Slashdot Mirror
How Do YOU Establish a Secure Computing Environment?
sneakyimp writes "We've seen increasingly creative ways for bad guys to compromise your system like infected pen drives, computers preloaded with malware, mobile phone apps with malware, and a $300 app that can sniff out your encryption keys. On top of these obvious risks, there are lingering questions about the integrity of common operating systems and cloud computing services. Do Windows, OSX, and Linux have security holes? Does Windows supply a backdoor for the U.S. or other governments? Should you really trust your Linux multiverse repository? Do Google and Apple data mine your private mobile phone data for private information? Does Ubuntu's sharing of my data with Amazon compromise my privacy? Can the U.S. Government seize your cloud data without a warrant? Can McAfee or Kaspersky really be trusted?
Naturally, the question arises of how to establish and maintain an ironclad workstation or laptop for the purpose of handling sensitive information or doing security research. DARPA has approached the problem by awarding a $21.4M contract to Invincea to create a secure version of Android. What should we do if we don't have $21.4M USD? Is it safe to buy a PC from any manufacturer? Is it even safe to buy individual computer components and assemble one's own machine? Or might the motherboard firmware be compromised? What steps can one take to ensure a truly secure computing environment? Is this even possible? Can anyone recommend a through checklist or suggest best practices?"
If you want a secure computing environment, don't connect your computer to anything! Also keep it in a faraday cage, and make sure the power supply lines are filtered so they can't carry signals out through the cage.
That's what I did last time I needed a super secure environment. Local network only, KVM extension to put the user interface far away from the locked up computer. Granted that's not what the article is looking for, but that was the best solution I could find at the time.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Get the necessary equipment and make your own CPU. Also make the lithography masks yourself to ensure your paranoia score reaches a maximum level! Next proceed to make your own motherboard (making all the components yourself as mentioned earlier). Also you'll have to create your own CRT monitor (imagine if they intercepted the signals between the graphics card and the monitor!!!). And you might want to sit in a faraday cage made out of mu metal with your own personal lemon battery based power supply.
A faraday cage is not enough. Make sure no optical signals can get out of the room.
cpghost at Cordula's Web.
Nobody but me gets to my abacus!
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've got a VM that I run on Windows 2000. That OS is no longer patched by Microsoft so I don't want to expose it to the internet. I turned off all the networking protocols and shut off all the services that have to do with I/O. If I open a browser the only site it will connect to is a server I have running inside the VM, which requires a password. I turned off the network shares so there's no chance of getting an infected file from the host machine. The only way to write a file to it is via a USB drive and I scan those before I connect it.
The OS runs great and, with all those unnecessary services turned off, quickly as well.
You have to achieve a personal balance between functionality and security. Security and functionality are inversely proportional. For the average user, having a login password will be enough. If you are storing private data, like tax returns and financial documents, encryption is a good idea. A Truecrypt container with a strong password (16+ characters, upper and lower case letters, numbers, and symbols) will suffice.
If you are of the moderately paranoid group (like me), then FDE, private browsing, and a SSD with TRIM capable motherboard/OS will be enough. If you believe the NSA is watching you, then try taking your meds and refer to the moderately paranoid measures.
sudo make me a sandwich
The Ninja post was a joke with a point: It's practically impossible to do "secure computing" unless you are an island unto yourself.
The better question is:
What level of security is "cost effective" for you?
I'll give my answer as a reply.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The term "secure" here is used in a bit misleading manner, there's nothing that could possibly be absolutely "secure" in this world, ever.
We should always ask only what amount of security the environment provides. In terms of money.
To ensure you have a secure computing environment: 1) Don't buy a computer and 2) Don't turn it on -the first line of pretty much every book on information security...
It's very hard to live in a constant state of fear and paranoia. Better to unplug and relax.
none
i actually run linux on the desktop to help stay secure and don't pirate software. Add some ufw firewall rules and a router based firewall and you can survive most non-local (in the room) attacks.
