NSA Releases Security-Enhanced Android

An anonymous reader writes with the recent news that, in line with its goal to provide secure phones to government employees in various domains, "The NSA has released a set of security enhancements to Android. These appear to be based on SELinux, which was also originally created by the NSA."

Comments

Enhancement, from the NSA?

[sethstorm]

Another platform, more backdoors?

Re:Enhancement, from the NSA?

[pushing-robot]

One source said it has twice as many backdoors as SELinux. Another source said ten times as many.

I think they're both correct.

Re:Enhancement, from the NSA?

[Baloroth]

SELinux Android is OSS, same as SELinux. Look at the code yourself if you are convinced there are backdoors. That is part of the point of OSS after all.

Re:Enhancement, from the NSA?

[Feyshtey]

Probably true, .. but source?

Re:Enhancement, from the NSA?

[Nerdfest]

I'm just amazed to see an Android story without a first post by Bonch or one of his ilk.

Re:Enhancement, from the NSA?

[Anonymous Coward]

One source said it has twice as many backdoors as SELinux. Another source said ten times as many.

I think they're both correct.

Wait, if it has both twice as many backdoors as SELinux and ten times as many, wouldn't that imply both have zero backdoors?

Re:Enhancement, from the NSA?

[mathimus1863]

Have you ever heard of the Underhanded C Contest. You get points for making the code exhibit some kind of backdoor, extra points for the more it looks like it could've been an innocent mistake (for instance, code where using a less-than-or-equal-to operator instead of less-than operator actually opens up an obscure security hole, and it's a mistake programmers make all the time).

I recommend you look at some of the examples of winning entries. It's amazing what these people have come up with. No number of eyes will find it. Simply put, even if it's a popular open-source project, thousands of eyes are likely to miss a well-placed backdoor like these. And if anyone is capable of doing it, the NSA certainly is.

Still don't believe me? How about the OpenSSH PRNG flaw that went unnoticed for two years, despite being used in servers all over the world. It was due to someone removing what appeared to be a useless line of code, but that code was actually adding some necessary extra entropy to the random number generator. It might've been an accident, or malicious. But the point is it happened, and on a high-profile project.

Re:Enhancement, from the NSA?

[Darkness404]

You can't be 100% secure, 100% of the time. There will /always/ be a weak link. Be it a backdoor or a security flaw. The goal is to manage your risks. Using security enhanced Android (after about a good month for security researchers to look at the code) is unlikely to introduce any more government-imposed security risks than simply being in the US and its tyrannical laws (PATRIOT Act, CALEA, etc.). Chances are, SEA is going to be more secure than the patched together stock Android system.

Of course they can hide a backdoor in it. But why bother when they already have nearly unlimited powers due to the PATRIOT act, have many corporations that will bend over backwards for the police state, and laws like CALEA.

Re:Enhancement, from the NSA?

[Anonymous Coward]

Capable? Yes. The NSA hires geniuses. But so do foreign nations, various companies, and universities. If we're going to indulge in an encomium of the extraordinary competence of the NSA, though, the most honest praise would be for an NSA imagined as most likely trying to provide genuine security with this effort, not backdoors, which open up the possibility of breaches or discovery.

Consider the NSA's purpose in making a secure version of Android: it's a system built by geniuses to be operated, in the end, by idiots, who are targeted for attack by other geniuses. From the NSA's perspective, there are two opponents: the brilliant Enemy and the Friendly moron. Leaving a backdoor, however well-obfuscated, provides the brilliant Enemy with an avenue for taking advantage of the Friendly moron who violates security procedures for his ill-conceived convenience. Backdoors allow breaches, and the NSA has to be smart enough to know that there are enough geniuses out there working for the other side(s) to find one and exploit it.

Consider also the fallout if a backdoor were to be discovered in the NSA's source code. Geniuses will be reading this code, if for no other reason than because it demonstrates the NSA's thinking. If someone found a backdoor and, instead of exploiting it or selling it to exploiters, decided to publicize it as an example of a purposeful NSA backdoor, the NSA would lose immense credibility. What kind of turf and funding wars would they face then, if the rest of the government agencies lost trust in them? Would the much-vaunted geniuses of the NSA consider that risk acceptable?

