China Prepares To Examine MS Windows Code

Stargoat writes "CNet reports that China is looking into MS's source code for Windows. They are looking both to increase security as well as perhaps create a Chinese version of Linux. Or are they perhaps concerned with rumors of deliberate holes left in the software for the NSA to exploit?" Here's an earlier Slashdot post about the Microsoft-China agreement.

Comments

Would You Trust a Chinese OS?

[reallocate]

Don't know about any backdoors in Windows, but we all certainly have reason to distrust any OS sponsored by the Chinese government. They may have adopted a friendlier demeanor, but the folks who gave us Tiananmen still run the place.

Re:Would You Trust a Chinese OS?

[lanswitch]

The only 100% secure os is one that you write and maintain yourself. Provided your computer is physically secure as well...

So then you decide that you have to trust others in order to get an os. But who are you gonna trust? Governments like the Chinese? The EU? Multinationals like Microsoft? That doesn't sound secure to me. There is always the chance of compromise for various reasons, and you won't be able to find out.
The only way around this is very well known. The source must be available for all to see and scrutinize. This is the only way to ensure that software only does what you want it to do. This is one of the strong point of Open Source Software.

Re:Would You Trust a Chinese OS?

[Anonymous Coward]

I'd trust it MORE than an American OS. What need does the Chinese Government have for backdoors in internally used software?? These are people that will simply grab you on vague suspicion of anything they don't like, torture you until you admit to whatever they like, and then execute you -- all before breakfast.

Re:Would You Trust a Chinese OS?

[Pave Low]

Wow..this straining, twisting, and bending to equivalate the US to the Chinese government is just too much.

You try to compare Kent State, where 4 people were tragically killed, to Tianamen Square where hundreds, possibly thousands were deliberately massacred (the exact number will never be known since the Chinese government bans all discussions of the incident). Never mind that it was the National Guard directed by the state governor, which is not the same as the Federal Government . Unlike in China where it was a military action conducted by Beijing and the PLA.

So, no, the US has not had it's share.

if Chinese government servers run Windows

[SHEENmaster]

Then the entire security model rests in NSA translators knowing the traditioonal chinese word for RCP and the servers having enough bandwidth to support VNC or Terminal Server.

The NSA won't bother with any backdoors beyond a possible inclusion of Systram translation software.

not going to help

[lingqi]

1) as this post has pointed out, just because you get to look at the source does not mean it's secure. (the post is from Jeremy Allison on the security of Samba servers)

2) Besides, being closed source and microsoft, are they going to be able to [practically] compile windows and compare it to the actual version? Why do I doubt it?

3) even if you get to look at the source, then you'd have to look at the source of every security patch that comes your way too, because otherwise you can just put a hole in one of your patches and pretend it fixes such and such. I mean, it's not like this hasn't been done before (Germain police, Java Anonymous Proxy).

But then again Microsoft is probably just doing this for show anyway - bribe a few key officials so that there are too few people with too tight a schedule to examine all-too-much of bloaty code, and there you have it - "oh the code was examined and was ok" even though it's just a formality.

I say stay away from Microsoft on principle when you need to be sure that you are secure.

Re:not going to help

[randombit]

And what do you base that on? When is the last time they have secretly snuck in anything to their software that did anything to track you, database you, categorize you, spy on you, download your personal records, view your documents, etc?

If it makes you feel better, just think about unintentional holes. I'm sure you can think of one or two security bugs that have shown up in Microsoft products in these last few years, can't you? NT service packs have been known to introduce bugs in the past, and it's unlikely to believe this won't continue with Windows Update, etc. Just because there are no intentional backdoors doesn't mean it's secure.

Re:Whats the use?

[spektr]

Depending on the amount of source code provided you could ofcourse compile it and compare the resulting binaries.

Microsoft doesn't give you a compilable version of their code. That's the point.

Re:iptables --source winders_box -j DROP

[Saib0t]

Firewalls are all great, but unless you want to shut your computer from the outside world, they won't work.

Outgoing connexions are as much of a problem than incoming. If the software calls home to transmit information, there's not much you can do.
It doesn't even have to be automatic, a properly crafter answer to a software update request could trigger the transmission of information, for instance.

And even if the code the chinese govt sees doesn't have any hole, quid of the patches they WILL have to apply to their systems?

Bottom line: The only solution to having a computer that can't spy on you is having full access to the code that's running on it, both at install time and after...

Re:and if they steal it?

[radja]

>This is not very different from certain South American and African countries that demanded and received the formulae to certain drugs and then turned around and started making their own.

that was a GOOD thing, saving thousands of human lives who otherwise could not afford medicine. withholding a lifesaving medicine for your own profit is not a very nice thing to do.

Hows this...