1. Write your own OS, that way the government can't backdoor your OS's manufacturer without prior knowledge.
2. At a minimum flash your motherboard's firmware to something trusted or written yourself
3. Write your own anti-virus
4. Run ethernet wire to trusted locations (make sure it's outdoor grade wire)
5. Install security cameras at trusted locations and filter everything from them via DPI.
6. Surf mass pron off a random trusted location.
...involves condoms on the cables.
1 What are the threats? 2 Why do you care? 3 Expose as little as possible 'publicly' with as few people even knowing you have diamonds in your safe. 4 Have 'CCTV' so you can detect intrusions (and possibly a honeytrap) 5 Assume anyone with $$$ to spend technically will first spend $ on more basic intelligence. 6 [This list goes on and on]
Breathe into this paper bag. If you still feel dizzy, lie down..
Kudos to you AC! Not many of us have paranormal means of posting to /.!
I lie about everything
On the other hand, perhaps there's another explanation.....
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
lock all your computers down. physically check them before they connect to the network. install DLP and other software to disable all ports. kill any unused port on your switches. allow only approved TCP ports in and out of your network. scan everything with application layer appliances and switches
There is no way you can avoid putting trust on something outside your own control, be it the C compiler, firmware on the motherboard or the CPU itself. So what you really are asking is "where should I put my trust level". That depends extremely from person to person and is next to impossible to answer, almost like asking "what car should I buy". You cannot expect good answers to what you ask without providing good indicators about what threats you consider important. However, the slashdot crowd usually does not pay any attention to the original question in any case, so maybe it is not that important :)
When you are sure of something, you probably are wrong (search for "Unskilled and Unaware of It").
one as a decoy and the other where you have your security.
"Do Google and Apple data mine your private mobile phone data for private information?"
Really? You ask that question? Eric Schmidt stated a couple years ago that "Google isn't free- the cost is your information".
Even the US Govt considers your data no longer yours once it leaves your possession. Meaning, no search warrants are required for cloud based data. It's like taking garbage to the curb, it's a free for all.
Not only is your data not secure in the cloud, it's much more attractive target. Little me, "joe smith" is not a target at home, nobody gives rats rump about me... but Google or yahoo or hotmail... that's an exciting target for hackers. If you're data is there, you are now attractive via proxy. They get hacked, your data is compromised.
The problem is, laws haven't in any way kept up with technology. Unfortunately, mega global corporations now generate huge revenue off this broken model.. Thus, in the US anyway, it's now impossible to fix. It takes money to run for office, companies have money, therefore most elected officials are puppets of the corporate world. That's just fact in the US. Laws are not to protect people anymore.. just protect revenue.
My "computing environment" is quite adequately secure against my threat model which is limited to criminals who might want my secret banking information. Yours might include the NSA or even Bruce Schneier.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
This is about my personal computing, but I would apply the same general principles to other non-critical environments.
What's the worst thing that could happen to my computers? Someone sneaks into my home and installs a hidden camera to catch everything that's on the screen and all keyboard input, AND they somehow install something to log all network traffic and become the man in the middle when they want to.
How likely is this? Unless the feds confuse me with a terrorist and do this with a warrant, it's exceedingly unlikely.
What are some other "high-loss" risks?
* Virus that encrypts my computer and holds it ho$tage
* Virus installs a keylogger that captures an email login, banking credentials, etc. and uses them to impersonate me in a very bad way. "Hi, this is your bank. Your wire transfer to OFFSHOREBANK was processed this morning. This is just a call to remind you of a low-balance fee if sufficient funds are not deposited by the end of the day. Thank you."
* Fire or other calamity that physically destroys my computers, and things a lot more important than my computers.
So here's the big question:
What are the security vulnerabilities I can mitigate cheaper than the "cost" of just not having a network-attached computer at all?
