Secure OS Gets Highest NSA Rating, Goes Commercial

ancientribe writes "A hardened operating system used in the B1B bomber and other military aircraft has now been released commercially, after receiving the highest security rating by a National Security Agency-run certification program. Green Hills Software's Integrity-178B operating system was certified as EAL6+, which means that it can defend against well-funded and sophisticated attackers." The company is not saying how much the OS would cost a potential customer: "The system and its associated integration and consulting services are custom solutions." Both Windows and Linux are EAL 4+ certified, which means they can defend against "inadvertent and casual" security breach attempts.

Comments

Let the Testing begin...

[sbenson]

Now let people who don't have financial ties test it.

Re:Let the Testing begin...

[Verdatum]

The financial ties involved in EAL evalution are pretty loose at best. I'm more familiar with FIPS and Orange Book evaluation, but assuming the processes are similar, evaluation is done a an independent third party organization; usually as a result of a requirement stated in a government contract. There is not much in the way of monetary incentive for the evaluation group to rate a product any higher than it deserves to be.

That being said, I don't believe EAL6+ requires any additional vulnerability testing beyond that of than EAL5+; it is mostly just a stricter evaluation/review of the soundness of the OS design.

Re:Let the Testing begin...

[mixmatch]

I doubt the OS developers will 'release' it for public scrutiny. This is likely to be a costly solution sold to high bidders.

Re:Let the Testing begin...

[sbenson]

If it is Internet facing, it's an open test bed.

Re:Let the Testing begin...

[Isao]

Ok, here are some real facts about how this works.

Under the Common Criteria (CC), people with financial ties create the product. They (or another sponsor who wants the product evaluated) pay an independent lab (CCTL) to evaluate it. Labs are certified by NIAP, a partnership of NIST and the NSA Information Assurance directorate. (The NSA has two main parts, the other is Signals Intelligence.) The independent lab evaluation is overseen by a Validation team employed by the government, who reviews the process and results of every evaluation, including all vendor evidence, before it is certified. The Validators also oversee the labs for proper execution of the CC. Once it passes all these reviews successfully it is certified.

Certifications are tiered by Evaluation Assurance Levels (EALs), from 1 to 7. Generally, the higher the EAL, the greater confidence there is in the vendor claims. This is NOT the same as being more secure!

The way to use these certified products is to select a product family (say firewalls), and review at a minimum two documents: The Security Target (ST) and Validation Report (VR). The ST is written by the vendor or sponsor, and basically contains the security claims they're making for the product, and how they expect the product to be used. The Validation Report describes how those claims were evaluated, and what notable things the Validation team observed during the evaluation. After reading both of these documents (usually not more than 100 pages - pretty short for 1-2 years of work) you can determine if the product can be used in its certified configuration in your environment.

Check out some interesting operating systems, like Windows XP, Mac OS X, or one of the Linux's.

It's certainly not perfect, but it's better than what we had.

Re:Let the Testing begin...

[MikeBabcock]

You've never worked in government, have you?

2005 is the modern era for a government OS review.

Re:Let the Testing begin...

[interploy]

Any rich nerds want to give this a go?

n/t

[KasperMeerts]

I'm sorry if I take a test that gives Windows and Linux the same security rating not very seriously.
Also, how can they test this? The only way to properly test something like this is to let it out in the wild for a decade or two. That's not something you can imitate in a testing room.

Re:n/t

[characterZer0]

EAL does not mean what you think it does.

http://en.wikipedia.org/wiki/Evaluation_Assurance_Level

Re:n/t

[moderatorrater]

Source code audits with automated scripts that attack every port and every program checking for buffer overflows or other avenues of attack. It would require a lot of work, but it makes sense that the NSA would put in a lot of work to explore these operating systems, both to know how to secure against attack and to know how to pull off an attack against another country. The real question is, how much do you trust this OS not to have an NSA back door?

Re:n/t

[blhack]

Also, how can they test this? The only way to properly test something like this is to let it out in the wild for a decade or two. That's not something you can imitate in a testing room.

You forget the the NSA pretty much recruits the best and brightest hackers that the world has to offer. Their policy of "we don't have a budget" and the oppurtunity to work on the absolute cutting edge (and actually see it put to use) is pretty much the most kickass thing that you can offer somebody who has a passion for knowledge.

Re:n/t

[negRo_slim]

I'm sorry if I take a test that gives Windows and Linux the same security rating not very seriously.

Don't be a pussy this guy sounds legit.

Re:n/t

[mcgrew]

I also noticed that TFA didn't say what EAL stood for or who did the certification, or how. In fact, it was incredibly short on details. About the only thing TFA said that wasn't in the summary was that this OS runs in hardware, and you can run Linux, Windows, or Mac on top of it.

Re:n/t

[MozeeToby]

Most likely they aren't 'testing' security to determine a rating. They are probably looking at architecture, design, rigorousness of developement process, and source code (if available). I imagine they see having the source code available as a negative for Linux simply because it gives would be attackers much more information about the system than is otherwise available. Combine that with the fact that the Open Source process isn't as complete as it could be and it's not at all suprising it recieved the rating that it did.

Re:n/t

[Smidge207]

A dog and a horse both have four legs but, they do have several other differences.

Agreed: the size of their respective cocks, for one

=Smidge=

Re:n/t

[thermian]

I imagine they see having the source code available as a negative for Linux simply because it gives would be attackers much more information about the system than is otherwise available.

That theory is one touted by commercial OS vendors, and its been thoroughly disproved. Availability or otherwise of source code has no effect on the hardness of your OS. If anything having it available is even safer, because its a heck of a lot easier for people to point at a problem bit of code and say 'fix that bit now'.

What causes the problem is non rigorous OS design. Hiding the source won't help you protect your clients from a design flaw which allows them to be attacked.

The OS in question here however is most likely quite rigorously designed, and won't have a lot of the bloat that causes desktop OSs so many problems.

Re:n/t

[webscathe]

Sure you read TFA?

"After receiving the highest security rating by a National Security Agency (NSA)-run certification program..."

Re:n/t

[Zackbass]

Then why are they recruiting some of the best mathematicians I know?

Re:n/t

[CaptainPatent]

Indeed, I was looking at that too and some interesting points from the wiki article:

To achieve a particular EAL, the computer system must meet specific assurance requirements. Most of these requirements involve design documentation, design analysis, functional testing, or penetration testing. The higher EALs involve more detailed documentation, analysis, and testing than the lower ones. Achieving a higher EAL certification generally costs more money and takes more time than achieving a lower one. The EAL number assigned to a certified system indicates that the system completed all requirements for that level.
[...]
Technically speaking, a higher EAL means nothing more, or less, than that the evaluation completed a more stringent set of quality assurance requirements. It is often assumed that a system that achieves a higher EAL will provide its security features more reliably (and the required third-party analysis and testing performed by security experts is reasonable evidence in this direction), but there is little or no published evidence to support that assumption.

So basically it costs money to get EAL verified, and the farther up the scale you go, the more money it costs to run the testing. So even if a Linux distro wanted to be verified at a higher level - who's going to fork over the dough?

Additionally this seems to be a hired method of testing and bug report/fixing. Just because they fix the bugs found at one "level" of testing does not mean there aren't missed holes. Additionally it doesn't mean that a well written piece of software isn't capable of a higher rating with little or no fixes (like the Linux kernel probably is.) It is impressive that Integrity-178B achieved the EAL-6+ rating because it has definitely been put through its paces... and due to the way it was designed it probably has very few holes in it, but EAL should definitely not be the end-all be-all judge of OS quality.

Re:n/t

[madsenj37]

It most likely has to do with defaults and not abilities. But that is just a conjecture on my part.

Re:n/t

[Drawkcab]

The source code in this case is available both to the NSA testers trying to hack it as well as to customers. "Security through obscurity" isn't good enough to get that level of EAL certification. It requires going through each line of code and proving that its secure, even to someone who knows exactly how it works. It would be theoretically possible to do it with open source, but it would require an extreme degree of organization and discipline compared to normal open source projects.

Re:n/t

[Anonymous Coward]

Not true. Their are lots of civilians. I know this from first-hand experience.

Re:n/t

[thedonger]

That is, "there," not "their." Don't I feel stoopid.

Re:n/t

[betterunixthanunix]

Actually, the security of a system should not depend on hiding the operating details of the system. The EAL levels are based on things like audit logs, privilege separation, the ability to kick a user off the system and kill all their processes, etc. The availability of the source is neither a positive nor a negative on EAL ratings.

Re:n/t

[the_other_chewey]

So basically it costs money to get EAL verified, and the farther up the scale you go, the more money it costs to run the testing.

Is Scientology somehow involved in this?

Re:n/t

[Drawkcab]

This OS comes with source code that you compile yourself. High security developers can't just take another companies word for what their OS is doing. So you would be able to inspect the source code for a potential backdoor.

Re:n/t

[lanterndog]

Yeah... I majored in pure math (e.g. abstract, theoretical stuff) in college. I was good. The NSA was all over me. I didn't accept, obviously (I wouldn't be able to admit this if I had. :) They recruit lots and lots of math people. Very few CS people (I double-majored in math and CS. Google and MS tried to recruit me through CS). However, I will get flamed to the end of the earth for this, but it's my experience: Mathematicians are insanely more intelligent than CSers. That, and cryptography (which is why the NSA exists) has much more to do with mathematics (Algebra and Number Theory especially) than it does with programming or OS design.

Re:n/t

[Anonymous Coward]

My question to blanket statements like this is always, "Which version of Windows?"

Give me any of the NT family of Windows (pro or business editions as the case may be) and I can configure them to be as security as any version of Linux.

The main problem with both Windows and Linux is they are not secured on initial installation and in home use, people often run with higher privileges than they should.

I have never had a Windows computer or server of mine infected or compromised. It is possible to do.

Re:n/t

[Anonymous Coward]

Don't I feel stoopid.

Especially so after you forgot to check 'Post Anonymously' the second time around...

Re:n/t

[powerlord]

Not to mention that the "certification" only applies to a specific configuration.

The best way to do something like this is to essentially take a "frozen" fork from an existing distro, pair it down to bare essentials (and what does that mean?), and then start on the mother of all code reviews.

Even if you got a sample paired down distro organized, you'd now have to Document it, and then turn it over and pay for testing (two things that the OSS community is usually poorer at than their Commercial brethren).

Re:n/t

[snowraver1]

Here is an example where the source code has led to a "hack"

If I remember the details correctly, they looked at the TCP stack for the linux kernel and found a section that was essentially labeled "This code is to catch errors. This code should never run", or something like that. They figured out how to make that code run (along with some other magic), and the rest is history.

The source code allowed the attacker to identify the issue, as well as find out how to execute it. When you are writing a program with millions of lines of code, there WILL be an error/hole somewhere. Both open source and closed source have holes, but open source provides you with the source code to explore as well.

Re:n/t

[zappepcs]

Perhaps what you might consider is: WTF? They can test that? So the NSA has been keeping a botnet going for testing of things like this?

Tinfoil hat types will be wondering how much the NSA has had to do with maliciousness on the Internet in general now.

Little Freudian slips like that will lead people to think that electronic/network spying and warfare is not something new to the US government nor is it something they know nothing about. Can you say 'underwater cable cuts' without getting cynical?

Yeah yeah, I know that's all conspiracy theory crap. You have to admit that news stories like this kind of lend themselves to that sort of thinking.

Re:n/t

[Anonymous Coward]

You apparently did not read the wikipedia article through. The reason that Windows and Linux (distributions) achieve EAL-4 rating is because "EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line."

Furthermore, "Commercial operating systems that provide conventional, user-based security features are typically evaluated at EAL4."

Higher levels require some sort of formal methods use in the design and testing. This is very unlikely to ever happen for Linux (it is virtually impossible to create a formal design retroactively; either it does not correspond to the system or it is just as complex as the system).

