0

This question covers the risks of accepting Binary blobs in one's distribution.

This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot help thinking that the binary blobs in the Linux kernel could contain explicit security holes.

Where most of the blobs consist of sound and graphics drivers, has anyone confirmed an intentional security hole in any of the blobs?

  • Binary blobs are not drivers, but firmware, i.e. code that executes on a processor other than the main CPU. This can be just as bad, security-wise — but you're already trusting the hardware designer, so all you really need is to know that the binary blob comes from the hardware designer. – Gilles Feb 5 '14 at 20:02
  • @Gilles Not all binary blobs are firmware. They may be data tables or configuration blobs. – forest Nov 1 '18 at 7:54
2

The problem with an intentional security hole is that it looks exactly like an unintentional one. A well done attack shouldn't be detectable as anything more than a coincidental error. It is really a your guess is as good as anyone else's type scenario. Best practice if you need a high level of security is to firewall your system to prevent external access and control what it can send out. It at least limits the possible damage of any kind of breach, including much more likely malware threats, since even if the NSA did put in a backdoor, they are most likely not going to use it on you. It's still a vulnerability that exists, but it isn't inherently any more of a threat than any other unknown vulnerability that may be in some zero day war chest somewhere.

  • If the NSA put in a backdoor, even if they did not care about using it on you, some clever hacker might discover it and sell it for a hefty price to someone who will use it on you. NOBUS is BS. – forest Nov 1 '18 at 7:53
  • @forest sure, but that is just as likely as finding an unintentional one. If it's hidden well enough that nobody found it yet, it's probably not that obvious. – AJ Henderson Nov 1 '18 at 12:06
  • Indeed. My point is that intentional backdoors are not less of an issue for you than unintentional ones, even if the NSA is not out to get you. Bugdoors can be as nasty as nasty bugs. – forest Nov 1 '18 at 12:07
  • Yes, we agree. I'll make an edit to the answer later to make that a bit more clear. My point was primarily that it's not really distinguishable from the threat of bugs or any unintentional zero day held in a warchest that could be compromised. – AJ Henderson Nov 1 '18 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.