* Fire/theft/physical loss. Mitigated/prevented by backups, casualty insurance, fire extinguishers, etc. .TXT, TAB- and comman-delimited simple spreadsheets, .GIF and .JPEG images, and some versions of PostScript and PDF files are among the many formats that will likely be easily readable 10 or 20 years from now assuming the media is still readable or that the file has been copied to new media before it became unreadable. Human-readable paper printouts, photographic slides, and photographic negatives are also pretty much immune from becoming technologically obsolete in my lifetime, but they require large amounts of space and a certain amount of care. Paper and especially film also decays over a 10-100 year time frame.
* Theft: Good encryption and good passwords. Pray the thief or his buyer isn't a forensics expert.
* Malware. Mitigated/prevented by backups, low-cost ("$50+tax with $50 mail-in rebate!") security software, "safe-surfing" habits (script-blocking, etc.), 2-way firewalls on the computer and network gateway/router, etc.
* Legal government intrusion: Mitigated/prevented by living in a relatively free country. Cannot be eliminated.
* Illegal/rogue government or ISP intrusion: Mitigated/prevented by living in a relatively free country that can and sometimes will throw individuals responsible in jail. Work on the assumption that this cannot be eliminated.
* WiFi intrusion on my home net: Mitigated by strong encryption and a good pass-phrase and a WiFi Router vendor that I trust.
* WiFi spoofing: Unknown risk.. Other than keeping the password secure and avoiding algorithms that are known to be vulnerable, I don't attempt to mitigate or prevent this.
* Public WiFi hotspots: Compute with care, avoid using them unless absolutely necessary. Prefer my cell phone's "G3/G4" instead of an unsecure or secure-but-untrusted hotspot.
* WiFi- and Bluetooth-based attacks: Turn off WiFi when not in use. Don't allow connections in or out without my permission.
* Backup failure: Test backups. Have multiple backups in multiple formats from multiple points in time.
* File format obsolescence: Have really important stuff in formats that will likely outlive the usefulness of the data.
Bottom line:
* If I lose everything I have on my computer, it won't drive me to suicide.
* The very important stuff is backed up in multiple places including offsite and in multiple formats.
* The medium-important stuff is backed up.
* If I can prevent a large amount of likely damage at a low cost, I'll do it.
* If I can't afford to lose it, I can't afford to NOT insure against loss.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
and work to keep it that way. Security is a political state, according to most experts (Schneirer et al). And yes, "reducing the size of government" in a democracy means reducing that democracy.
"Do Windows, OSX, and Linux have security holes?" Of course they do. A better question is, "Are they likely to have security holes that are known only to malicious actors that remain secret over time?" The usual answer for Linux is "NO WAY READ THE SOURCE!!!@!" In practice, not many people are qualified to review source for bugs, although backdoors inserted into widely reviewed and read code are likely to be detected before backdoors inserted into a code base with few people looking at it. As for backdoors in common OSes in general, the best answer is "probably not." Even without direct access to the source code, behavioral analysis of network traffic should show something's odd. Besides, large conspiracies are hard to keep secret. On the flip side, if your adversary really is the U.S. government or a similarly funded and capable entity, OS security holes in common OSes are the least of your concerns.
"Does Windows supply a backdoor for the U.S. or other governments?" I'm guessing you mean the NSAKEY. Again, network behavioral analysis is your friend in detecting this. A better question is, "Does Microsoft provide a backdoor for themselves?"
"Should you really trust your Linux multiverse repository?" Maybe. A detailed explanation of what happened with the kernel.org compromise a while back was never forthcoming, at least not to the extent that FreeBSD has been with their own recent compromise. A better question is, "Do my adversaries have positive control over [insert resource here] in a way that is undetectable to me and others of [resource] over a sufficient time period to adversely affect my security?"