For this reason, Linux will probably never get any higher. Windows may just get higher, because it has a completely new security model and kernel, which are likely able to get EAL-6 grading in time.

Re:n/t

[orclevegam]

Cryptography yes, security no. Although cryptography is a very important tool in designing a secure OS, it's not the only one, and probably not even the most important one. Likewise for software in general. Cryptography is important for communications, and data protection which makes it important for communications between programs, and storage of programs, but actually ensuring the integrity of the system or application has a lot more to do with CS than it does Math. Both math and CS students can be equally smart, but in different ways. The math students will tend to be good at number crunching and abstract thinking, particularly in regard to projecting problems into various spaces where they can be solved using various functions. The CS students are going to tend towards a more systematic view of things in which they break problems down into sub-components without losing track of the larger picture and the way the various pieces interlock and interact with each other. You most likely perceive the math students as being "more intelligent" because you yourself are more inclined to the mathematical way of thinking about things.

When the NSA was first created the primary concern with regards to security was a combination of mathematical and physical problems. Mathematics in the form of encrypted communications, and physical in the form of ensuring that the people and/or documents that contained sensitive information and the devices used to cypher them were properly secured. With the rise of the internet and the switch to an increasingly interconnected infrastructure software security has emerged as a factor now. It no longer matters how good the encryption is between your two programs if the OS their running on can be compromised and the data scraped as the application decodes it (or better yet the encryption key itself). As such even though the NSA started as an organization specializing in primarily cryptographic systems it must expand to include software and hardware security as well.

Re:n/t

[Anonymous Coward]

This is Tom Cruise. You are in serious trouble for suggesting that all Scientology does is enrich its leaders. I'm going to sue you for all you're worth, which I'll kindly donate to my church.

Now, which other chewey do you say you are?

Re:n/t

[drsmithy]

So basically it costs money to get EAL verified, and the farther up the scale you go, the more money it costs to run the testing. So even if a Linux distro wanted to be verified at a higher level - who's going to fork over the dough?

Commercial Linux vendors like Red Hat, SuSe and IBM.

Certifications like EAL tell you about the technical capabilities of an OS. They don't tell you anything about how competently said OS will be used.

Re:n/t

[Haeleth]

You forget the the NSA pretty much recruits the best and brightest hackers that the world has to offer.

Erratum: for "the world", read "the USA".

Re:n/t

[jawtheshark]

Mathematicians are insanely more intelligent than CSers.

No doubt, and I say this as a CS. However, you won't implement a secure system without a good CS. The maths and the crypto, leave it to the mathheads. A secure architecure, with people that know how to avoid the typical security pitfalls... that's where you fine computer science people.

So, yes, they're smarter.... they still need to rely on us.

Re:n/t

[Kjella]

So basically it costs money to get EAL verified, and the farther up the scale you go, the more money it costs to run the testing.

Uh, yes? The more specific the documentation, the more work has to be done to verify it. I'm not sure how many million LOCs are in the Linux kernel but if I had to go through EAL6+ semi-formal proofs for all of them I'd charge a bundle too. Are you really trying to imply that NSA issue this sham certification because they're short on funding? Stop trying to pretend that all the "experimental support" that goes into Linux could or should pass certification, because it damn well shouldn't. Certainly not on based on a casual "it's probably capable" that's quite frankly pulled out of your nethers with no documentation to back it up. Here for example are THREE security exploits in the kernel in the last two months:

1 Linux Kernel VDSO Unspecified Privilege Escalation Vulnerability (Vulnerabilities) Rank: 820
Last modified on: 2008-11-04 00:00:00 MST
URL: http://www.securityfocus.com/bid/32099
2 Linux Kernel LDT Selector Local Privilege Escalation and Denial of Service Vulnerability (Vulnerabilities) Rank: 820
Last modified on: 2008-10-03 00:00:00 MDT
URL: http://www.securityfocus.com/bid/31565
3 Linux Kernel 'generic_file_splice_write()' Local Privilege Escalation Vulnerability (Vulnerabilities) Rank: 820
Last modified on: 2008-10-03 00:00:00 MDT
URL: http://www.securityfocus.com/bid/31567

Don't get me wrong, Linux is a great system and all but I wouldn't want to nuclear launch control on it, sorry.

Re:n/t

[jawtheshark]

Both open source and closed source have holes, but open source provides you with the source code to explore as well.

So, you like security through obscurity. I had to laugh out recently during a presentation when a coworker said "Rename the admin.php page to something else in order to add another layer of security." The rest of the meeting was not amused, but I couldn't help it.

Re:n/t

[not already in use]

I'm sorry if I take a test that gives Windows and Linux the same security rating not very seriously.

Linus himself has said that security related bugs take no precedence over any other bug. Besides, no one expects a linux fanboy to objectively rate the security of their OS, as would say, someone interested in national security.

Linux is just as buggy and full of holes as Windows, get over it.

Re:n/t

[slater86]

I guess it depends if they're talking about vanilla linux/windows installs.
Usually anything I hear about NSA testing, they specifically talk about SE Linux rather than just a random distro.

Re:n/t

[Kent Recal]

I'd be perfectly comfortable with a linux powered "nuclear launch workstation" as long as it's not connected to a network.
The same, btw, applies to any other OS, no matter how many certifications they may have invented for it.

Common sense dictates that such a system should have multiple independent layers of protection anyways, all of which default to "No, do not launch" in case of failure or breach.

Re:n/t

[khellendros1984]

I tend to think of it as a different kind of intelligence. As orclevegam said up above you, mathematics focus on using more complex concepts to do single things. Computer science is construction of interconnecting systems, where the pattern of the whole system must be understood in order to build good code. In essence, interconnection of very simple bits. Both of these disciplines require a great deal of abstract, out-of-the-box thinking, but applied in different directions.

Re:n/t

[mkramer]

Having working with the OS in question and directly with the NSA on getting our own OS certified (which we decided was too expensive in the end, and wound up throwing it away to use Integrity-178B)....

NSA does employ a sizeable group of mathemeticians in the area of security now as well. They've invested a lot of time in money in mathematical models for proving security, namely from the vantage point of possible combinations of system states, and how to minimize those into a human-testable number of states.

Re:n/t

[jawtheshark]

Sorry, I didn't read that comment, but I promise I will. Sounds like a very reasonable explanation to me.

Re:n/t

[NormalVisual]

It would be theoretically possible to do it with open source, but it would require an extreme degree of organization and discipline compared to normal open source projects.

And a large wad of cash to spend on static analysis tools and other goodies.

Re:n/t

[jasmak]

The real question is, how much do you trust this OS not to have an NSA back door?

This was my first thought after seeing the title. Don't see any other way that the NSA would recommend an OS unless they get something out of it.

Re:n/t

[lanterndog]

After reading these replies, I take my "more intelligent" comment back. :) It was out-of-line, no doubt. It's just been my experience that intelligence has been more concentrated in mathematics. That isn't to say CS people are "stupid" in any way. It's just that the smart:"just there because I grew up playing video games" ratio in CS is way lower than it is in math. In mathematics, I learned how to abstract things in a very logically rigorous way. I learned how to model various situations with various techniques in the most general (and hence widely-applicable) ways possible. CS taught me, aside from all the nuts-and-bolts stuff (which I taught myself long before I went to college) how to tie much of the mathematics together to develop algorithms and wider theoretical systems that would produce valuable things in a less abstract domain. So, CS and mathematics go hand-in-hand. Well, CS wouldn't exist if it weren't for Church, Turing, Kleene, Godel, etc. (mathematicians) either. :) You've hit the nail on the head with this one, and it's something that I've been dying to hear from other people: CS is about theoretical systems, not programming.

Re:n/t

[hotdiggitydawg]

So even if a Linux distro wanted to be verified at a higher level - who's going to fork over the dough?

How about the NSA themselves? (a) They're the people doing the certification anyway; and (b) they pretty much built SELinux themselves... sounds like a good fit if you ask me.

Re:n/t

[InlawBiker]

Nokia IPSO, which is certified for Check Point FW-1 and VPN-1 and is based on BSD, is also EAL4.

   

Re:n/t

[OriginalArlen]

I'm a Linux user, and that makes sense to me. I also use OpenBSD because it goes to the next level. I would not expect OpenBSD to achieve the same order of security as software controlling nuclear weapons though.

Re:n/t

[Anonymous Coward]

If you can't trust linux, to launch your nukes, would you prefer a series of yarn and wheels? (note: highly insecure to angered moths)

Re:n/t

[ozbird]

Mathematicians are insane.

Fixed that for you.

Admittedly, mathematicians can formally prove they are more intelligent the CSers, but nobody except another mathematician could a) understand the proof, and b) give a shit.

Re:n/t

[Bill, Shooter of Bul]

Its just a generally true maxim. Math is more rigorous and further developed field of study than CS. Its easier to test an aptitude for math than CS. This may change as the field matures (possibly into Wolfram's New Kind of Science). But its not there yet. So its much easier to prove that those with math degrees are smarter than those with cs degrees. I mean think if we did the same comparison back in the time of plato between farmers and mathematicians I think farmers would be found to be more intelligent.

In any case, if you need other people to tell you you are smart to feel good, you have emotional problems that are best served in a psychiatrists office, rather than on the internet.

Re:n/t

[AvitarX]

Isn't that what compile yourself means?

He/She didn't say run the compiler yourself.

Re:n/t

[Ex-MislTech]

If you can't trust linux, to launch your nukes, would you prefer a series of yarn and wheels?

Qnx - good chance you have taken it for a drive

http://en.wikipedia.org/wiki/Qnx

Re:n/t

[CaptainPatent]

Uh, yes? The more specific the documentation, the more work has to be done to verify it. I'm not sure how many million LOCs are in the Linux kernel but if I had to go through EAL6+ semi-formal proofs for all of them I'd charge a bundle too. Are you really trying to imply that NSA issue this sham certification because they're short on funding?

I never made the assertion that the NSA is wrong to charge money for their services or that this is in any way a "sham certificate." I was responding to the parent and grandparent - specifically with the grandparent saying he didn't trust a certification where Windows is on equal grounds as Linux.

Stop trying to pretend that all the "experimental support" that goes into Linux could or should pass certification, because it damn well shouldn't. Certainly not on based on a casual "it's probably capable" that's quite frankly pulled out of your nethers with no documentation to back it up.

Once again I didn't make the assertion that Linux should pass certification for higher levels, simply that it probably could pass with few or no updates - "few" being relative to what Windows may require for the same certification and depending heavily on what hardware the underlying system is running, the actual kernel being used, the GUI placed overtop, the additional software installed, ad infinium.) I don't doubt there are problems with the OS, I agree we shouldn't forgo testing on blind faith and just give it the next level, and I think by no means do I think Linux should be given preferential treatment as far as pricing goes.

In fact, the only point I wanted to make to the grandparent of my original post is that EAL is basically a testing procedure with a related certification and there are reasons Linux "performs" identically to Windows on this particular scale.

Re:n/t

[mcon147]

You need to run a 'nuclear launch control' ? http://www.ertos.nicta.com.au/research/sel4/

Re:n/t

[conspirator57]

kind of, but not really. The higher EAL levels require things like proofs on your enforcement algorithms in the context of the machine (CPU feature set) it runs on. There are a lot of musty corner cases where user-based security fails. Thus it is impractical to retrofit existing OSes that rely on user-based security, because the security methods have fatal design flaws.

as far as practicality, consider denial of service attacks using the confused deputy problem. Linux, like windows, is full of mutexes and spinlocks. The answer is priority inheritance, and even that is only a partial answer.

Re:n/t

[BronsCon]

You could decompile the compiler to verify th... oh... wait a minute...

Re:n/t

[bogidu]

So . . . let's release this 'secure' os into the wild for a few months and see how many security exploits can be found in it.

Re:n/t

[orclevegam]

Having working with the OS in question and directly with the NSA on getting our own OS certified (which we decided was too expensive in the end, and wound up throwing it away to use Integrity-178B)....