It's in the NSA's interest not to introduce even well-obfuscated backdoors in this product. It is in their interest to have such facilities available in consumer-grade products and exports, and God only knows what's baked into the phone companies' customized builds that they've compiled and installed onto a consumer-grade phone. It is not, however, useful to them to have such access in source code that is publicly available to be read by people looking for problems or compiled by people smart enough to know what they're doing.

If the NSA really is as smart as we'd all like to believe, they'll make this an honest, open, secure product without backdoors or traps. They'll make a product that will solidify their place in the government funding arena as the authority in hardened security.

Re:Enhancement, from the NSA?

[aintnostranger]

As others have said, the internet has many "non average" users. Besides, what is this myth about the "NSA superpowers"?? I mean, the people that work there and code there are human beings that went to the same colleges as everyone else. Not only that, but the internet is bigger than the US. If there's one superpower US agencies have that is money.

Re:Enhancement, from the NSA?

[dgatwood]

But the NSA can't beat the internet.

You're joking, right? Do you honestly think that, if someone were injecting a flaw, they would inject a flaw that was readily discoverable? No. Of course not. They'd introduce some miniscule mistake in some random number generator that makes the result no longer be quite uniformly distributed in such a way that the error is only detectable by performing thousands of calls and doing heavy math on them, thus enabling a side channel attack on the randomly generated symmetric keys used for SSL or some such.

Re:Enhancement, from the NSA?

[justforgetme]

While I don't necessarily disagree with your premise; could I interest you in one of my new security enhanced tinfoil hats?

Re:Enhancement, from the NSA?

[FormOfActionBanana]

Having done a little tinkering in this area myself, trust me. The Internet is not working very hard on this.

Re:Enhancement, from the NSA?

[justforgetme]

while mainly correct, your proposition ignores the fact that in programming you have a lot of plausible deniability in form of the programming mistake. A wrongly placed comparison or wrongly compiled regexp can have huge side effects while looking like little mistypes even a good albeit tired dev would make. Now think that by implanting such a small discrepancy into a big project you could do very many things without being ever detected. Also the side effects of such a behavior are very difficult to follow in a big project making the possibilities of it being forcibly discovered ridiculous since you would have to follow every reroute into oblivion before being sure there are not deliberate side effects.

Re:Enhancement, from the NSA?

[justforgetme]

BTW the UCC hasn't been updated in two years? the last contest post is from early 2010 and there is no winners anouncement.

Re:Enhancement, from the NSA?

[hairyfeet]

Oh please! That many eyes bullshit was proven to be just that, bullshit, or did you forget the KDELook bug? That one lasted 6 months. The Quake 3 malware? Lasted on the repo for a YEAR AND A HALF. The ONLY way the "many eye" theory would work is if you had many eyes of the appropriate skill level but as those and many other examples prove you do NOT have eyes of the appropriate skill actually looking at the majority of the code. Hell I'd bet my last dollar that at least a quarter of the code that makes up ANY average distro is ONLY looked at by the ones who wrote the thing in the first place. Now if the NSA went to one of them with a big fat check you don't think they'd take it? those guys at NETSEC were working with OpenBSD for FOUR YEARS and nobody caught on, if the one hadn't talked after his NDA ran out they'd have probably never known!

Remember friends just because you HAVE the ability does NOT mean that the ability has been used. How many here have looked at the code in your distro of choice networking stack? how many here have the skill to explain what each line is calling and what EXACTLY its doing? thought so, just because someone CAN doesn't mean someone HAS.

Re:Enhancement, from the NSA?

[arose]

If you are afraid of the NSA plating that kind of backdoor, then why would you be concerned about the obvious source (NSA code contributions), one that sees minority usage and extra scrutiny from security folks (being security code) no less? The smart way is to plant an individual into the dev community of a universally, gain trust, then plant it through them.

Re:Enhancement, from the NSA?