"Do Google and Apple data mine your private mobile phone data for private information?" Probably. What's "private information" in the context of your user agreement with them for use of their products? Unless expressly forbidden by law or contract (and sometimes not even then), you can expect a company to do what's best for itself. If that happens to also benefit you, great. If not, too bad. Better question: "Does [device] purchased from [company] have the obvious capability of making my data available to [company] should they have an interest in it?" Follow on: "Is it in [company]'s interest to protect my data? If not, is there a way I can make it so, or limit the access [company] has to my data?"
Does Ubuntu's sharing of my data with Amazon compromise my privacy? Maybe. See that part above about contracts, law, and corporate motivation.
"Can the U.S. Government seize your cloud data without a warrant?" In some cases, yes. I'm not completely current on court cases, but I think e-mail left on a service provider's system for >= 6 months can be read without a warrant. I think there's also some provision for mail that's been "opened," too. There have been numerous reports, however, that service providers have provided information to the government upon request, without requiring a warrant. I personally think the telecom industry is all too cozy with the government, and think the telecom immunity bill Congress passed is evidence of that. There are also some interesting correlations, e.g., Qwest was the only large telecom to NOT cooperate with the warrantless wiretaps, and their CEO was convicted of fraud. Better question: "Do I have data sitting around on a system over which I do not have positive control which I should've stored locally or deleted because it was no longer relevant?" Current law is much more protective of personally owned things (where the law agrees that a normal person would have some expectation of privacy) than it does of cloud services (where you have deliberately handed your data over to a third party, thus weakening the expectation of privacy that the law assumes a normal person would have).
"Can McAfee or Kaspersky really be trusted?" Assuming you don't mean John McAfee or Eugene Kaspersky personally, they can if being trustworthy is in their corporate int
What this gets down to, even starts heading down that path right in the question, was covered by Ken Thompson in the classic paper "Reflections on Trusting Trust": http://cm.bell-labs.com/who/ken/trust.html
There are some good questions in there but, the rathole its starting to go down is not helpful. You need to look at what secure means to you first. What are the use cases for the environment? What does the environment need to allow? What should it not allow? Why? Answer those, and the path forward will become more clear.
"I opened my eyes, and everything went dark again"
If you're paranoid enough to ask those questions, then I'd suggest an air-gapped computer. Anything you want to install on it use a USB stick, so what if it has or installs a backdoor? There's no way to talk to that backdoor anyway. Unless you think somebody is going to create a custom trojan to infect the machine, extract whatever it wants and store it on the USB stick, then upload it to the mothership next time you plug it into an Internet-enabled computer. But if that's a concern you should probably put your computer in a Faraday cage in a vault too, because then you must have a three letter agency on your tail.
Live today, because you never know what tomorrow brings
I have thought about possibly using one computer just for on-line banking and another computer for everything else. That way the computer that is used for on-line banking would most likely never have been exposed any websites, email messages, or anything else which would be likely to contain malware. The computer that I would use for on-line banking would probably either use Linux or be a Mac.
I would not be 100% sure that that the computer used for on-line banking is clean, but that is probably about the best that I could easily do. I am not an expert on computers or computer security, but that seems like one possible resonable precaution.
My main desktop computer runs Linux, by the way, so if I were ever to add an on-line banking only computer, I would probably choose Linux for it too.
I lie about everything
Infinite loop detected... failure...
.
No matter how secure the OS is, no matter what security apps you are running; I am sure that you will find a way to bypass all that security and suffer an exploit.
any machine that has been used can be compromised. just like your living room, if a thug REALLY wants to get in, they will.
your task, therefore, gentlemen, is to be as frikkin BORING as possible. please to start with best Star Trek captain. nobody will bother you then.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Have a "secure ops" room with a computer that is run off of stock "dumb" batteries delivering the normal voltages delivered by a power supply. Your normal laptop's battery is too smart for the job.
Make sure the room is EMF-proof when the door is shut and locked from the inside. Yes, that includes visible light, so you'll need a battery-operated light source.