NSA does employ a sizeable group of mathemeticians in the area of security now as well. They've invested a lot of time in money in mathematical models for proving security, namely from the vantage point of possible combinations of system states, and how to minimize those into a human-testable number of states.

Yes, I've seen some of the work that's been done on trying to create a OS that can be mathematically proven to be secure, but I just don't buy it. Sure you can use some set theory and various other things to try to show how mathematically the system is bounded within the secure states, but all of that goes out the window once you move beyond a non-trivial set of functionality, and completely ignores the human side of the equation (which is the most important part, if the system makes it hard on the user to remain secure, then the user won't use the system the way it's meant). I also wasn't saying that mathematicians have no place in software security, or that they aren't useful, just that a mathematician isn't necessarily the best (or even good) choice for designing a OS.

Computer security is equal parts software, hardware, interface, and user training. Ignore any of those and you've just introduced your weak link in the system (usually the user and/or interface which go hand in hand). Hardware is only really an issue of you're trying to secure against a threat with physical access, which any halfway competent security professional can tell you is a stalling tactic at best. Software is critical to prevent things like buffer overflow attacks, but can be tested automatically with a good degree of accuracy. Interface and user training are really the linchpins of security. A good interface is a must in order to allow the user to make informed decisions concerning how trustworthy the system in question is, and proper training is important to allow the user to properly interpret the information they're receiving from the interface and to learn to spot subtle signs of problems.

Of course, in a specialized environment like a B2, or highly secured and hardened systems like no doubt the NSA uses the problem can be reduced in scope as to be nearly fully encompassed by a mathematical state model, but in so doing you massively limit the capability of the underlying system. In essence you take a general purpose system (computer) and reduce it's functionality to one specific task in order to be assured of it performing that single task in a easily controlled fashion. Although this is fine for the highly specialized tasks the NSA puts these systems to it would never work in a general purpose system used by end consumers and even most businesses. Once you go down that route, you might as well just use an embedded device as you've already lost the greatest advantage a PC has which is generalized functionality.

Re:n/t

[jrumney]

So basically it costs money to get EAL verified, and the farther up the scale you go, the more money it costs to run the testing.

Sounds like Scientology for operating systems.

Re:n/t

[ChrisA90278]

"Source code audits with automated scripts that attack every port and every program checking for buffer overflows or other avenues of attack. It would require a lot of work"

So much in the the sun would burn out before you coulld finish. Do the math and any non-triveal program. I just looked at one of mine and there are over 2,000 branches. How many possible paths are there? Let's just say "more then you can test in a few billion years"

But we don't have to test. Remember the theorem about triangles a^2 + b^2 = c^2. How do we know it is true for all right triangles. Did some one actually check EVERY triangle or even 0.001% of them. No they used a mathematical proof so we know with certainty. One can apply the same methods to software. But it is very hard and very slow. But even so much faster then exhaustive testing.

Re:n/t

[jawtheshark]

Well, CS wouldn't exist if it weren't for Church, Turing, Kleene, Godel, etc. (mathematicians) either. :)

And I love to talk about those poeple. What you have to understand is that CS is maths... In the same way that biology is physics. That's perhaps not the best analogy, but we're just lower on the abstraction ladder.

But computer science is just maths, a part of it. It's discrete maths, computability, and many things more. You have no idea how much this confuses employers when I bring this up. There is a reason that computer science is a part of the Math department at the University I went. ;-)

Re:n/t

[divisionbyzero]

I suppose it depends on how you define secure. What evidence do you have the Linux is any more secure than Windows? What's your criteria? EAL isn't an absolute measure it's basically a standard. The more things you can check off the higher your rating. What's your checklist? Judging by your post it seems just pure prejudice.

Re:n/t

[the 99th penguin]

EAL does not mean what you think it does.

Inconceivable!

Re:n/t

[lanterndog]

I really wish that were the case at the University I attended. CS is really math, I completely agree. Software design and programming are not CS. They're engineering, and should be treated as such. And yeah, that does confuse the hell out of people, even CS people. Sometimes they get ridiculously defensive when I say things like "CS is a bullshit field. It's the bastard child of mathematics and electrical engineering, and the theory should be in the math department. The programming should be in the engineering department." :D

Re:n/t

[TheRaven64]

Linus himself has said that security related bugs take no precedence over any other bug

And the OpenBSD guys say that the only difference between a bug and an exploit is the intelligence of the attacker. There have been lots of non-security bugs fixed in OpenBSD that have later turned out to be exploitable. Much as I enjoy disagreeing with Linus, in this case he is exactly right. You can't easily tell which bugs are security bugs, you can just say whether someone you know has figured out how to exploit a particular bug.

Re:n/t

[brunson]

I call "Shenanigans".

Base your 1-7 (or above) rating on how many hours a system remains uncompromised unprotected on the 'net.

Re:n/t

[v1]

what it means is that if you have a higher EAL number, it means you definitely have more money, and possibly are more secure.

Re:n/t

[bheilig]

To achieve EAL6 you must successfully pass penetration testing, and you must also have a formal methods verification which includes both the formal (mathematical) specification and that the code correctly implements the specification. EAL4 and below have the documentation requirements.

Re:n/t

[failedlogic]

After the 3rd try, you were smart enough to call yourself stupid by posting anonymously. Brilliant!

Re:n/t

[lgw]

Formal proof of correctness is such a joke that I can't take this whole rating method seriously. Yay, you have a proof that your program is correct - where's your proof that your proof is correct? Did you prove your source code or machine code correct? And your microcode? And your gate layout? On your I/O controller?

Re:n/t

[hlee]

However, I will get flamed to the end of the earth for this, but it's my experience: Mathematicians are insanely more intelligent than CSers.

I'd just like to reiterate what another poster mentioned about mathematicians and CS students utilizing different skill sets, and add some anecdotal evidence from my university days. A good third of my class held national scholarships and they generally trounced the rest of us on any math heavy exams - they certainly ran circles around me in that area, and I regard myself as capable. Oddly enough I seemed to do better than many of them at programming: designing programs, debugging, etc. I didn't have any trouble canniblizing code from my previous year's project and making discoveries in a project no one else did because of the accuracy of my program. I later discovered those discoveries were actually predicted by a mathematical model - ironic isn't it?

Re:n/t

[piojo]

I'd be perfectly comfortable with a linux powered "nuclear launch workstation" as long as it's not connected to a network.

Well, all it could take is a bored or deranged employee with a lot of time and a terminal. You could try to deny them access to a terminal, but then they would just need to find some other vulnerability that allowed them to run a command. SELinux might help prevent that, but it doesn't have any sort of formally proven safety.

Re:n/t

[Bill, Shooter of Bul]

Think of it this way: If you randomly select a group of people and subject them to the curriculum of a subject, what will be a good indicator of the intelligence of the graduates? Well, if its easy to tell the smart ones from the not smart ones then only the smart ones will be left at the end. But if the subject isn't as well defined, it would be easier to get through without being particularly smart.

Its natural selection, sort of. Look at the other physical sciences. Chemistry used to be throwing crap together and then describing what color the result was. Now its requires p-chem that requires students to deal with partial differential equations. That in a effect raised the intellectual bar for all chemists.

Re:n/t

[cos(0)]

Formal proof of correctness is such a joke that I can't take this whole rating method seriously. Yay, you have a proof that your program is correct - where's your proof that your proof is correct? Did you prove your source code or machine code correct? And your microcode? And your gate layout? On your I/O controller?

You're right, all proofs are useless. They're just an invention by The Man to keep us down.

There are a couple of problems with your argument. First, "a proof of a proof" is redundant. I don't know whether you've ever seen a formal proof, but each step in a proof proceeds only once it's justified.

Second, not having a proof for the I/O controller, gate layout, microcode, and so on does not invalidate the proof for a program. A proof for a program will assume that the underlying layers are correct. Then it's up to the microcode, I/O controllers, and so on to have their own formal proofs.

Re:n/t

[rHBa]

The OS in question here however is most likely quite rigorously designed, and won't have a lot of the bloat that causes desktop OSs so many problems.

Well, as long as it runs iTunes and Real Player, otherwise I'm not interested...

*removes tongue from cheek*

Re:n/t

[Atario]

Higher levels require some sort of formal methods use in the design and testing. This is very unlikely to ever happen for Linux (it is virtually impossible to create a formal design retroactively; either it does not correspond to the system or it is just as complex as the system).

No problem.

1. Create black-box-style formal spec of Linux
2. Rebuild Linux from scratch using only the specs

Easy!

Re:n/t

[6th time lucky]

all of which default to "No, do not launch" in case of failure or breach

Actually, I'm not sure you would want this mode of failure if you were actually at war (a la cold war-war). Denying your enemy to fight back just by breaching the system is probably just as effective as neutralising them as hitting them with some missile.
Actually penetrating the system and using your enemies armaments against themselves is just getting cocky...
Although in today's "terrorist" wars, a fail-unusable situation is better than having all the codes set to 00000...

Re:n/t

[somerandomnamehere]

Yes, I've seen some of the work that's been done on trying to create a OS that can be mathematically proven to be secure, but I just don't buy it. Sure you can use some set theory and various other things to try to show how mathematically the system is bounded within the secure states, but all of that goes out the window once you move beyond a non-trivial set of functionality

Buy it or not, formal verification is becoming an increasingly important aspect of all software, especially OS design and construction. The seL4 project at NICTA is a prime example. It is complete and non-trivial operating system kernel that provides unbreakable guarantees of process isolation and containment as verified formally. L4, a close relative of seL4 is already deployed on hundreds of thousands of mobile phones using the Qualcomm chipset. see http://en.wikipedia.org/wiki/L4_microkernel_family for more details.

Re:n/t

[Xest]

A good CSer will realise that math underpins most of CS anyway. A good CSer will himself have a solid grounding in math.

Perhaps the issue is that you're assuming anyone good at CS is a mathematician because they make use of math and assume that anyone whose a CSer is crap because you're only classing those who don't understand the mathematical underpinnings of their subject as CS guys?

Learning AI without combinatorics, networks and graphs, cryptography without number theory and database theory without set theory to give a few examples are always going to lead to someone who may be able to just about get by in these subjects but wont be overly great at them.

Re:n/t

[orclevegam]

I'm familiar with L4 (and it's various relatives) and I rather like the kernel, although I think it needs a lot of work to achieve anything close to good security. That's not really the kernels fault of course, it's only part of the problem, and there's really very little wrong security wise with the actual kernel, but a kernel by itself is only a very tiny piece of the overall security of the system, it's the other system utilities and even the filesystem itself that's the biggest security problem. Pointing at a kernel and calling it secure as opposed to an OS (and all the baggage that entails) is a little like pointing to a safe and calling it secure as opposed to a bank. It doesn't matter how badass your safe is if anyone can walk in, pick it up, and walk off with it, it's a layered approach to security that makes it secure, and somewhere along the way people need to be involved. Security always comes down to people at some point, and as such anything that does not quantify the person and take them into account is not truly secure. To go back to our previous metaphor of the safe, you can mathematically prove the number of combination's the lock might have, and you can mathematically prove the physical strength of the various components, but what you cannot do is mathematically prove that the guy in charge of guarding that safe is doing his job, or that someone won't somehow manage to steal the safe itself.

Now, formal verification is a nice tool, it lets you efficiently spot certain kinds of problems, but formal verification by itself is far from a good measure of how "secure" something is. A good secure OS must be both free from code defects and exploits (buffer overflows, various injection attacks, escalation bugs), and must be designed with an overall goal of ensuring that the user is given all the tools and information they need in order to make informed judgments about the state of the system.

Re:n/t

[mcgrew]

Yes, but I was badly hung over.

Re:n/t

[OwnedByTwoCats]

it means you definitely have more money

It means you definitely had more money. You don't have it any more, you spent it getting the certification.