[MaestroSartori]

1) MS shows Windows source to China, then produces kick-ass version of Linux. Kick-assedness taken back into mainstream Linux, thanks to the GPL.

2) MS has a look at shiny new-kick-assedness Linux source (hey, its open!), spots something similar to the code they showed China (or similar enough to please a finned lawyer-shark), sues everyone who ever used Linux, everyone who ever met them, and some people who look like them.

3) Profit!!! (by destroying, or at least hurting, many Linux vendors, and setting back the 'political' progress Linux has made with big business.

Clearly a level of exaggeration in there, but I wouldn't put it past those wily scoundrels at MS to be hoping for something like this...

Would You Trust an American OS?

[Anonymous Coward]

Don't know about any backdoors in Red Flag Linux, but we all certainly have reason to distrust any OS sponsored by the American government. They may have adopted a friendlier demeanor, but the folks who gave us Hiroshima, Nagasaki, Vietnam, the genocide of the First Nation, the CIA-sponsored overthrows of democratically elected governments in various South American states, the illegal invasions of Iraq and Afghanistan, and the lovely freedom of Guantanamo Bay still run the place.

Re:Would You Trust an American OS?

[Anonymous Coward]

Last time I checked, Congress gave the President authorization to invade Iraq and Afghanistan.

Or do you mean 'illegal' in the sense that the real world never has and never will sympathize with hippy ideas of peace and love and flowers strewn everywhere?

Re:Would You Trust an American OS?

[kinnell]

Last time I checked, Congress gave the President authorization to invade Iraq and Afghanistan.

They are illegal in the sense that there are agreed international laws which the USA is a party to.

Re:Would You Trust an American OS?

[fondue]

It's funny when Americans notice there are other countries for the first time.

Now go and read about how international diplomacy works, and stop making an ass of yourself.

Re:Would You Trust an American OS?

[Felinoid]

the illegal invasions of Iraq and Afghanistan

Any time someone dose something someone else dosen't like you'll find someone quoting laws that do not exist.

IANAL but if there is any law forbidding war it can not possably be legal.

I'd also like to say that the folks who established many of the sighted problems are in fact not in power anymore.
Tell you what... Remove "illegal" and replace "the folks" with "the government" or better yet "the offical policy".
Oh yeah and that line about "friendlier demeanor" your kidding right?

However Microsoft Windows isn't sponsered by the United States government.
Not that this is any great distiction.
On the other hand we do have the source code. Ok well we may not have source code comming back from China but if we recreate RedFlag from source I doupt there'd be any back doors.

Turst the american government? Only so much as the freedom of information act is honnored.
Turst the Chines government? Only so much as I can review the source code?
Trust the Cannadian government? Only so much as they havn't invaded... yet.... give em time they'll get pissed off enough some day.

Trust but verify....
Show me the source.

Re:Would You Trust an American OS?

[Pave Low]

You've provided nothing that shows the US war was illegal.

The UN Charter is not law or canon, and nobody will be taking the US to court anytime soon.

Re:Would You Trust an American OS?

[Mr. Show]

From the CIA world factbook entry on the USA:

International organization participation: AfDB, ANZUS, APEC, ARF (dialogue partner), AsDB, ASEAN (dialogue partner), Australia Group, BIS, CE (observer), CERN (observer), CP, EAPC, EBRD, ECE, ECLAC, ESCAP, FAO, G-5, G-7, G- 8, G-10, IADB, IAEA, IBRD, ICAO, ICC, ICCt (signatory), ICFTU, ICRM, IDA, IEA, IFAD, IFC, IFRCS, IHO, ILO, IMF, IMO, Interpol, IOC, IOM, ISO, ITU, MINURSO, MIPONUH, NAM (guest), NATO, NEA, NSG, OAS, OECD, OPCW, OSCE, PCA, SPC, UN, UN Security Council, UNCTAD, UNHCR, UNIKOM, UNITAR, UNMEE, UNMIBH, UNMIK, UNMISET, UNMOVIC, UNOMIG, UNRWA, UNTSO, UNU, UPU, WCL, WCO, WHO, WIPO, WMO, WTrO, ZC

From here you can do your own research into which international laws the US is bound by. Or am I being overly optimistic?

Yeah, but what does this dump of acronyms prove exactly? Did the World Health Organization, just to pick one, pass some kind of resolution that said the US could not invade Iraq? You have to understand the specific international laws relevant to Iraq, and have at least a loose understanding of how law works generally. Simply citing that the US is a member of ASEAN does not make your case. For example, the US argued with some merit (regardless of whether you agree with it) that Iraq stood in violation of some 12 or 13 UN resolutions requiring it to "disarm," including the most recent resolution 1441 passed unanimously by the Security Council last February (if memory serves). That resolution warned of "serious consequences" if Iraq did not disarm, and at the time of the invasion, the US government was making the case that Iraq had not disarmed and therefore "serious consequences" would ensue.