Make sure the only input is the keyboard and mouse or equivalent. Make sure the only output is the screen and optionally a printer or equivalent write-only device. Make sure the storage is not only sealed inside the computer but that its contents can be destroyed at the touch of a button AND that the contents self-destruct if the door to the room opens while the computer is powered on. Make sure there is a strong power-on password or other authentication mechanism and that the data storage self-destructs after only a few failed attempts to gain access.
Oh, finally:
Make sure your computer has a "trusted bootloader" that only runs "trusted applications" and that nothing is installed on it that is not needed. Lock down the entire system so seemingly-non-malicious mistakes don't compromise the computer itself in a way that isn't immediately obvious. For example, it's okay if a malicious insider's buggy formula in a spreadsheet gives a mathematically incorrect answer, but it's not okay if that causes the spreadsheet to create a file that grows big enough to trigger a bug in the filesystem that disables the "trusted bootloader" mechanism so the next time the machine boots, someone can run a script that creates an EXE file that logs all future keystrokes for the malicious insider to view and memorize later. Of course, any computer you put in this room will have to be designed and built by someone you trust, using parts designed and built by someone you trust, etc. Alternatively, the computer can be simple enough that you can mathematically prove it is trustworthy.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
>use an entirely separate computer.
No. You don't have to. If you can boot from a USB port or CD/DVD, use a live read-only OS and boot from it.
An example of it is here: http://www.spi.dod.mil/lipose.htm
You can do the same thing with other live distributions like Knoppix, Trinity, Ubuntu, etc.
--
BMO
Layer 1 (most secure): strictest confidential information, for storage purposes only. system locked metal room with no windows and no internet, system locked in cage with access to display, keyboard, mouse, and drive, all data read/written to drive is permanently logged, connected to layer 2 via sneaker-net.
Layer 2: strictest confidential creation and reference. internal LAN only systems, user endpoints are read only and contain no drives or usb. server is in locked room with limited access and contains files accessed by users, as well as user endpoints with write capability, connected to layer 3 via sneaker-net.
Layer 3: confidential creation and reference. internal LAN with write ability to files, temporarily read only network connectable to layer 4 via password.
Layer 4: normal productivity with confidential read access. normal internet connected network, usb and drives on centrally located system controlled by admin, all io logged.
Most often than not computers and servers are intruded by spammers to install spam-sending bots. So, join spam reporting scheme on a regular basis, for example: http://blackhole.mx/ Only human smartness can counter human smartness.
Use at least 2 operating systems, at least 2 browsers, at least 2 office applications, etc. Because if there is one and only one monopoly software or hardware vendor, it is much easier for it to get corrupted. A realistic competition is the best measure against corruption.
You raised serious questions of the civilization's scale. As any serious problem the problem of security can be solved by a systematic work and communication, at least partially. It will always be a running battle between good and evil.
That's a silly post. Syn attacks aren't about "security" they are about usability (except for the edge cases where you can syn-flood a computer into a vulnerable state). Security is about data loss or exposure, and a syn flood makes your computer *more* secure. If it's down, you can't lose anything. But nobody can use it, either.
Learn to love Alaska
1 - Reload all computers that come in the door with *your* load. .. Lock down the OS users dont need to be installing things. that's your job.
2 - Lock down hardware to prevent things like USB from working
3 - GPO ( or equivalent on *nix)
4 - Monitor monitor monitor... Both at the PC level and network.
5 - No BYOD..
---- Booth was a patriot ----
Only useful if you can trust your firmware...
Two of my imaginary friends reproduced once
Is it anything like a thorough checklist?
Your trolls are an enormous waste of time, but I still laughed because of your devotion to duty.
Hail Eris, full of mischief...
E pluribus sanguinem
I lie about everything
On the other hand, perhaps there's another explanation.....
That's no explanation, because he'd clearly have to be lying about lying about everything, but that means he's telling the truth, but that means he lies about everything, but that means .... *does not compute* *does not compute* *head explodes*
I am officially gone from
You have to start with the position that no OS, network, or configuration is ever going to be 100% secure. If the system is accessible by someone via some means, it has at least one vulnerability.
