Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD.
I'd like to know if there are any other references to this issue. This would help in my Thesis addressing this or similar issues.
Could you recommend reliable resources, preferably academic papers?
(BibTex compatible is preferable)
You should understand the OpenBSD allegations better before, no such thing as a backdoor was found. And it's mostly HOAX and FUD spread thanks to blogs and other funky websites that spread the rumor about an actual backdoor existing in the recent OpenBSD code. You might want to know exactly how it turned out before writing your Thesis.
Actually this was thoroughly discussed on the openbsd-misc/openbsd-tech mailing lists, you can access the archives easily.
The OpenBSD leader was contacted by an ex FBI agent or something who made allegations regarding some backdoor code implanted in the past by the FBI.
This led to a complete review of the source code by skilled developers, even not participating in OpenBSD's development. Not a single piece of what can look like a backdoor was found. Some bug fixing and improvements were possible thanks to this review, so in the end, these allegations made OpenBSD more reliable I guess.
You will find many many more details on the mailing list, use google and check for this thread: http://marc.info/?l=openbsd-tech&m=129236621626462&w=2
Very good subject, good luck with your Thesis.
EDIT: BTW, some people say bullshit on the ML, just dig through all the mails and don't make up your mind after reading one mail. Otto, Theo, Marc and Stuart are reliable, take their word for granted, they know what they are talking about.
EDIT2: One more interesting point is the bounty some people put up to encourage others to look for the backdoor.
EDIT3: Apparently I couldn't clearly express myself in my comment:
"I am not aware of other issues actually, as they say on the ML, the code changes fast and bugs happen all the time. However, what you can check is which where the remotely exploitable bugs on OpenBSD default install, they boast having only a few in a heck of a long time. It might be interesting to see how they happened"
I am not aware of any other issues concerning allegations of backdoors in OpenBSD. The code changes fast, even if the allegations are true and there had indeed been a backdoor introduced, it's most likely been fixed as a side effects of continuous development and auditing through time. OpenBSD claims on its webpage: "Only two remote holes in the default install, in a heck of a long time!". So it's worth looking these two remote holes, how they were introduced and why. This could add some relevance to the Thesis, one could analyze how related or unrelated to a third party (governments, ...) these two critical issues were.
The closest thing I've seen to what you're asking (and it has nothing to do with state-sponsorship) is this speech by Ken Thompson during his Turing Award Lecture. It basically asks the question, if the gcc compiler was at one point poisoned to produce compilers which produced backdoor-ed code, and then the was used to compile gcc for a number of major distros and subsequently the code was destroyed, would we ever know?>
This is more a thought experiment on what could potentially happen if someone were to attack systems high enough up the stack. Interesting concept, there are ways to automate the output of a compiler to ensure that it's sane (assuming your tools were compiled with a good compiler...) but as far as I know they are not implemented on any of the major open-source projects.