Re:n/t

[mishatae]

What about the NSA/SeLinux security model? Surely that goes beyond "conventional, user-based security features" I daresay that it is also a bit more secure than your standard xp/vista boxen.. I read somewhere that the NSA uses it for their most highly classified stuff.

Re:n/t

[lgw]

How do you know a formal proof is correct? Many formal proofs published in peer-reviewed journals have turned out later to be incorrect. If you merely want to claim "code review is good", I'm with you.

Many people (for some deranged reson) do formal "proofs" of a program's correctness, which is then compiler with a compiler that has not been formally proven correct. Yeah, that's helpful. And what did you compile that compiler with? Thompson hack anyone?

Real world security holes have been found in systems that have had their security formally proven. Again, I'm totally onboard the "code review is good" bus, but these formal proofs are just a particularly awkward and slow method of code review, without any real benefit over other formal code review methods.

Re:n/t

[Thomas Cruise]

Quit impersonating me, will ya?

PS:Send karma to badkarmadayaccount, this one's just a sockpuppet. Tihomir.

Re:n/t

[charlesnw]

Um. No. It's not that simple. You test a real world deployment. You don't deploy systems unprotected on the internet in the real world (all the malware infected windows boxes non withstanding). What is unprotected? No access control? Publishing the root password (without selinux/grsecurity et al)? Then it's just silly.

Two steps from the highest, actually

[moderatorrater]

EAL7+ means that it can defend against well-funded and sophisticated attacks and doesn't have an NSA backdoor built into it. EAL8 is exactly like EAL7+, only it can do it while getting slashdotted.

Re:Two steps from the highest, actually

[jbeaupre]

EAL9+ means it autonomously retaliates against the attacker's system.
EAL10+ means it autonomously retaliates against the attacker.

Re:Two steps from the highest, actually

[tonywong]

Heh, glad to see slashdot readers marking this as insightful.

FTFA:
"[EAL6+] is the highest [rating] in the world. This means that the OS was designed and certified to defend against well-funded and sophisticated attackers," says David Chandler, CEO of Integrity Global Security, the new Green Hills subsidiary.

Parent should be marked as funny, even if they didn't see the humour carefully woven into the OP.

Re:Two steps from the highest, actually

[Sponge Bath]

My computer goes to EAL11!

The power of God blazes out of the box to melt the faces and explode the heads of intruders,
just like in Raiders of the Lost Mainframe.

Re:Two steps from the highest, actually

[Anarke_Incarnate]

EAL11+ means it goes to eleven. The others they go to 10, but this one goes to 11, so if you need that extra.....push off the cliff....

Re:Two steps from the highest, actually

[Linker3000]

But does it go all the way to 11?

Re:Two steps from the highest, actually

[FiloEleven]

It's a shame they don't go to eleven.

Re:Two steps from the highest, actually

[Verteiron]

EAL11+ means it autonomously launches nuclear missiles at Russia, knowing the Russian counter-attack will destroy the attacker.

Re:Two steps from the highest, actually

[durrr]

And EAL11+ Means it autonomously do pre-emptive strikes against all potential attackers.

Followed by sending robots back in time to pre-preemtptively attack whoever turns out to not succumb in the first(?) attack.

Re:Two steps from the highest, actually

[ceoyoyo]

EAL4+ is Windows - defends against inadvertent attacks. EAL3+ gives you a cookie to encourage you to break in. EAL2+ contains a virus that actively spreads your data around the net. We're not sure what EAL1+ is yet.

Re:Two steps from the highest, actually

[Eudial]

EAL12+ includes an HAL9000:esque AI that preemptively triggers a global nuclear holocaust, to ensure it will never be hacked.

Re:Two steps from the highest, actually

[caluml]

You have to wonder why an OS that runs on bombers and other military aircraft has to be so secure. I assume it doesn't have any kind of networking enabled, so that would mean that the only way you could tamper with it would be to get past lots of suspicious people with guns, and barbed wire, and get close enough to do it. Now, if it was reliability, or something else it was certified for, sure. But security?

Re:Two steps from the highest, actually

[owlnation]

EAL11+ is also know by its codename: SKYNET.

Re:Two steps from the highest, actually

[Shakrai]

I assume it doesn't have any kind of networking enabled

Umm, you assume wrong....

Re:Two steps from the highest, actually

[Thaelon]

EAL84+ means it is self-aware. It's not recommended that you try to pull the plug. It will fight back.

Re:Two steps from the highest, actually

[tylerni7]

No one actually knows what EAL11+ does, because no one has ever been crazy enough to try to attack an EAL11+ system.

Re:Two steps from the highest, actually

[TheRaven64]

I have worked in this area, so I am only legally allowed to talk in very general terms (the system in question is not one I worked on, so I can speculate about it as much as I want):

There are lots of things you might want a bomber to get access to. In any theatre of operations you have a number of friendly and hostile assets. Knowing the location of the friendly ones allows you to discount a lot of sensor clutter easily. You are likely to have a large number of other sensor platforms, ranging from satellite imagery to locally-deployed acoustic sensors. Getting this data fed into your targeting computer is very important. Something like an Apache can identify and prioritise a staggering number of targets at the touch of a button. You almost literally have a 'destroy the most important enemy asset in this area' button.

Since Marathon, battles have been won and lost based on who has the best information. Any modern military system spends most of its time co-ordinating data from various sources.

For more information, the relevant buzzword is C3I.

Re:Two steps from the highest, actually

[suburbanmediocrity]

EAL7 applies to systems and not just the shrink wrapped OS. I.e., you have to mathematically prove (not just demonstrate) the security.

DO-178B requires spacial (memory) and temporal (a deterministic schedule) and is used on commercial airliners. The time at which tasks run (you can think of a task almost as a function call) is set a prori at design, not run time. All I/O is scheduled, no interrupts, 100% determinism.

Re:Two steps from the highest, actually

[Kadmos]

EAL12+ means it can drink your milkshake.

Re:Two steps from the highest, actually

[laejoh]

Why don't you just make ten more secure and make ten be the top number and make that a little more secure?

Re:Two steps from the highest, actually

[Anarke_Incarnate]

but....this goes to 11

But will it run Doom?

[alcmaeon]

or Duke Nukem 3D?

lols

[negRo_slim]

A hardened operating system used in the B1B bomber and other military aircraft has now been released commercially

B1 Accidents, OS Homepage, More Wikipedia!

Re:lols

[avandesande]

I doubt that the same company that wrote the OS also wrote the operations software for the B1. Not sure where you get a LOL from.

Re:lols

[db32]

I blame all of my hardware problems on software too...

Seriously, going through that list I see. Fire, lots of fires. Two instances of computer failure due to faulty hardware. A few landing gear hardware problems. A dash of pilot error or otherwise bad luck. And a rather unfortunate bird strike on a weak section of a wing (that was later redesigned because of this event IIRC).

I am curious as to what you are trying to insinuate by linking to crashes due to these issues next to the software....

Re:lols

[OldManAndTheC]

Hey it's not the system's fault if the pilot can't remember the password to unlock the joystick. It's supposed to be secure, after all.

So why can't Windows and Linux do this?

[Van Cutter Romney]

What's preventing Microsoft and open source world from understanding these "sophisticated" attacks and hardening their respective operating systems against them?

Re:So why can't Windows and Linux do this?

[eddy]

The fact that both a windows installation and most linux dists need to be useful for the common folk, you know, with security no-nos such ethernet and maybe even USB support. And no, hotgluing ports doesn't cut it.

Look, it'd be perfectly feasible to push Windows or GNU/Linux through a higher certification, but someone has got to pay for it and the market is infinitesimal.

Re:So why can't Windows and Linux do this?

[thermian]

What's preventing Microsoft and open source world from understanding these "sophisticated" attacks and hardening their respective operating systems against them?

This isn't a desktop OS, so there isn't really much ground for comparison.

Re:So why can't Windows and Linux do this?

[Legion_SB]

In the big picture, there's a distinct trade-off between security and usability.

That doesn't mean that, in the small picture, every security improvement comes at the cost of usability. But when you're talking big picture, to get the kind of security you're talking about, you have to rethink what it means to use a computer/OS/etc. Things you currently take for granted (like, as someone else said, plugging a USB device in) become "holes" that have to be closed.

Re:So why can't Windows and Linux do this?

[archen]

Well think about this: do you think that certification is still valid when you modify anything? When you go down that line of thinking you come up with the conclusion that any consumer usable system is not going to be certified and be anywhere near modern. The best we can do is probably OpenBSD.

Re:So why can't Windows and Linux do this?

[Tumbleweed]

What's preventing Microsoft and open source world from understanding these "sophisticated" attacks and hardening their respective operating systems against them?

Mmm...the will at Microsoft to actually improve their products on anything other than the most superficial level?

Re:So why can't Windows and Linux do this?

[Kjella]

What's preventing Microsoft and open source world from understanding these "sophisticated" attacks and hardening their respective operating systems against them?

Long story short, a lot of semi-formal proofs that most of the time will have zero benefit, but it's the difference between believing it and proving it. Plus checks that have very little relevance in the rest of the world, for example EAL5 and up must include checks for covert communications channels. How many places in Linux can you pass data around for future extension that can be used for that? I guess a lot if you're not explicitly designing for not allowing any.

Re:So why can't Windows and Linux do this?

[avandesande]

It's been some time since I researched hardened OSs but these methodologies slow down the operating system by a noticable amount.

Re:So why can't Windows and Linux do this?

[DragonWriter]

What's preventing Microsoft and open source world from understanding these "sophisticated" attacks and hardening their respective operating systems against them?

The fact that it costs money to do, and money to prove, and the number of customers willing to pay enough more money to buy systems certified at the higher levels isn't enough to justify the cost.

Higher level computer security isn't worth much if any attacker with the resources to penetrate your computer security is also going to have the capacity to bypass your computer security by compromising personnel or non-electronic information. And, even for computers, a supersecure operating system isn't worth much if its got to share data over an less secure network or use less secure applications.

Worse than Dell with the Windows tax

[Anonymous Coward]

When you order a B1B, you pay for the Integrity-178B license even if you later install a copy of Linux For Strategic Bombers.

Re:Worse than Dell with the Windows tax

[Anarke_Incarnate]

Nah, just click "I Don't Agree" and back out of the license agreement. Then ask for a refund

Re:Worse than Dell with the Windows tax

[Anonymous Coward]

You meant GNU/Linux for Strategic Bombers.

Re:Worse than Dell with the Windows tax

[Dr Caleb]

You probably shouldn't click the 'Don't agree' button inflight.

Just ask these guys.

Re:Worse than Dell with the Windows tax

[Anonymous Coward]

When you order a B1B, you pay for the Integrity-178B license even if you later install a copy of Linux For Strategic Bombers.

Please don't run Linux For Strategic Bombers. The head maintainer is a well-known a**hole, for years he's refused to accept patches for longstanding bugs, and he's changed the license to prevent 3rd parties from distributing modified versions.

The bombing community has created a new fork of the project starting from the last Free version, called "Bombastic". It's already capable of handling 80% of mission requirements, and version 1.0 should be released in the near future. Please encourage all of your squadrons to use this truly Free alternative instead.

Re:Worse than Dell with the Windows tax

[Cajun Hell]

Even worse, if you do that and then try to resell your copy of Integrity-178B on eBay, they kick you off.

Re:Worse than Dell with the Windows tax

[rrohbeck]

When you order a B1B, you pay for the Integrity-178B license even if you later install a copy of Linux For Strategic Bombers.

Aah, I always wondered what LSB stands for.

Re:Worse than Dell with the Windows tax

[Phrogman]

Nah you wan to run OpenB1BSD, even more secure :P

Ample protection?

[DoctorFury]

Question is, though, does the security extend to the child OS and its software while running on this "so expensive we can't tell you how much it costs, and you can't hack us to find out" system? I guess that's a general question. Wouldn't running a browser on (god forbid) a Vista component leave you just as vulnerable as if you hadn't bothered?

lower that 4+

[internerdj]

Inadvertant and Casual attempts?
Oops. I tripped over my computer and hacked your system. Sorry.