This is why blanket questions as asked in the original posts are worse than useless. Asking is certain OSes have vulnerabilities (they do) is a waste of time. Looking for bogey-men like government backdoors or vendor/service providers is equally useless: either they exist and you can't do anything about them, or they don't and you're worrying about nothing.
But the biggest problem with blanket questions is that they lead to one-size-fits-all thinking. And with designing a secure environment, there is no one size that fits all. What works perfectly is one environment is a huge overcompensation in another, and woefully inadequate in a third. You have to look at your specific environment, including business processes (involving humans, not just electrons), resources, physical environment, everything. If you're considering setting up security, don't think in terms of "secure computing environment", think "secure environment." Limiting your scope to the computing environment only introduces blind spots (vulnerabilities).
I call this reasoned paranoia for two reasons: it serves a distinct purpose, and it stops short of tin-hat thinking. Your approach needs to keep what you can do as the focus. You can't close government backdoors, if they even exist. You can't stop hackers in Pyongyang from probing your firewall. You can't close (or even know about) every vulnerability that currently exists in your environment. But you can understand that they are there, take reasonable steps to close or manage the ones you know about, and have plans in place to respond when new ones are discovered or exploited.
Find a used Commodore 64. Doubt any virus could fit in memory.
-- By all means let's be open-minded, but not so open-minded that our brains drop out.
Place computer in a blast furnace. Toast until all metal is in a liquid state. Poke with stick until computer no longer resembles computer. Allow to cool. (preferably with liberal application of cold water) Transport left overs to a old witches graveyard. Bury under the light of a full moon. Giggle about HOSTS files as you walk away.
I did it all for the penguins!
A computer that is infected by a virus where the VIRUS ITSELF leads to output that is not a result of operator input + the programs the computer is designed to have on it may be "secure" in a narrow sense of the word, but not in the broader sense of the word.
Let's suppose that instead of STUXNET infecting the Iranian computers that were connected to the centrifuges through social engineering and/or USB memory sticks, they had been deliberately infected at the computer-manufacturing factory or during initial setup, before they were attached to the centrifuges.
While it is true that they would not in turn infect other computers outside of their "secure network," they would still not be trustworthy and therefore, in a broad definition of the word, they would not be a "secure computing device."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Can anyone recommend a through checklist or suggest best practices?
Step one: Put someone else in charge of security
Step two: Make that someone else liable for security breaches.
That's why part of my home security system is a 70kg (150lbs for you yanks) CRT TV. A burglar would steal my neighbours LCD before they steal my antique.
First of all start with parts which are proven to be reliable. For example Linux or OpenBSD.
Then think of your security risks. What is your problem. Do you not want your data to get out? Do you want to provide services even if the world ends? Thos are all different kinds of problems requiring different solutions.
Then get your processes straight. How do you install software? If it's google X free download, click on the first link and download it to install it, you might want to re-think them. Who has access to the machine.
Then make your system as minimal as possible. Don't install any services or software packages you don't need.
Then, and perhaps actually earlier, how is your physical security. Do you have multiple armed guards to prevent the attacker from entering? How secure are they against social engineering?
If that seems overblown to you, just get your average Linux distribution (like Xubuntu) and install it with software harddisk encryption. That should be good enought.
Then you know what?
Don't use a computer. Ever. If there is no end to what you can trust, not even a computer encased in concrete at the bottom of the Challenger Deep is enough.
Your response is ridiculous.
--
BMO
You don't need computer security, you need psychiatric help, seriously. I've known people with paranoid delusional conditions before. Talk to to Psychologist about getting help and make sure you take care of your mental health. You really, really, don't want to end up on the street where your mental health spirals out of control.
If your not willing to work with that than I suggest you keep a few practical thoughts in mind:
The FBI doesn't care about your porn habits unless they involve underage kids.
