Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
This question covers the risks of accepting Binary blobs in one's distribution.
This may be a very paranoid conspiracy question. But considering all the topics regarding the NSA in 2013 one cannot help thinking that the binary blobs in the Linux kernel could contain explicit security holes.
Where most of the blobs consist of sound and graphics drivers, has anyone confirmed an intentional security hole in any of the blobs?
The problem with an intentional security hole is that it looks exactly like an unintentional one. A well done attack shouldn't be detectable as anything more than a coincidental error. It is really a your guess is as good as anyone else's type scenario. Best practice if you need a high level of security is to firewall your system to prevent external access and control what it can send out. It at least limits the possible damage of any kind of breach, including much more likely malware threats, since even if the NSA did put in a backdoor, they are most likely not going to use it on you. It's still a vulnerability that exists, but it isn't inherently any more of a threat than any other unknown vulnerability that may be in some zero day war chest somewhere.