It does not matter whether or not you agree with this interpretation. What matters is that the language was sufficiently vague to allow for this interpretation. The language was also sufficiently vague for countries that opposed the war to plausibly argue that the US needed more explicit authorization from the Security Council before resorting to force. But given the "serious consequences" mentioned in 1441, and given the previous 12 years of UN resolutions demanding certain action by Iraq (which no one in a position of authority in any country seriously believes they ever obeyed), the US would probably be acquitted if brought before an international court, assuming standards of proof similar to those in US courts (beyond a reasonable doubt). But you have to understand that in February, when 1441 was passed, the US knew it was going to invade Iraq almost regardless of what they did to disarm. Therefore why would the US write a resolution (and it wrote 1441 itself) that it knew it was going to probably break in a few months? No, instead it gave itself enough flexibility in the language to do what it wanted to do "within the law." Such is the nature of international relations, and such is the way it will probably always be.

Re:Would You Trust an American OS?

[dinivin]

Saddam didn't attack his neighbors,

So I imagined that whole invasion of Kuwait when I was in High School? I knew I had an activate imagination then but I didn't know it was that active.

Dinivin

Re:Would You Trust an American OS?

[reallocate]

>> Or perhaps we just wanted them to surrender before the Russians got in.

That's revisionist history that I disagree with, but, even if true, so what? It's a legitimate motive. The fewer people brought under Stalin's yoke, the better.

What possible reason was there for Nagasaki anyway?

Because the Japanese didn't surrender after Hiroshima. The deaths at Nagasaki were fewer in number than the projected deaths during an invasion of Japan. The fact that they were caused by a nuclear weapon has no impact on the ethics of the situation. 100,000 people killed by infrantrymen and carpet bombing are just as dead as 100,000 people killed by a 20-kiloton weapon. The Japanese fascists, not the U.S., bear responsiility for what happened to their country.

Couple of questions

[tsetem]

Considering China's respect of Intellectual Property, and their desire to create a custom version of Linux to break the Microsoft monopoly, What is to prevent China from looking at the Windows Source, and then taking the good parts out and inserting them into Linux (or derivative utilities). What if they saw how the whole Active Directory authentication stuff worked, and enhanced Samba?

I mean that could really be interesting. Genuine MS protocols in the Linux kernel. Microsoft would be pissed because of IP theft (ala SCO). But what could Microsoft do? Sue China?

Re:Couple of questions

[fermion]

I don't think it matters. MS is looking at a situation where it's products are being rejected by large portions of the world. The only reason that MS can use close standards and be so firm on copyrights is because they own most of the OS on all of the computers that matter. If the world standardizes on another OS, then MS will have to open up it's software just so the west can do business with the east.

So this probably poses no net loss to them. If the source ploy works then they win because the government will use windows and therefore the citizens will be more comfortable using widows as well.

If the chinese government looks at the source and copies the protocols into their linux, MS still wins. MS will be able to keep the standards closed in the west, where they make most of the money, while still be able to advertise that the systems will communicate with those in the east.

If the chinese government releases the linux source with the borrowed MS protocols, the MS wins doubly. There is no way that those enhancements will be included in a western Linux, and it would be very difficult to independently engineer the enhancements in such a way that there would not be significant copyright issues.

In any case, MS can change the protocol at any time, as it did with it's IM service, or even purposefully create messages that will break the competing service, as it did to Navigator.

Re:Can China regerate a standard build ?

[Dot.Com.CEO]

Just out of interest, have you ever used VS.NET? Say what you will about their OSes, but VS is an amazingly well built IDE.

Re:Funniest line in the article

[Anonymous Coward]

Don't y'all get it? The next cut of Windows will sell for $30 in China while selling for $300 here. Just take a look at what the drug manufacturers, clothes manufacturers, and book publishers are doing. It's very frustrating when your classmates show up with their Prentice-Hal textbooks that cost $6 in India while you paid over $60 in the USA and the only difference is theirs says "International Edition" and "Not for sale in the USA".
In fact, I'll bet the deal went more like this:

MSFT: Let us sell windows.
China: We want the money.
MSFT: You can get a cut, call it tax.
China: Our people don't have much money.
MSFT: We'll charge whatever the market will bear.

So, now Gates have to make a "Chinese" version that cannot be made to run with the English language to avoid people selling $30 chinese windows for use in the USA.

Timing

[Nishi-no-wan]

Did anyone else notice that it was soon after Balmer testified in the anti-trust sit-com about how revealing Microsoft's source code would be a national security threat, that China and several eastern European countries bought into Microsoft's Shared Source inititive?

Re:iptables --source winders_box -j DROP

[GigsVT]

The only solution to having a computer that can't spy on you is having full access to the code that's running on it, both at install time and after...