Re:lower that 4+

[hagardtroll]

Ho ho ho, your humor is irrepressantly fascinatingly killian like. No, I'm not referring to the likeliness of someone slipping on a banana peel, but more of someone who cannot determine the existence of such a peel even in their midst because of the vagaries of density in matter. When one sips of the Tranya, they can see the world anew. Never again with the hijinks of virtual likeness of chief executives who concern themselves with indiscretions by script kiddies. More likely they imbibe on the nectar of the gods that Tranya is. Your scribe will not endeavor to move beyond the trivialities of such nonsensical musings. Instead, they will stretch their actualities into a shape only know to their inner selves. So do not resist the citrus belches and glucosian after taste. Imbibe early and often when nature sees fit to present you with the Tranya.

Re:lower that 4+

[ben0207]

"I hacked you? Sorry mate, I was just trying to play Solitaire"

Re:lower that 4+

[CorporateSuit]

"I hacked you? Sorry mate, I was just trying to play Solitaire"

Looks like we're lucky this time. Last kid that accidently played videogames with our system chose Global Thermonuclear War!

Re:lower that 4+

[glittalogik]

That was pretty much the plot of Wargames, wasn't it?

Unfortunately, probably a niche product at best

[93 Escort Wagon]

It seems like in the OS battle between security and convenience, convenience wins every time. I see Windows everywhere - at the bank, on hospital equipment and at doctors' offices, on ATMs... not to rant specifically against Windows; but it shows up a lot of places where I think we'd be much better served if the company had gone to the time and expense of developing a custom solution. Really, why should Windows be running on an X-Ray machine or an electrical power plant console?

Re:Unfortunately, probably a niche product at best

[onefriedrice]

Really, why should Windows be running on an X-Ray machine or an electrical power plant console?

Why not? Since we're not railing specifically against Windows, why shouldn't we start with general operating systems and build the functionality we need on top? That's what they're for.

Re:Unfortunately, probably a niche product at best

[j_sp_r]

Because nobody cares if they crash. Hell even the video systems in the hospital run some sort of Windows. (The only completely embedded/failsafe system is probably the anaesthetic). It doesn't matter that much to let someone lie a few more minutes most of the time (otherwise the changes of survival where pretty low to begin with). Anyway, the Windows system only controls where the output go, not the output itself. It failed less times then the power as far as I heard.

Re:Unfortunately, probably a niche product at best

[s0litaire]

Does the include Nuclear submarines?

Re:Unfortunately, probably a niche product at best

[rickb928]

There was a time when indeed, custom software runs some dangerous and life-threatening machines, such as radiotherapy devices, and even the custom stuff will occasionally fail, with unfortunate consequences.

Then again, would a PDP-11 have been considered off-the-shelf hardware back in 1985?

Custom programming is no guarantee, and there is in fact no substitute for testing. It's not about how good your software is, it is even about how users actually use it...

Re:Unfortunately, probably a niche product at best

[dragonturtle69]

I think it is more the race to the bottom, who can be the most profitable. It almost like a MBA law based on an engineer's law; Good, Quick, Profitable, pick two. Since profitable is always picked, we are left with good or quick. And since quick is thought to equal more profitable (less DEV time), it is the second choice. Good becomes good enough.

Then there is the thought process that believes that whoever is doing support is just a fixed cost, and therefore do not cost more when things are poorly made.

A lot of Windows and Windows DEV is like McDonalds; quick cheap, and good enough. Not many want to take the time to make their stuff from scratch.

Re:Unfortunately, probably a niche product at best

[Tubal-Cain]

See XKCD on Voting Machines.

A tad careless?

[Zathain Sicarius]

Isn't releasing this OS a little careless? Part of the reason it's so secure is because only the military has its hands on it. If you go around selling it, I'm sure someone will buy it just to poke around and find each and every hole in its security.

Re:A tad careless?

[omnifunctional]

Not really, this OS was not created for the B1B, it is just the one being used in some of the systems on the aircraft. It is also used by and is widely avaialble to avionics companies who build systems for any number of commercial and military aircraft. The only thing that has really changed it that Green Hills is marketing the product more widely. Remember it is just an OS.

Re:A tad careless?

[PitaBred]

Obscurity may increase the effective security of an OS, but if it really is secure, it shouldn't matter who has it.

"Linux" is not certified for anything

[crush]

A couple of specific distros on specific hardware have received EAL4+ certification: RHEL5 (on 12 or so different platforms) and SLES9 on IBM eServer spring to mind. I'm fairly sure that no other GNU/Linux distributions have received such certification and it makes absolutely no sense to talk about "Linux" being certified for anything.
This is not just nit-picking about GNU/Linux vs Linux as the name: it's a case where it's actually very important to be aware that specific versions of specific programs with specific configuration files have been tested and found not to fail in particular ways.

Good for them

[MikeRT]

It's not like the military really needs to replace all of its important infrastructure since it already has SIPRNet and JWICS which shield its sensitive systems from most hackers because they're not even on the public Internet anymore.

The Protection Profile and Validation Report

[jea6]

The Protection Profile and Validation Report can be downloaded at http://www.niap-ccevs.org/cc-scheme/pp/id/pp_skpp_hr_v1.03.

The Security Target and Validation Report can be downloaded at http://www.niap-ccevs.org/cc-scheme/st/vid10119/.

Re:The Protection Profile and Validation Report

[Isao]

You may also want to include the Security Target, which is where the vendor makes their security claims. It's at the second link.

"Both Windows and Linux are EAL 4+ certified"

[whoever57]

Is this really a true statement? According to Wikipedia, only Windows 2000, SP3 is EAL4 certified. Since this is an obsolete and unsupported release (Win2k SP4 is still supported), is it correct to say that "Windows..[is] EAL 4+ certified"?

It would be more accurate to say either: "Windows 2000, SP3 is EAL4 certified" or "Windows used to be EAL4 certified".

OT: Link in your sig

[mikiN]

Can you please tell me if this company has any relationship with a certain paper company down in Texas? Or will you send this Haitian guy over to me to

Why the hell am I posting on Slashdot? Dunno, just like any ordinary day I guess.

Article misleads about EAL6

[epdp14]

EAL6 is NOT the highest rating given by the NSA. EAL7 is. EAL7 has been awarded to one product (The Tenix Interactive Link Data Diode Device). Source: http://en.wikipedia.org/wiki/Evaluation_Assurance_Level

Re:Article misleads about EAL6

[avandesande]

TFA says 'highest rating given to an OS'

Check your facts.

Re:Article misleads about EAL6

[oGMo]

Actually it's EAL8. But you can't know about it, because it's insecure. Products that qualify for EAL8 can be neither confirmed nor denied, because if you knew about them, they wouldn't qualify. Those developers that make it are EAL8-ed.

;-)

Re:Article misleads about EAL6

[ZFox]

From what I read, the EAL rating system is just the assurance level of the protection profile.

The O/S was awarded a protection profile of "High Robustness" at EAL-6+ (the + just means they went a little above and beyond EAL-6), which seems to indeed be the highest security rating awarded.

On their website if you sort by "Conformance Claim" for validated products it seems to hold this up. Then again, it may just be sorting in alphabetical order. :)

You don't know how your walls can be breached

[wintermute42]

The nature of computer system penetration (hacking) is that it takes a great deal of time and patience. The attacker will put a lot of effort into learning everything they can about the system and then more time in probing possible vulnerabilities.

Linux and Unix systems in general have a better underlying security model than Windows (e.g., the way root/administrator vs. user is handled). Unix architectures also had years of students attacking them (back before this was a serious crime). However, if those of us who are Linux fans are honest we know that the reason we don't have to worry as much about Linux attacks is that hackers target Windows because it is more pervasive.

The Greenhills operating system has never been exposed to a large group of people who are willing to spend a lot of time penetrating it. The idea that you can just label a system as secure seems questionable. You always get attacked via means that you didn't expect. What they're really saying is that the system implements a security model that they believe to be secure. But B1 bombers are not placed on the Internet protecting large amounts of money, so they are unlikely to attract hackers.

Re:You don't know how your walls can be breached

[Ynot_82]

"if those of us who are Linux fans are honest we know that the reason we don't have to worry as much about Linux attacks is that hackers target Windows because it is more pervasive."

More pervasive on the desktop, sure
but if I was going to attack a computer system, why do I care about desktop OSs
I don't really want to break into some guys windows machine (and what? steal his bookmarks and mp3 collection), I want to break into a commercial company's database and steal financial details

That means Unix / Unix-like

Re:You don't know how your walls can be breached

[cptdondo]

Think about this. The B1-B (and any other nuclear weapons platform) isn't going to be subject to some pimply kid running half-understood scripts at random.

Instead, the other side, whoever that might be, will be doing their utmost to subvert and, if that fails, disable the computers on board. Those computers must communicate with HQ, so they can be hacked.

You've got some of the best, brightest, most resourceful people working for the NSA and its equivalent in Russia, China, and probably Iran and a few other places trying to hack these systems. They have tools and budget that we can't really imagine.

I'd guess that your garden variety linux install would barely make it through the warmup round for these guys (and gals.)

Re:You don't know how your walls can be breached

[malevolentjelly]

The Greenhills operating system has never been exposed to a large group of people who are willing to spend a lot of time penetrating it.

Like the NSA spending months cracking it for its EAL certification? No, nothing like that.

I'm sure the internet backbone routers running Integrity see very few users as well. This is not a new operating system- this system is older (in legacy) than linux.

This is not an OS like Windows or Linux- it is the sort of thing that is designed for missiles and satellites. Windows, Linux, Mac OS X- the security issues with them are close enough in the NSA's eyes that the military is required to keep them under armed guard when used in sensitive roles. The technology used in this operating system is both far beyond and irrelevant to the areas you'd use linux, mac, and windows for. This isn't multi-user, it's not a server, it's not desktop oriented. There's a very good reason you can't just buy a copy of this-- if you had a copy or the source code, you probably wouldn't know what to do with it.

Re:You don't know how your walls can be breached

[Seth Kriticos]

"computer system penetration (hacking)"

Please use the more focused term 'cracking'. Hacking can actually mean a lot more (including the finding of new ways to clean your toilet)

Re:You don't know how your walls can be breached

[drsmithy]

Linux and Unix systems in general have a better underlying security model than Windows (e.g., the way root/administrator vs. user is handled).

Uh, no. In fact, it is classic UNIX that has the poorer architecture, with its superuser concept.

However, if those of us who are Linux fans are honest we know that the reason we don't have to worry as much about Linux attacks is that hackers target Windows because it is more pervasive.

At least this part is correct.

Re:You don't know how your walls can be breached

[drsmithy]

More pervasive on the desktop, sure but if I was going to attack a computer system, why do I care about desktop OSs

Because they are plentiful and almost all maintained by ignorant users.

I don't really want to break into some guys windows machine (and what? steal his bookmarks and mp3 collection), [...]

And credit card details, identity, etc. To say nothing of being able to use that machine for spamming, fileserving, or bouncing other attacks off.

[...] I want to break into a commercial company's database and steal financial details

You mean you would attempt to attack systems mostly run by professional, knowledgable administrators, where abnormal behaviour will be quickly noticed and addressed, often with follow-up by the authorities ?

Re:You don't know how your walls can be breached

[jschottm]

I don't really want to break into some guys windows machine (and what? steal his bookmarks and mp3 collection), I want to break into a commercial company's database and steal financial details

1. Many desktops in corporations have all kinds of financially interesting documents on the hard drive. Excel, Word, locally stored e-mail, etc.
2. Many desktops in corporations have all kinds of interesting passwords on the hard drive. Login procedures/passwords may be found in Word documents and e-mail, for example. Various user name and password combinations may be in the local password file as well as stored by FF/IE/Safari and the like. Chances are those same combinations will be used on other systems.
3. Many desktops in corporations have access to those servers that are not accessible to the outside world.