The CIA could care less about you unless your working on behalf of a foreign government and even then probably not.
The NSA consider you a civil matter.
If your in another country simply substitute your local government agency for the right one.
Frankly if you were working for anybody that the CIA, NSA etc actually cared about you would be getting professional advice from your employer, and not by asking Slashdot. You sound like a young person thinking about becoming a script kiddie or someone with delusion of prosecution over warez trading and porn surfing. The comment is quite sincere, you need to seek help from a mental health professional.
I'm going to assume that this is a serious question, if slightly fuzzily worded. And that what you want is the best security position that is practical, and still have a computing environment that is useful to you.
So this is going to draw some fire I suspect, but maybe start by reading the PCI DSS Data Security Standard and apply as much as possible of the practical stuff to your environment.
PCI DSS has its issues and its critics and is most definitely not perfect. But it is an attempt by a group comprising of all the major credit and debit card brands to define how to secure a computing environment that is connected to the internet and contains sensitive information.
A lot of it won't be relevant to you. But if you're not trying to achieve compliance, you can throw out the bits you don't need.
Never trust a man in a blue trench coat, Never drive a car when you're dead
Do Windows, OSX, and Linux have security holes?
Yes.
Does Windows supply a backdoor for the U.S. or other governments?
Yes.
Should you really trust your Linux multiverse repository?
No.
Do Google and Apple data mine your private mobile phone data for private information?
Yes.
Does Ubuntu's sharing of my data with Amazon compromise my privacy?
Yes.
Can the U.S. Government seize your cloud data without a warrant?
Yes. (The U.S. government can do anything. Your only recourse if they do something wrong is to sue them. Suing them typically takes years of time and hundreds of thousands of dollars for you. Thus, in a practical sense no one really has any firm rights any longer because the system in charge of correcting breaches to those rights is not accessible or swift for an average citizen using it.)
Can McAfee or Kaspersky really be trusted?
No.
Naturally, the question arises of how to establish and maintain an ironclad workstation or laptop for the purpose of handling sensitive information or doing security research. DARPA has approached the problem by awarding a $21.4M contract to Invincea to create a secure version of Android. What should we do if we don't have $21.4M USD?
Use FreeBSD or other extreme minority operating system.
Is it safe to buy a PC from any manufacturer?
Not any, but likely most.
Is it even safe to buy individual computer components and assemble one's own machine?
Again, usually it would be. It seems like software is typically the vector of attack. Hardware much less often comes with built-in vulnerabilities.
Or might the motherboard firmware be compromised?
Less likely than the OS, but remotely possible from some manufacturers.
What steps can one take to ensure a truly secure computing environment? Is this even possible?
Don't connect your computer to the Internet. Even if the OS is hacked, the motherboard firmware is hacked and the hardware itself is hacked, it doesn't matter if nobody can access it but you.
Can anyone recommend a through checklist or suggest best practices?
http://lmgtfy.com/?q=secure+hardware+and+software+computing+checklist
__
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
Does lying require falsehood, or merely an intent to deceive?
no physical access to the computer. it's in a locked case. Network is isolated and also locked up, running the network cables inside metal conduit is a plus, any long runs MUST be fiberoptic in armored cable if they exit the secure building or room and then the data traversing it must be encrypted.
No internet access at all. no local storage at all. All storage is on the server in encrypted volumes. No you cant print, no you cant save to a disk or anything but the server.
Final step, do what lockheed does. LCD screens have no polarizer on them. you must wear polarized glasses to see the screen. PLUS you have a 3m privacy filter on each screen.
you want email, you use your lower security computer that is outside the secure environment.
100% hacker proof unless they are able to compromise an employee that has access to the server room where the only place you can get a copy of the data is located.
Do not look at laser with remaining good eye.