[VortexCortex]

The politically correct term is: "Magnetically Shielded Helm" or "Induction Resistant Headwear", never "tinfoil hats"...

...we stopped using "tinfoil hats" when the government had all of the household construction materials replaced with useless aluminum foil.

Re:Enhancement, from the NSA?

[Anonymous Coward]

Learn to read. Nobody said "ten", decimal "2" is represented in binary as "10".

Obviously you don't understand binary or English.

Re:Enhancement, from the NSA?

[GameboyRMH]

If this app has its own RNG algorithm in it I'd say that's a pretty big red flag already.

Re:Enhancement, from the NSA?

[K. S. Kyosuke]

Nobody said "ten", decimal "2" is represented in binary as "10".

Nobody said "ten", but the OP wrote "ten", if you really insist on being pernickety.

Re:Enhancement, from the NSA?

[IAmR007]

The NSA develops things like SELinux for its own use, not out of charity. Putting an intentional flaw in SELinux would open up back doors into their systems as well. Something tells me an intelligence agency wouldn't allow anyone clever enough to spot their flaw to access their systems, which might contain classified information.

Re:Enhancement, from the NSA?

[justforgetme]

You kind of have to at least acknowledge the fact that somebody could just have screwed up, it still is just "sacks of mostly water" that write those programs. That, of course, if you aren't pathologically paranoid.

Re:Enhancement, from the NSA?

[formfeed]

While I don't necessarily disagree with your premise; could I interest you in one of my new security enhanced tinfoil hats?

Don't be silly. We all know you can't trust a tinfoil hat unless you folded it yourself from source.

Re:Enhancement, from the NSA?

[evilviper]

Still don't believe me? How about the OpenSSH PRNG flaw that went unnoticed for two years, despite being used in servers all over the world.

No such thing... You probably meant OpenSSL, but I doubt a typo made you omit the fact that this was ONLY in the Debian packages of it, and worse, they were warned the patch was a terrible idea and ignored the advice.

Re:Enhancement, from the NSA?

[damium]

The algorithms for RNGs are quite simple and hardly easy to program in a flaw that would survive a review at that level. Entropy gathering, that's more complex but entropy is usually assumed to be non-uniform so we have some nice simple methods for converting it to be uniform. Also non-uniform RNGs would be detected in scientific work rather quickly and it's quite easy to test for statistical flaws by making a few hundred thousand random numbers.

Now, some package maintainer commenting out the line in OpenSSH that actually makes the numbers random, that could be a while...

Re:Enhancement, from the NSA?

[swalve]

I agree. I think they are more worried about keeping their shit secret than they are getting into other people's stuff.

Re:Enhancement, from the NSA?

[dgatwood]

You'd think this would be detected rather quickly. Unfortunately, history disagrees with you. It took almost two years. And this one wasn't even deliberately obfuscated by anyone.

Re:Enhancement, from the NSA?

[cduffy]

*sigh*. Think about it for a moment. For which values of x is it true that 2x == 10x?

Re:Enhancement, from the NSA?

[damium]

That was the incident I was referring to. In that case valgrind points it out rightfully as uninitialized memory, a patch to initialize it was reviewed by the OpenSSL team in 2003 and rejected with the stated reason that the PRNG used the uninitialized data as part of the entropy (they even have an FAQ entry for it). The Debian maintainer for OpenSSL proceed to patch the code in their build script later in 2006 by actually removing the call to the function! So in this case the bad patch wasn't reviewed by anyone who was familiar enough with the code to see the error (I couldn't find any place where the maintainer tried to send the patch upstream), that is why the bug was only on Debian based systems. Most of the people reviewing OpenSSL/OpenSSH were reviewing the source tree not the internal Debian patches.

On PRNGs: I've only coded PRNGs for my algorithms class years ago and only 1 of 3 algorithms was required to gather entropy so I wouldn't consider myself an expert on the topic. I do recall the math being exceeding simple however, no more than a few lines of code for the sequence generator itself (most of the work in the assignment was verifying the random distribution). I would doubt that one could hide a flaw in one from eyes that knew the algorithm properly. This is of course the main flaw with the many eyes claim - It's not the number of eyes that matter but rather the quality of the eyes (more eyes just increases the chance for quality).

