How can I ensure that some OS can be trusted? I'm not speaking about possible security problems which can happen everywhere but about something like a backdoor left by a developer. Can such a thing occur (Or had they occured) in Windows, or in most popular linux distros like Debian/Fedora/Arch/Ubuntu/Gentoo?

  • 1
    Well, if you haven't heard the news from the past several years, there have been allegations that Microsoft co-operated with a certain government organization, and that Linus Torvalds had been approached by the same to put backdoor into kernel. But those are allegations. Can backdoors occur ? Potentially. More likely issue I'd worry about is bugs that can be exploited, specifically in drivers and user's applications. – Sergiy Kolodyazhnyy Feb 19 '19 at 20:55
  • 1
    You may like to read An attempt to backdoor the kernel, from 2003. – forest Feb 20 '19 at 4:27
  • 1
    Linux Mint had a backdoored download blog.linuxmint.com/?p=2994 – multithr3at3d Feb 21 '19 at 1:59

There are two ways: inspect every line of code, or build your own OS. Not only the OS, but all the libraries, the compiler, everything that touches your source code.

A backdoor can be deployed? Yes. But on any open source OS (Linux, OpenBSD, Plan9 et al) any backdoor can be detected by other programmers, the same cannot be told about closed sourced OS (Windows and MacOS came to mind).

|improve this answer|||||
  • To be fair, OSX has a lot of open source components, and there are a lot of people reverse engineering Windows. But it is true that far fewer people will be analyzing Windows since it's a lot slower to audit something by reverse engineering it. – forest Feb 20 '19 at 4:26
  • @forest: the build process of OSX is still behind closed doors and therefore not auditable, so the open sourcedness of those components is much less convincing. Many open source distros invests efforts into making build reproducibility for this reason. – Lie Ryan Apr 4 '19 at 9:23

It's relatively easy to check the development history of an open-source operating system, on github or elsewhere. If there are more than a few developers, and they are working under their real names, then you don't have to audit each line of code; you already know that each line of code has already been audited before it gets put into the "official" codebase. You can probably compile from source if you study the docs.

Yes, it is possible to hide backdoors and malware in software where the code is open to scrutiny; there are even software writing contests based on exactly that. (See the Underhanded C Contest in wikipedia.) However, "underhanded" code is necessarily spaghetti-ish and violates good SDLC practices; open-source software is necessarily optimized for readability and maintainability. Nobody would be allowed to put a machine code snippet in a C constant, for example, in a commercial software product; much less in an open-source community project.

Also, don't underestimate how difficult it is to write and deploy malicious code that actually works as intended. Just because an exploitable attack vector theoretically exists, and has been documented in a bug report somewhere, doesn't mean somebody has actually spent the development hours necessary to exploit that bug in a way that is both scalable, and undetectable to the user. Much less, undetectable to fellow developers.

And besides, open-source software is less vulnerable to malware and remote-code execution exploits, simply because of the variety of distros; it's harder to create malware for them. If you use a linux variant, and accidentally encounter a malicious attachment or some sort of drive-by download, it will almost certainly be a Windows executable. You will laugh out loud and simply delete it.

TLDR: Don't be paranoid... you can trust any half-way respectable open source project.

|improve this answer|||||
  • I'm familiar with the conspiracy theory (and underlying facts) of the "_NSAKEY" story, regarding a commercial, consumer-grade OS. Obviously that can't be done with an open-source project, for reasons elaborated above. – Jay'z coding habit Apr 3 '19 at 23:43
  • I would further add that, even if you do "trust" an open source OS enough to use it, it is still advisable to reverse engineer critical component, if you have the capability. Shared libraries, networking stacks, firewall rules and implementation, crypto tools, etc. Disable unwanted/unneeded hardware drivers that come bundled in. But it would be unadvisable to believe you must audit every line of code. – Jay'z coding habit Apr 4 '19 at 0:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.