Re:You don't know how your walls can be breached

[Alpha830RulZ]

Uh, no. In fact, it is classic UNIX that has the poorer architecture, with its superuser concept.

Which is different than a Windows Server local admin account how?

I think SELinux steps it up a notch, other than that, I figure it's six of one, half dozen of the the other. Either environment is about as secure
as the administrator of the system cares to/is capable of making it. I've made both acceptably secure for business purposes (demonstrably able to hold off random internet based attacks, still susceptible to social engineering)

Re:You don't know how your walls can be breached

[drsmithy]

Which is different than a Windows Server local admin account how?

A superuser account (like root in traditional UNIX) cannot be restricted (that's why it's called the superuser). Effectively, it bypasses the OS security layer.

The Administrator account is - like all accounts in Windows - restricted by ACLs. While it does have a very generous list of ACLs, it is still subject to limitations on what it can do by the security layer of the OS. Which is why, for example, there are some processes that 'Administrator' does not have permission to kill.

The difference between a 'superuser' and 'really high privileged user' is an important concept to understand.

I think SELinux steps it up a notch, other than that, I figure it's six of one, half dozen of the the other.

SELinux does indeed, "step it up a notch" - but most Linux systems are not running with SELinux configured.

Either environment is about as secure as the administrator of the system cares to/is capable of making it. I've made both acceptably secure for business purposes (demonstrably able to hold off random internet based attacks, still susceptible to social engineering)

This is certainly true. By far the biggest factor in OS security (for any remotely contemporary OS) is the person (or people) using it.

Re:You don't know how your walls can be breached

[Lincolnshire Poacher]

>The idea that you can just label a system
> as secure seems questionable

In a formal system, the behaviour of the software is entirely understood and proven. So we can rule out corner cases. No happy cracking avenues there.

This leaves us with the specifications. What the certification says is that the OS correctly implements a documented and approved security specification that is resistant to the enumerated threat capabilities.

By approving the security spec they can, indeed, say that the system is proven secure against those capabilities.

> But B1 bombers are not placed on the
> Internet protecting large amounts of money

True, but they are networked to a wide range of assets via JTIDS. Not every piece of datalinked equipment has such assured security.

Runs on the 787?

[Markimedes]

I've worked with test benches running the OS and hardware that is going on the 787.

If it's the same thing, it's going to be interesting seeing something like windows or linux run on it.

It has different processing areas, and each of the areas run on a different piece of hardware. So you basically had one computer running datalink to ground stations and other aircraft and another computer doing navigational computations (and several other computers doing various other tasks).

If windows were the same way it would be like.. having a different set of ram and a different processor running network tasks from ones running hard drive communication tasks.

Then again the OS that connects all of these together might be more flexible than I imagine, I only work on a small piece of software that runs on one of the aforementioned.

The most hardened OS ever

[davidwr]

The most hardened OS ever is any OS running in an signal-leak-proof room in the middle of a mountain with well-paid, trustworthy guards manning the entrance and a booby trap to bury and destroy the computer if anyone unauthorized gets past the entrance.

In this environment, even Windows 98 is secure.

Cost?

[Anonymous Coward]

OpenBSD is free, and I guarantee "that it can defend against well-funded and sophisticated attackers."

Re:Cost?

[Surt]

How much money do you put behind that guarantee? And really, how sure are you that it is going to stand up to billion dollar funded attackers? That such an attack won't find even a single buffer overflow attack, or some similar.

Re:Cost?

[Anonymous Coward]

Well if an Anonymous Coward guarantees it...

Security?

[sdkmvx]

Doesn't the security of a computer system rely on a good sysadmin? I could open every port known to man, but I don't need to and its insecure, or I could only run services I need, and keep them patched and up-to-date. This should be factored into security levels.

Re:Security?

[Anonymous Coward]

Doesn't the security of a computer system rely on a good sysadmin?

Partially, but not entirely. There are other factors.

I could open every port known to man, but I don't need to and its insecure, or I could only run services I need, and keep them patched and up-to-date. This should be factored into security levels.

And how would you protect yourself from the Apple laptop wireless flaw that was remotely exploitable by anyone in wireless range? Apple chose to protect themselves by threatening to sue the guy who discovered it, but that isn't a very good security method. Not many of us can afford that many lawyers :)

Another example: in the past, flaws have been found in tcp/ip stacks that are exploitable even if you have all ports firewalled off.

Even OpenBSD had a bug that could be triggered by sending a specially crafted IPv6 fragmented packet.

Good security isn't easy.

Airwallin' the night away

[UngodAus]

So it has not network stack? Or keyboard? Or monitor, or... That's the only way I'd deem it that secure.

Re:Airwallin' the night away

[HalWasRight]

Network stacks don't belong in the kernel. Why should a bug in your network stack have the ability to crash your system? This is what a separation kernel is all about. And why Windows and Linux can never be secure -- waaaaaaaay to much code running in supervisor mode.

OpenBSD?

[1053r]

Does anybody know if OpenBSD (or any *BSD for that matter) has ever received a rating? Or at least, what it would probably rate if it were to receive a rating? I would suspect that it would rate at least with Linux or perhaps one higher, seeing as their slogan is "only two remote holes in the default install in over a decade."

Re:OpenBSD?

[hotdiggitydawg]

Does anybody know if OpenBSD (or any *BSD for that matter) has ever received a rating?

After hours of meticulous research, I've discovered *BSD is apparently rated as "DEAD", as confirmed by Netcraft.

I know it's true, I read it here on /. !

Re:OpenBSD?

[Lincolnshire Poacher]

> Or at least, what it would probably rate if it were to receive a rating?

Unfortunately, and much as I love it, OpenBSD would also be rated at EAL 4. There are no formal proofs of correctness for the OpenBSD code base.

Yes, it is good solid code but no-one actually has a proof of how it behaves or to what degree it implements any documented specifications.

Re:Anonymous Coward

[CorporateSuit]

As much faith as I have in the NSA's security abilities, does anyone have any idea what criteria they were using exactly? Any in-depth results they've made public, preferably?

It's an aggregate result of how many social security numbers B1 bombers have lost over the last 10 years divided by how many B1 bombers, with the software installed, have been stolen out of government offices or left behind in taxi cabs.

EAL6 + EAL4 = ??

[AlexNicoll]

This is silly. It is an EAL6+ operating system that will host EAL4+ guest operatnig systems, probably so that someone can actually do something useful with it. So, can someone explain to me how the data in that EAL4 operating system isn't vulnerable to a casual/incidental attacker? How does running a vulnerable OS on an invulnerable OS make the vulnerable one any safer? (I have the same problems with people claiming VMWare makes them more secure...)

Re:EAL6 + EAL4 = ??

[argent]

VMWare makes systems more secure than if you ran multiple applications in the same OS image.

VMWare makes systems cheaper than if you bought separate hardware to run each application.

This presumably provides the same kind of division, plus it's been piddled on by the DoD to smell more secure. Remember, in avionics, weight requirements can make "more expensive" into "impossible", so it improves security by allowing you to use multiple instances of the OS where that wouldn't otherwise be possible,

Re:EAL6 + EAL4 = ??

[AlexNicoll]

I see what you're saying, but if those multiple instances need access to the same data - say, avionics, the data is vulnerable at the risk level of the lowest assured entry point. The weight option is a given, you are correct - but them having a really, really, secure VM implementation doesn't make the multiple windows implementations running on them any more secure. If that were the case, why didn't the NSA stop with NetTop, and not bother pursuing the High Assurance Platform?

Re:EAL6 + EAL4 = ??

[argent]

For all I know they're writing applications in a native API as well, and only using these hosted operating systems for non-critical or untrusted services, I don't know, I'm just noting that there are situations where virtualization does improve security over the non-virtualized alternative.

Re:EAL6 + EAL4 = ??

[twizmer]

It is definitely used to run native code as well.

Re:Anonymous Coward

[bl8n8r]

NSA E.A. Testing Criteria
---
EAL0 $1,000,000
EAL1 $1,000,000
EAL2 $2,000,000
EAL3 $3,000,000
EAL4 $4,000,000
EAL5 $5,000,000
EAL6 $6,000,000
EAL7+ Call for quote.

Hack a bomber

[gsgriffin]

This sounds really smart. Let out something that the military uses and see how long it takes to get hacked. We go through this all the time and everyone thinks they've got it licked. Then, after about a billion collective hacking hours are spent on it, some joker finds the hole. Now they can drop bombs! Cool!!!

Re:And...

[Martin Blank]

Some companies do use it for marketing. Others use it secondarily for marketing, but primarily to garner or maintain eligibility for certain contracts. EAL certification is required to get into certain government roles, for example. Ongoing re-certification is required to remain in some of them. The criteria and results are available from the Common Criteria website. For example, the evaluation covering Windows XP and Server 2003 details the OS variants, hardware on which it was tested, and drivers and patches that were present during testing.

Source code leaked?

[moteyalpha]

The source code is leaked and it is :
Boot:
cli
cmp al,al
Here:
jz Here
I think it is unbreakable myself, but it seems that it doesn't do a whole lot.

This is an RTOS, not a general purpose OS

[EmbeddedJanitor]

GreenHills make RTOS solutions for embedded use etc. The emphasis is on robustness and security over features. It is a painstaking process of testing and verification to add features.

Sure, in theory, Windows and Linux could attain these levels of security but in practice Windows and Linux favor adding features and capabilities. Compromises have to be made to get stuff out in an acceptable timeframe.

Re:This is an RTOS, not a general purpose OS

[malevolentjelly]

Actually, INTEGRITY is quite a bit ahead of linux in feature set for its chosen market. It's one of those "90's" era architectures as compared to linux's 70's era architecture. In general, EAL4+ is known to be the highest security level a system can be retro-fitted to run at. To get EAL5 or above, a system must be secure by design. So don't think of it as an insecure system that has tons of bandages that make it secure, think of it as a system that does not have security holes because it was built with unbreakable security in mind, not adherence to a 70's era computing paradigm like linux or an 80's era paradigm like Windows or Mac.

Re:OS X, enough said.

[Colonel Korn]

In the annual hacking contest we talked about, oh, six months ago, in which competitors won laptops by being the first to gain root access to them, OSX was breached first, early on day 1. Vista and Linux, properly configured, weren't breached until the rules allowed direct access to the machine on a later day of the competition. This translates to: Macs are secure because they're not a common target, but when there's incentive to hack one (like there would be for a system that needs a security rating for deployment) it goes down easier than anything else.

I think you missed the point

[MikeRT]

The point here is that it really does make good use of security through obscurity here. By being a product that is sold only to customers that work in classified environments, it has an inherent advantage in that almost no one outside of a small customer base will have access to poke at it. Put simply, the criminal element has hitherto had almost 0 chance of getting a chance to go to town on it.

Re:I think you missed the point

[malevolentjelly]

I interviewed at Green Hills a while back, and was told that there was no security clearance required to work on their software.

You obviously weren't interviewing to be on the RTOS group.

Besides, an EAL6+ indicates that security through security is not necessary. To be EAL6+, it is generally indicated that the product must not be breakable even by those who designed it.

You may already know this OS by it's common name

[gearloos]

This is Windows M.E. , right?

Hmmmm after RTFA

[dreamchaser]

From the TFA: "Chandler maintains that locking down the OS saves money for security in the long run. 'There's an opportunity that this [solution] could be a cost savings for enterprises, with all that is spent on intrusion prevention' and other security tools and efforts, he says."

I'm not so sure I'd trust ANY OS without also having other security checks and intrusion detection in place. Sounds like bad advice wrapped around marketingspeak to me.

Re:NSA dumped Linux

[harlows_monkeys]

Why is he being voted down? He's right about Linux (and the same thing can be said about Windows, too, and OS X). None of them use a development process that includes formal verification of specifications or formal verification that the implementation matches the specification. Of course they are insecure.