Re:Enhancement, from the NSA?

[JasterBobaMereel]

The issue is not skilled eyes or appropriate eyes, but eyes at all, no-one is looking because it works..

The code does get security audited, by professional companies, often the same ones that audit closed source systems, it does get regression tested, but mostly by the people who wrote it ...

The flaw is that no-one is really looking for bugs in code that works, but that is also true of closed source systems ..

Is it secure from the NSA et al?

[TeddyR]

The question is what backdoors have they placed on it. Is it secure from themselves (NSA) and other three letter agencies?

Re:Is it secure from the NSA et al?

[chill]

Considering Android was pretty much swiss cheese to begin with, you'd have to wonder why they'd bother.

And the risk involved in doing something like that and releasing it all as source code makes even less sense.

No, I think the simple truth is the NSA realizes that being secure is hard work. Even people whos lives depend on it get it wrong. The average schmoe hardening up their smartphone is still going to fall prey to an easily shoulder-surfed password. Or the XKCD $5 wrench. Or all of the data that goes thru the boot-licking telecom companies. Or... or...

No, this is probably the real deal. The NSA guys hate Blackberries as much as the rest of us and are looking for approved replacements.

Re:Is it secure from the NSA et al?

[Anonymous Coward]

NSA is made up of two sections; one does cryptanalysis (i.e. signals intelligence), the other provides crytographic help for the government (and the public), often being at the cutting edge of cryptographic research.

SHA1 and SHA2 were NSA designed; do you trust those?

In any case it's open source (info page is here: http://selinuxproject.org/page/SEAndroid . currently down; use google cache)

Re:Is it secure from the NSA et al?

[Undead Waffle]

I'm guessing this is more related to the fact that the militar is looking into using tablets and other such consumer devices in the field. (See previous /. articles for reference. I'm too lazy to find links to them myself.)

Re:Is it secure from the NSA et al?

[thegarbz]

Check the source code and let us know. Kinda hard to place a back door in OSS isn't it.

Re:Is it secure from the NSA et al?

[The Grim Reefer]

or just direct a satellite to read the reflections on your glasses.

Sorry, we're talking about the NSA, not CSI.

This is probably appropriate too.

Re:Is it secure from the NSA et al?

[stephanruby]

And the risk involved in doing something like that and releasing it all as source code makes even less sense.

If you believe in security through obscurity, then yes that would make no sense to you.

Re:Is it secure from the NSA et al?

[MagusSlurpy]

Unless the "security through obscurity" is to make the OS more widespread, and so make actual NSA phones less obvious targets. One thousand "sensitive" phones amongst an install base numbering one hundred thousand slashdotters and tinfoil hatters is a good starting point.

Re:Is it secure from the NSA et al?

[Patchw0rk F0g]

or just direct a satellite to read the reflections on your glasses.

Sorry, we're talking about the NSA, not CSI.

That's not CSI, that's 007.

Re:Is it secure from the NSA et al?

[SpzToid]

That clip was amusing. What I found even more amusing was clicking one of the YouTube thumbnail videos off to the right side of that page, which lead me to the CSI gem below.

Never seen the show myself but it seems to be a clip where one of the agents is quoted as saying:

I'll go make a GUI interface using Visual Basic. See if I can track an IP address. [to find a killer]

Somebody got paid how much to write that? I can only believe some screen-writer slipped that in as an Easter egg for those with a clue. But for all I know, the medical shows are equal in this regard.

https://www.youtube.com/watch?v=hkDD03yeLnU&feature=related

Re:Is it secure from the NSA et al?

[GameboyRMH]

CSI has lots of product placement advertising for MS products. I'd really like to believe it was a hidden joke for techies, but... :-(

Re:Is it secure from the NSA et al?

[The Grim Reefer]

Oops. I meant to link CSI to this They forgo the reflection off of the glasses and get the one right off of an eye. And of course: "Enhance!" "Zoom!" "Stop!" "Enhance!"...

