5

After reading different articles, most notably/concerningly:

I am wondering: How can I be sure that my toolchains and application software are not compromised?

The obvious but elongated answer is to write a compiler in machine language for a specific processor, then an OS, and so on up from there. (Though this does not discount the possibility of hardware compromise.) Open source software is fantastic, but that does not remove the possibility of a Kevin Thompson-esque hack such as not allowing a compiled application to open a connection on TCP Port 12345 (for example), and seamlessly bridging it to (say) 12344 unless certain conditions are met. (Critical for an application like nmap).

How likely are these essentially "invisible" exploits that are baked into our software without our knowledge?

closed as too broad by GdD, Xander, schroeder, TildalWave, Bob Brown Feb 8 '15 at 17:29

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Have you read this? (Note that the article is not quite right; V and W wouldn't necessarily be bitwise different, it's just that the efficacy of the attack would be bounded above by how often they're different. – user49075 Feb 2 '15 at 9:34
  • @RickyDemer I like that as a possible approach, however is it reasonable to assume that compilation is 100% deterministic these days? I have heard several (anecdotal) testimonies that optimisations or even instruction choice may be somewhat random... – Ephemera Feb 4 '15 at 5:48
8

Actually, you cannot. Even without speaking of an actual compromise, from a security perspective you may assume that your application already contains bugs which can be at least be as effective than a software compromise.

That's why, when building a secure system, your security must not rely on a single tool. Instead, you must use a layered security approach, the final application being in the center, adding several layers of security over each one with the following approach:

  • The outer layer N+1 is in charge to control the security of the inner layer N,
  • While there can be a way to pass data/session from layer N+1 to layer N (think about proxies, firewalls, etc.), there must be no easy way to pass from layer N to N+1.

Such scheme can be achieved:

  • On a host using a combination of all different segmentation tools provided by you OS (each service running a different user with minimum rights, use of jails/container/..., etc.),
  • On a network using proxy, firewalls, NIDS, monitoring, etc. (it might be a good idea to use slightly heterogeneous platforms)

This will provide you two advantages in case of any kind of backdoor would be used:

  • Unusual activity has by far more chances to be detected since it would at least require some time before climbing up the layers,
  • If you set your system right, the flaw will be limited to the area actually accessible to the backdoor, all the rest of the data will remain safe.
7

One of the articles you link to -- If the NSA has been hacking everything, how has nobody seen them coming? -- makes an assumption in posing the question:

"If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them?"

The premise for this question is incorrect, because for all we have found out about the NSA's advanced capabilities for attack, we have also found out that they are highly reluctant to use active attacks and that their internal procedures even state to stop if anything looks odd, or if signs of for example intrusion detection tools are detected. (I seem to recall Tripwire being specifically mentioned in this context somewhere.)

The NSA's modus operandi appears to be primarily passively monitoring, occasionally infiltration of juicy targets, and rarely active, simply because active attacks stand the risk of being detected. Likely even more so these days now that knowledge of the threat, if likely not anywhere near every specific attack, is out in the open. Yes, active attacks get used, but as they come with the risk of being detected and possibly even reverse-engineered (depending on the target's perceived and actual capabilities) they get used far less often than one might perhaps get the impression of.

By, as GZBK wrote, implementing a multi-layered approach to security, including mundane bugs, you also reduce the impact of a breach. And since for just about anyone mere mundane bugs are almost certainly far more likely than being hacked by the NSA and having backdoors implanted in software, this protects you against a significantly more likely threat while also providing you with a degree of protection against the less likely threat.

A tool such as a compiler or operating system is a highly complex piece of software, and standard software development processes are nowhere near as rigorous as those found for example in space hardware or aviation. The odds of a mundane bug making it into an operating system seems significantly higher than you being targetted by a nation-state level adversary. That doesn't mean to completely dismiss the possibility of nation-state level attackers, but it does mean to prioritize and implement reasonable countermeasures based on the determined threat model. Scare mongering may help a politician get reelected, but it isn't a good approach to general security.

  • On the last paragraph, in case you are big enough to be afraid of being targeted by the NSA, it would perhaps be more cost efficient to take an existing small OS and do a thorough in-house review for backdoors (and, while you are at it, bugs). – Davidmh Feb 2 '15 at 14:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.