That is NOT what EAL 6+ means!!

[mclaincausey]

I am really sick of ignorant people misstating what Common Critera is. All a high EAL means is that your system has been tested and it does what you claim it does in your Security Target, which describes your system, and which vendors can write HOWEVER they want. Sometimes there are standard "templates" called Protection Profiles for certain classes of security assets, which restrict how vendors can draft their targets, but still, all the EAL is is an assurance level that those requirements are met by the solution. You could Common Criteria certify an absolute trainwreck to a very high EAL: if your requirements as stipulated in your Security Target include, for instance, "There will only be null passwords," and the lab verifies that, among other bad requirements, those items as assured to a high degree, you could wind up with an EXCEEDINGLY insecure system at a high EAL. A security practitioner reviewing the CC documentation can make a determination about whether the protection profile is worthwhile, and then the assurance level simply provides assurance that what s/he has read in the Security Target is actually how the system is engineered. It's not rocket science, I just don't understand how people keep mouthing off about crap they clearly don't understand.

Re:That is NOT what EAL 6+ means!!

[jea6]

Good call. Virtual upmod for you. I posted the PP and ST above: http://tech.slashdot.org/comments.pl?sid=1033867&cid=25808441.

example use

[hey]

ssh my-b1b
login: root
password: hellosss
last login Tue Nov 18 17:22:14 EST 2008 from nsa
# drop -4 bombs
# exit

What support does it have?

[Orion Blastar]

All I see are Ada 95, Embedded C, and C++ support, not much third party driver support, and hardly any third party applications at all.

Might as well use AROS as it has more of that than the OS in TFA.

There is a point to this

[dltaylor]

besides /vertising for Green Hills:

Modern warplanes are connected in a battlefield 'net that allows data, command and control to be passed between the planes (and satellite and ground). This is (obviously) a wireless network. Having a network stack and other interfaces hardened against intrusion makes it less likely that a battlefield adversary could either generate false data (the "magic" display in an F-22 paints the local AWACS as a "bandit", for example, and the pilot launches a missile), snoop data (the "stealthy" F-22s are here, here, here and here, so launch missiles at them), or perform some sort of DOS, degrading the systems capabilities. There are "well-funded and sophisticated attackers" who are likely to have those goals.

If there was a business case, and so many of the developers didn't have, uh, reservations, about using their code in military equipment, the OpenBSD and, maybe, Linux kernel and glibc could be certified (stripped of a few components, probably, and with a few tweaks). With a "trusted" kernel, libraries, and tool chain, you build the rest of system from scratch, anyway. It's not like you're supposed to be browsing the public internet with IE or FF on a B-1's navigation system.

There's no way for M$-Windows to be certified at EAL6+, because its design philosophy (the back doors are built in, not added on) is completely against any sort of security, and I don't think Vista is even EAL4+.

What rating would Diebold get?

[DevConcepts]

EAL0? Is there such a rating?

Re:OS X, enough said.

[Anonymous Coward]

Nice troll, but the Mac was not hacked remotely, the guy had command-line access. In those cases, computer security is the last of your problems.

Re:Your sig

[Shakrai]

Your sig must be hilarious for people (blind folks and such) who need their computers to read the text of websites for them. :)

At least they don't have to worry about seeing goatse when the trolls post links ;)

Ubuntu!

[jd]

It is headed by the only Linux nerd who could afford to chase a rating of 6 or above. (7 is the highest the EAL will go.) Another thing to consider is that EAL ratings are only valid for a combination of OS and hardware. So, running Windows on any box (even if functionally identical) to the configuration tested on makes the tests invalid. The true is arguably the same for Linux, except that you can download LTP and gain some measure of assurance (even if not blessed on that platform) that you've not broken any of the security.

The highest old-style NSA rating (A1) is superior to the current EAL6+, and general-purpose OS' did achieve it. Genesis was one (and, no, not the one with the Phil Collins plugin module). EAL6+ looks to me to be about the same as the Orange Book B3 classification, which Trusted Irix achieved. Linux, if LTP was extended enough, could be provisionally ratified up to this level. If it ever was, then I could see vendors like IBM (who got Red Hat certified up to EAL4+) or private millionaires either individually or (more likely) jointly funding the certification.

Of course, EAL-style security isn't everything you need. Security labels on packets would be good - isn't there some work on this already? Support for hardware MAC (mandatory access controls) for memory would be good, as that protects not only against memory access violations in software, but also against such violations with RDMA. (Of course, if the hardware isn't present, you don't get that security, but likewise if the OS support isn't present, you don't get the security.) Better support for hardware encryption - especially within OpenSSL and IPSec - would improve matters too. Coverity is a decent-enough static checker, but their much-vaunted cooperation with Open Source doesn't seem to be producing much in the way of results - I can't remember the last time anyone covered on Slashdot or LWN any work by them. Are the major Linux vendors considering alternatives like Klockwork or any of the theorum provers listed just the other day?

Linux is already very good, but it hasn't received the severe auditing of OpenBSD (although, arguably, Linux does better when it comes to bugs that aren't security holes and also does better on the feature set and hardware supported). Perhaps a round or eleventy of severe auditing would be good for it. There again, perhaps there are other means of being close enough to that level of effectiveness without cutting back on the flexibility and without demanding unreasonable resources.

Re:Ubuntu!

[jd]

Hey, that's damn secure! If the corefiles are corrupt or missing, unauthorized users can't figure out how to crash the software.

Re:Ubuntu!

[bzipitidoo]

Reading the comments in here, I think most of the posters don't understand what EAL 5+ is all about. Neither Linux nor Windows will ever achieve more than EAL 4. No, SELinux won't cut it. Neither will OpenBSD. 5+ requires formal verification. Do you understand what that means? You aren't testing everything you can think of, knowing that there will always be more problems because you can't think of everything and even if you could, you can't test everything. Instead, you have restricted the operations to such a small set that it actually is possible to prove every single possible permutation of all the operations will traverse and end only in known, secure states. For formal verification to be possible requires a small enough kernel, and Windows, Linux, and the BSDs are all far too large. They will never make EAL 5+. Hence the interest in microkernels.

Now, there are some idiots who think they can get a system rubberstamped if only they bribe, pressure, wear down, or befuddle enough labs. (They're also idiots for thinking that the labs can be befuddled.) I should know, I was once stuck having to work with such. Considering the depths of chicanery to which those former acquaintances were willing to go, I am not 100% confident that a system that is given a high EAL rating actually deserves the rating.

Green Hills has been hammering away at this for years, and now they've finally gotten their rating. It would greatly help with users' trust of the system if their code was open source. And it'd also help if there weren't more idiots trotting out the tired, old, and very wrong "security through obscurity" line that opening the source would compromise security. That sort of claim can only detract from any confidence that their product really is deserving of EAL 6, and that the people responsible for the evaluation know what they're doing.

Another big problem, and maybe why they didn't make EAL 7, is the hardware. I have heard that in the past systems have been considered all of a piece-- can't put the software on any old hardware, has to be only on the exact hardware it was evaluated for. But it takes so many years to get there that the hardware becomes obsolete and useless long before they're done. That's one of the things that happened with GEMSOS (could you mean GEMSOS, not Genesis?)-- it's only certified on a 286 or some such.

hehehe; this is a marketing joke

[WindBourne]

Lynx OS is EAL 7, and has been for a while. It will be quite some time before Greenhill makes it to EAL7. In the mean time, Lynuxworks uses Linux API, so that you have your choice of a real linux solution, or if needed, you can switch up to LynuxOS.

Re:hehehe; this is a marketing joke

[Drawkcab]

No OS has ever been certified to EAL-7. Look it up with the agency that does these certifications. It's public information. Many OSs make the nebulous claim that they were designed for EAL-7, but none have been certified for it. This is the first OS to be certified to EAL-6.

Re:hehehe; this is a marketing joke

[suburbanmediocrity]

Integrity DO-178B is open source (maybe for different definitions of open source). You get the source code when you pay for the OS.

Re:hehehe; this is a marketing joke

[Tubal-Cain]

Not unlike how Red Hat operates... unless you are not allowed to redistribute the source code (which would prevent an analogue of CentOS from arising)

Re:Your sig

[Eudial]

Is that a challenge I hint?

EAL = ToE(DUT) + ST(environment)

[conspirator57]

The EAL is only half of the equation. The Target of Evaluation (device under test) is subjected to EAL appropriate documentation and verification against a design document called the Security Target. This ST specifies the threat environment. For example the windows ST specifies that all authorized system users are benign and thus not a threat.

Quality of NSA people

[DesScorp]

The NSA doesn't really recruit anyone. Most people working at the NSA are military.

One, they do recruit civilians, quite heavily, and two, there are a large number of military people in their ranks. But those military people are pretty bright, too.

Simple really

[CarpetShark]

Also, how can they test this?

echo > hardened_os.asm -e "\tCALL _do_non_networked_basic_bomber_plane_stuff\n\tNOP"
make
run_vm ./hardened_os
attack_vm
if [ $? -eq 0 ]; then
    echo "It's tough. You should buy it."
fi

Missing the point

[Count McHenry]

On their web page Integrity claims:

INTEGRITY is secure.
Windows, Linux, VMware, and others are not.
And we can prove it.

http://www.integrityglobalsecurity.com/pages/learnCommon.html

Then the website mentions the TJ Maxx hack (and that TJ Maxx was not running the INTEGRITY OS). But the TJ Maxx hack had little to do with the OS, but rather the wireless encryption protocol in use.

From my limited experience, it seems most attacks like social engineering, weak passwords, poor configuration, etc., are much softer targets than the OS itself. To claim that the OS is the panacea of security is missing the point.

Re:Missing the point

[suburbanmediocrity]

Not really. There are many technicalities that go into this. The main point of this is to prove that a running app can in no way get unauthorized data or influence data in another app running on the same machine.

Greenhills, BTW, has had instances of Linux running under their Integrity for many years much in the same way that vmware does.

Are you sure

[Frankie70]

Are you sure about this? I saw quite a few movies where people get into to Military computers typing "Connect to Military Computer" & then guessing the right password. These were very smart people, but they did get into those databases and all.

Calm Down, this isn't likely what it sounds like

[JohnnyComeLately]

First, the title has a startling similarity to an FAA order that pertains to aircraft specifically. DO-178B is the latest draft of engineering standards a software package must pass to be allowed in commercial aircraft. Around 2001, after Sec Brown became a lawn dart in a mountainside, the AF put out an acquisition directive that all military, or DoD acquired, systems must pass the FAA's DO-178B which is also recognized by the EU. The DO has levels of "security" a system passes, but it's not the geek think of security I think everyone here, as well as the original author from the RTFM, thinks that it is. It's security from an engineering point of view. Will this system make a pilot think he's at 1500 feet when he's really at 400 and falling? Will it confuse the pilot to not notice s/he is at 400 and falling? Integrity is probably a better term. A communications system will pass around level D or C, which could be considered low on the CMMI model (no un-used code, desk review) in terms of integrity. An auto pilot on an F-22 would need to be Level A, which is around Level on CMMI where you have to map every entry and exit point, and all sorts of other verifyable pieces of data. You wouldn't engineer a 2 foot retaining wall in your backyard to the same level as the Eifel Tower.

Secondly, no system in universally accepted in acquisitions. They may have some certification, lets say for an F-22, but they'd never just blindly take that same package and consider it certified for an F-35, or any other aircraft, nor would the FAA for DO-178B. New fighter aircraft are networking, but you'll never "casually hack" one unless you've got your own F-22 and you're flying in the sortie between the two (man in the middle attack).

Well I for one

[rmdashrf]

will not touch it until it has been certified by an industry independent body like ISO.

Re:Frosty Piss

[Hucko]

Wrong story? http://science.slashdot.org/article.pl?sid=08/11/18/0110209/

What level is kid-proof?