Re:Is it secure from the NSA et al?

[strikethree]

The funny thing is, all of that IS actually possible IF the camera records the data. Zooming in on photos can reveal details you did not notice when the picture was shown at normal detail levels... however

I am not aware of any consumer or professional grade cameras that are capable of recording that much information in a single frame.

The NSA has a good track record too

[Sycraft-fu]

Take a look at DES. There was a big to do about the NSA "messing" with the S-boxes in DES. People conspiracy theoried that they had weakened it so they could crack it. Nobody at the NSA or IBM (who made DES) would say anything about it. The, in 1990, differential cryptanalysis was discovered by public researchers and it turned out the DES S-boxes were way more resilient to it than had then been random. Turns out IBM and the NSA knew about it back in the 70s, but the NSA asked IBM to keep a lid on it. The NSA's changes made DES more resilient.

Time has borne it out too. DES is decades old now and there has been no magic break in it discovered, no "backdoor" that would let people in, it is just too short a key to be useful anymore.

Along those lines, the NSA has signed off on AES (which was originally developed in Finland) as an approved standard to be used for classified data and said that AES is good security for the commercial world (which was the point of the AES standard). Again, time seems to bear them out on that, it is the most analyzed cryptosystem out there, and nobody has found any "backdoor" in it.

While there's no doubt the NSA takes their signals intelligence mission seriously, they seem to take their security mission seriously too. Their track record so far is excellent. Everything they've released has stood the test of time.

Now I suppose it is possible in theory that they are so far advanced of everyone else, and so arrogantly confident in their superiority, that they have hidden "backdoors" they figure nobody will ever notice... However if they really were that much better, would they need to?

Re:The NSA has a good track record too

[IAmR007]

Yeah, why break something that you are going to use, especially when your security requirements are far higher than an average user.

Re:It needs encryption not security controls

[Zeroedout]

Seriously, the biggest problem with Android is it's complete lack of filesystem encryption.

And how do you propose to securely decrypt the filesystem at boot? Have a touch screen keyboard as part of the boot-loader?! I'm sure U-Boot will accept your patches....

Re:It needs encryption not security controls

[FormOfActionBanana]

Probably not the decryptor function!

AES Finland?

[Anonymous Coward]

No Sir, you must be joking. AES ie. Rijndael comes from Belgium.

AES

And yet, .....

[Anonymous Coward]

These are manufactured in China. As long as that occurs, nothing about these can be secured. The west, if not the USA, should require that phones be produced in the west, using western components. After all, Chinese gov. is bright enough to do the same. They refuse phones that do not have parts PHYSICALLY produced in their nation. Of course, they are in a cold war with the west, so it makes sense for their actions.

Its funny

[Anonymous Coward]

Having gone through the comments here, to read the distrust of the NSA. To be honest, that is good.
Yet, for a number of you, you will trust the physical hardware is OK coming in from China. Why on god's green earth, would you trust china, a nation that has more spies running around the world, esp. in the west, then does America, while screaming that America has planted a backdoor in open code?

Re:It needs encryption not security controls

[GameboyRMH]

What's wrong with that (apart from the standard PITA factor of on-screen keyboards that most people seem to accept)? They'd have to randomize the keypad layout though to prevent password recovery via fingerprint-lifting.

Re:It needs encryption not security controls

[chill]

The Asus Transformer running v2.3 Honeycomb had full disc encryption. When it started to boot, it would show a virtual keyboard and I'd have to enter my password.

It is a little easier on a tablet, with the bigger screen, but it certainly was possible and not cumbersome.

fembots

[pbjones]

many times I read the title and think of something very different, this time it was 'enhanced android', must be a fembot! from Austin Powers.

BACKDOOR

[Syobon]

SELinux was the only way the US government could reach the linux kernel and implement a obfuscated backdoor worldwide. What is a difference between a bug or backdoor, from inside the source code they are the same.

Another noose for the dev manufactorers.

[Bill, Shooter of Bul]

Anything that removes potential security flaws from android is a double edged sword. Its many of those flaws that allow us to get root and install custom roms.