You'd have to read and understand all the code, and then compile from that code. Something I am willing to bet very, very, few people do for every piece of software they run.

Even then, you'd be vulernable to compiler based attacks, although I don't know if anyone has successfully pulled that off.

Regarding firewalls, I hope you're aware that you can filter outgoing traffic as easily as incoming. Regarding the malicious service masquerading as a legitimate one, the only solution to that is cryptographic signing for authentication, and even then, you are still trusting the party to not do anything malicious, the signing just proves that the person is who you think it is.

Re:Can China regerate a standard build ?

[CommandNotFound]

Just out of interest, have you ever used VS.NET? Say what you will about their OSes, but VS is an amazingly well built IDE.

Yes, I use it all day, every day, and I just don't see what the big deal is. Those who have confined themselves to the VB ghetto the past ten years are wowed; ditto those who have been using textpad, but having used other IDEs in the past 5-10 years (Delphi, Eclipse, JBuilder), I just don't see the big deal. It's well-built, but it's a rehash of other products. I wouldn't call it "amazing". The web service tools are the only really impressive part I've found that differentiates it from other IDEs. And I hate that I am confined to one OS for every piece of software that I ever write with this thing. I certainly wouldn't use it if I wasn't getting paid to.

Take a look at Eclipse, and I will put money that VS 2005 (or whatever) will "innovate" many features of that IDE, like the very nice lightbulb feature. And those who only get their news from MSDN emails will praise Microsoft for being so fresh and innovative.

Re:national security risk

[Sajarak]

Assuming that software is made more secure because access to the source code is restricted is a bad policy as it is just another form of security by obscurity. Even if the Chinese government didn't have the source code to Windows there would be nothing to stop them from reverse-engineering it. It would take them longer, but if they wanted to find holes then I'm sure they could.

In fact, you could even argue that closed-source favours the "bad guys" because only someone who stands to gain personally would want to invest their time in reverse-engineering and decompiling proprietary code. A better option is to design your software well and make the source code available to everyone, that way you're making it easier for people to find bugs and are more likely to get told about them when they do.

Proprietary operating systems are a national security risk and should be treated as such.

Indeed...

Re:Why on earth would...

[Overly Critical Guy]

Actually, the NT kernel is considered a very advanced piece of technology. I'd heard many developers blast the Linux kernel in comparison. It's all the cruft written on top that sometimes causes problems (just like in Linux, amusingly).

Heavens, no!

[Overly Critical Guy]

We're too busy playing "enlightened liberal" and trying to feel superior because we're against the grain by being overly critical of American actions and ignoring the atrocities of foreign countries! Stopping WWII after being attacked out of the blue (so much for isolationist America) is now an aggressive evil.

It's okay for Saddam to have stayed in power and continued torturing and stealing from his own people, because then we wouldn't have gone in "illegally" to overthrow their government.

Re:Whats the use?

[wawannem]

What you are referring to isn't a True example. It is a theoritical example.

It is clearly presented in Ken Thompson's famous paper "Reflections on Trusting Trust." It is a very good point, how much can you trust, well, trust...

I trust things to the extent that, if such exploits exist, I would be 0wn3d and there would be nothing I could do about it...

However, so would everyone else, and I am sure there are much more interesting machines to r00t than mine. By the time the l337 haxx0rz got to my machine, the exploit would have been discovered and made headlines...

I have spent a little time in IRC, and I read /. I know that doesn't make me an authority, but I have learned that most of these black hat types are so driven to earn karma from others that they couldn't keep a secret if their livelihood depended on it. To me that means, if they knew about it, so would everyone else in the world. Also, if they find out about the existence of any exploits like this, they would blab.

Therefore, I don't lose any sleep over it, and I figure I'll deal with the problems as they are discovered, and not ponder how many ways a compiler can insert malicious code.

Next stop: another OS

[MickyJ]

Having worked closely with Chinese developers (and companies) in China, Hong Kong, and Singapore over the last ten years I can tell you right now what the outcome of this inspection will be: "We can do it better!"

They have absolutely no intention whatsoever to buy or use Windows. They will develop their own OS (probably based on Linux) and copy anything and everything they can from Windows while proudly proclaiming that they did it all themselves, and that it's much better than that "imperialist crap" from the West.

the NSA does not need Microsoft to create holes...

[The Lynxpro]

Why would the NSA rely on Microsoft to create security holes in Windows? If Microsoft cannot be trusted to patch holes they mistakenly placed in the OS, how can the NSA trust them to actually produce reliable security holes for breaching? I'm sure the NSA has viewed Microsoft code long before. All it would take would be to use Echelon's combined computing power for probably a couple of minutes and they could find all the hidden BSD code buried deep within...