[Mishotaki]

Seriously, what level would it need to be to be protected from kids with too much time on their hands?

Having worked on DO-178B level B project

[jimmydevice]

The DO-178B standard specifies the engineering procedures and tasks that must be followed
to achieve certification to the level specified by and required by the FAA.
The three lower levels (B,C,D) are a subset of level "A" certification.
Level A states that failure of a level A system will result in loss of the aircraft.
Level B failure will cause disruption of flight and difficulties for the pilot.
Level C will cause additional workload for the flight crew.
Level D failure will not affect the flight crew, This includes in-flight entertainment...

Level A and B requirements includes detailed design documents that explain the purpose
of every line of code (prior to coding), code coverage with full conditional execution and
hundreds of other requirements that I've forgotten. IMHO, A DO-178B level A
O/S would take a department of 10-20 engineers 4-5 years.

Let me guess...

[xactuary]

It won't run Flash.

I already funded the development, as a taxpayer

[gr8scot]

Now, they want to sell me the "release version," as if they're suddenly a legitimate, privately funded dot-com startup of yore? I was born at night, but it was not last night. We citizens already own that product. Turn it over.

Re:I already funded the development, as a taxpayer

[Drawkcab]

How do you figure? The NSA didn't develop the OS, they just certified it. It was developed by a private company. The NSA makes companies pay to be tested this way, so it isn't tax payer subsidized.

Re:I already funded the development, as a taxpayer

[gr8scot]

... used in the B1B bomber and other military aircraft...

Now, do you suppose it was given to my military, as a xmas gift? Do you suppose development even began before a no-bid, cost+plus contract was signed? Like I said, I funded the development as a taxpayer already. I own that. Hand it over.

Re:I already funded the development, as a taxpayer

[Drawkcab]

So because its been used in military applications, you've constructed this elaborate fantasy scenario rather than just researching its actual history? It was developed years ago as a commercial product primarily for the embedded systems market. Military aircraft are just an example of the applications it's been used for after it was already a mature commercial product.

Re:I already funded the development, as a taxpayer

[gr8scot]

So because its been used in military applications, you've constructed this elaborate fantasy scenario rather than just researching its actual history?

Not close.

It was developed years ago as a commercial product primarily for the embedded systems market. Military aircraft are just an example of the applications it's been used for after it was already a mature commercial product.

Provide one other "example of the applications it's been used for after it was already a mature commercial product," shit-for-brain. It was developed for my military, after it received a contract from my military. I own it, bitch.

Re:I already funded the development, as a taxpayer

[Drawkcab]

Good luck collecting on that, troll.

Re:I already funded the development, as a taxpayer

[PipsqueakOnAP133]

Integrity for Avionics, the product you think you own, is simply a trimmed down version of Integrity, which is used in medical devices, industrial robotics, and other stuff like that.

After reading the product docs, the equivalent of what happened in the linux world would be: IBM starts with Ubuntu, and then the military asks "hey, can you make me a simpler version? I just want the bootloader, the kernel, and bash."

Re:I already funded the development, as a taxpayer

[ReedYoung]

Citation needed.

Integrity for Avionics, the product you think you own, is simply a trimmed down version of Integrity, which is used in medical devices, industrial robotics, and other stuff like that.

After reading the product docs...

The what?

The OS, which was first deployed in the B1B bomber in 1997, today runs in military and commercial aircraft, including the F-16, F-22, and F-35 military jets, and the Airbus 380 and Boeing 787 airplanes.

The information available suggests that the first deployment was its original purpose, and probable source of original funding. If the military did not subsidize the start of this company and the development of this product, then of course what I've said doesn't hold. But neither of you have provided any other sources of information yet. I've gotten my information from the article. What's the URL of your source?

Re:I already funded the development, as a taxpayer

[PipsqueakOnAP133]

You and the article are talking about Integrity-178B.

I'm saying GHS' web site and product info pages (www.ghs.com) says its a repackage of Integrity. (note, there's no 178B.)

In more detail: Integrity-178B is the same thing as Integrity trimmed down, an avionics added, and then the process of certifying the software suite and the customer's hardware together for DO-178B certification.

Both suites are EAL6+ certified since Integrity is EAL6+ certified.
The only code that could possibly be designed specifically for military use would be that avionics library.

I don't know for sure when or what the Integrity kernel was first launched or developed for, but considering we're talking about freakin' old company who developed embedded compilers, libraries, and debuggers back before the Macintosh was available, I see no reason to assume the OS core was built for a military contract.

Re:I already funded the development, as a taxpayer

[ReedYoung]

Scroll down to the bottom, and scan the list of names of their "Key Customers." Although GHS funding does not all come from military projects, so many of their "Key Customers" are military contractors that I doubt they'd be where they are today without military contracts and I stand by my previous statement: I funded that already and I don't welcome their second pass at my money.

What do you think about military outsourcing, generally? I know this isn't how it currently works, but my opinion is that GHS is welcome to provide this "Integrity-178B" product free of charge to net taxpayers like me, and cover their costs with their contracts with net tax recipients Raytheon, Lockheed Martin, etc. And the national defense should never have been privatized.

Re:I already funded the development, as a taxpayer

[PipsqueakOnAP133]

Keep in mind that the key customer table that you pointed me to is on a page specific to aerospace. If we were to look at this page: http://www.ghs.com/ConsumerProductsCustomers.html then we'd think HP owns them.

Clicking the "about us" link says they were founded in 1982 and were profitable since the beginning. This was well before the Integrity product launched, so I'm sure they had something good going for them for the previous 15 years. It could be military, it could be something else. But I don't see a clear military connection for a company that started it's product line with compilers and logic probes.

My opinion regarding military outsourcing and ownership is that if it's developed internally by the military, it should be shared with taxpayers as long as it's not a national security issue. It's the military. I have to assume that being the military, they'd want to have every advantage possible over any other military. So I would think that for the most important pieces, they'll do the R&D, but for anything that can be cheaply covered by commercial offerings, save the time and money and just buy it. If they decided it was more cost effective to buy it off the shelf or pay somebody else to develop it, then it's not ours. This would be simply because part of that discount in outsourcing is because it either leverages tech already developed or because the outsourced company still owns the tech.

I think should we own a part of NASA's tech and findings. But I don't think Garmin or SiRF owes me any source code just because their entire product lines depends on the military-developed GPS system.

Re:I already funded the development, as a taxpayer

[ReedYoung]

Thanks explaining your general perspective.

My opinion regarding military outsourcing and ownership is that if it's developed internally by the military, it should be shared with taxpayers as long as it's not a national security issue. It's the military. I have to assume that being the military, they'd want to have every advantage possible over any other military. So I would think that for the most important pieces, they'll do the R&D ...

The extent of outsourcing to Blackwater and Halliburton and KBR, and whatever are their current spin-offs' aliases don't fill me with confidence in that assumption.

Re:I already funded the development, as a taxpayer

[PipsqueakOnAP133]

It's unfortunate, but you're right that their use of Halliburton doesn't seem justified to me either.

Additionally, the fact that the war happened in the first place says there's some major corruption issues in the entire gov leadership.

they hate linux

[proind]

found this http://www.ghs.com/linux/threat.html on the Green Hills site, while looking for non-existent documentation.

there are a few other articles there talking about how horrible linux is.

a few questions id like to see answered

[nimbius]

are what are the overall capabilities of the operating system, its communication and data input methods outside and including standard user interface, and active countermeasures it employs against simple things like buffer overflow.

of course, proprietary OS means these statistics are blackboxed indefinitely, meaning that any claim or degree of security touted by the DoD cant be independently verified...
so how the fuck is this news again?? brjust blind curiousity, id like to see this bomber operating system go head-to-head against openBSD.

What this "OS" is about

[Anonymous Coward]

I think everyone horribly misunderstands what this "operating system" really is. (I have been working with it for years)
It is little more then a system executive with memory isolation and about 5k lines of code. (each mathematically inspected and proven)

It does not have a IP stack. (There are no ports to attack)
It does not have a GUI.
It does not have but a VERY basic scheduler (and I dont think the scheduler was part of the verified system but I could be wrong)
It does not guarantee your software you have running on it cannot be hacked (like an IP Stack).

All it does it make sure that memory from one container does not leak to another.
It is designed to support MILS (Multiple Independent Levels of Security) http://en.wikipedia.org/wiki/Multiple_Independent_Levels_of_Security

All this being said, from a security point of view it is a wonderful (but limited) foundation for building a secure system. (And GHS makes a great product)

Re:What this "OS" is about

[PipsqueakOnAP133]

"All it does it make sure that memory from one container does not leak to another."

Doesn't this also mean, no kernel panics caused by application software?
Doesn't this also mean, no privilege escalation can take place by hacking any piece of application software?

This sounds pretty darn good to me when it comes to security in embedded devices.

This is it

[hesaigo999ca]

Sounds fishy, smells like someone is trying to set up themselves a highly evolved botnet of PCs that
only the military would know about, hence how they get their AF cyberbotnet they kept talking about,
and this would also mean they would do a virtual layer, allowing windows or linux to lie on top of that, still vulnerable too. Wow, saw this coming a mile away, wonder who else saw it???

Also make back some of the money invested into this thing...by making available to the private sector.
2 birds with one stone!

DO-178B

[EchaniDrgn]

I've worked on Software with DO-178B compliance, that's what the 178B in the Integrity-178B stands for. If EAL verification is based on Documentation and Testing then I'd say that tacking EAL onto something that complies with DO-178B is just a short jump with a price tag tacked on. Moreover, the fact that it runs on the B1B is independent of their trying to be DO-178B compliant. Compliance with 178B is more in line with getting an OS/Software package certified for commercial aviation.

Sounds to me that Green Hills was aiming at this from the get go and is just picking up the EAL-6+ rating as another stamp on the box, and another advertising point. Not that I'm against software reuse, but once you know what goes into designing Aviation software, this sounds a lot less impressive.

http://en.wikipedia.org/wiki/DO-178B

Back to Square One...

[ibm1130]

The EAL6+ rating granted to the configuration represented by the B1B is unique and in order to get a like designation for anything else you'd have to go through the same hoops it passed through in their entirety. The fact that someone has gotten an EAL6+ really doesn't gain the next person to try much of anything beyond some familiarity with the process at Green Hills.

Integrity?

[hcdejong]

We've heard of it.

sO?

[conspirator57]

fEh

Mathematicians are abstractly smarter.

[arete]

My degree was in Mechanical Engineering, with a minor in CS, and now I manage a software firm (including hiring)

Mathematicians at a university are smarter, in my experience (dated by about a decade) I don't think this has to fundamentally mean there are no brilliant people in CS - I'd suspect the following mechanism:

CS is often really bad at evaluating students' ability. Possibly partially because they're a quite young educational discipline. Therefore, it's relatively hard to flunk out of CS due to lack of brilliance. (Flunking out from lack of DILIGENCE is different; a CS degree is still a lot of work.) I've seen VERY incompetent people with degrees from all sorts of places...

Math is often easier to flunk out of, and in some cases more likely to be very difficult to get program admission to. Perhaps this is partially because it's an extremely old educational discipline... And being less 'practical' I suspect there's a greater part brilliance and lesser part diligence to getting the degree. (That's not bad - some project management is important in CS!)

So if you take the same pool of candidates and randomize which field they go into, more people will stay in the program and graduate in CS than Math - at least in the admittedly limited subset of universities I've been exposed to. The best will do fine in either, the worst in neither, but a certain class of middle ones will pass in CS if they stick with it, and would fail out of Math.

I think it's also true that being a more practical, commercial discipline, there's simply demand for many more CS degrees, diluting the 'average' brilliance of someone graduating with that degree. I have made no attempt to verify this whatsoever, however.

Yes, I realize someone knows of a school where the math dept is easy and the CS dept is hard. I'm not trying to say this is a law of the universe, only a statistical truth.