Yes, booting from a LiveCD is another good alternative. But even if I used a Live CD, I would prefer to run it on a separate computer, so that I would not have to reboot everyday just for checking my online banking. Unfortunatley, that would actually require two reboots every day, once to boot up the live CD, and once to bootup back into the version of Linux that I normally use at home. Instead, I would prefer to leave my normal desktop computer running and then just boot up another computer with the live CD whever I need to use it.
If I ever actually do that, I might use a liveCD, or I might just install Linux on the banking only computer instead. If I were to unplug the hard drive, I could then probably assume that any ordinary Linux liveCD then had the extra security of being a read-only OS, although, Linux installed on the hard drive would have had more recent updates, including security updates.
I had not heard of the LPS-Remote Access liveCD that you mentioned, that sounds like a very good choice.
Back in 2009, Brian Krebs wrote these two articles that suggesting that small to medium-sized companies who lack fulltime IT/ security staff, use a Linux liveCD if they do online banking.
Read the all the docs. Install from CD. Don't panic.
If this is about a critical, large budget kind of thing, then this is so secure that I dare to claim that it is perfect, even though it theoretically is not.
1. Get some general hardware, supported by Coreboot;
2. Examine the code of Coreboot, then compile with a compiler release that is way older than the hardware;
3. Examine a microkernel codebase, newer than the hardware, then only compile what you need, simply because unneeded codepaths that are connected to other code can lead to a theoretical exploits;
4. Encrypt network communications, then bitflip for corruption, and include random noice (Rubberhose File System style);
5. Run a whitelist network packet checker, like Mandatory Acces Controll profiling, for communication.
6. Write application for functionality of computing device, compile for other CPU architecture, and emulate on CPU emulator lib.
Should be good enough, no?
Here be signatures
No, the notion of "secure" computing is ridiculous. The U.S. DoD is on both the giving and taking end of firmware exploits which made me smirk when you mentioned LPS.
On a side note. Has anyone ever mentioned to you that you come across as having a bit of a belligerent personality?
Two of my imaginary friends reproduced once
There's no perfection to be found anywhere, but you can be about 10000X safer on Linux than on Windows
Are you sure it is 10000x and not 100000000x? How does one go about calculating the proper number of zeros?
There's a huge variety of software in the repositories and any malicious software would be quickly removed
It often takes people years if ever to find innocent bugs and remove these defects... yet whenever your faced with an advasary who has intentionally hidden an expliotable defect then of course it will be detected...and quickly where the innocent bugs have not...yes...sure... of course... this makes perfect sense.
Is this perfect? Of course not
Is this gyberish? Of course it is.
But it's WAY WAY better than the situation on Windows where people install random malware to see "dancing bears"
Are you saying it is not possible for users to install random malware to see dancing bears on a linux machine? If a user downloads and runs a linux program... does it not execute?
or where Windows will auto-run executables just because you put a USB key into your system. Seriously microsoft, WTF?
Seriously Linux... WTF?
http://www.youtube.com/watch?v=ovfYBa1EHm4
And I won't bother asking what happens when that random USB key emulates a HID device and opens its own shell.
So, set up a Linux machine, don't run javascript from web sites unless it's a well known trusted site like your bank, only use software from the repos, and you'll be secure for most practical purposes as a "normal person" who isn't the target of the KGB or something.
Being a "normal person" is no fun. I thought the whole point of TFA was cloak and dagger on the cheap?
I see that many comments have done a good job pointing out the paranoid mindset of the questions in this post. It's true, if you're absolutely worried about hiding your data from the FBI, CIA, and NSA, you are either doing something so illegal that I don't want to help, or you are delusional and paranoid. However, reading between the lines, I think you've just seen too much FUD about security. If you really just want security that's "good enough" then you can get it by following some of the simple best practices. Here's some things that have been found to help in most environments:
1) Passwords are pretty good. Use a different password (fairly long, somewhat complex) on each different site and use a password manager (put that on a non-networked system if you're concerned), instead of trying to memorize dozens of different passwords.
2) Separate important and unimportant systems - if you have an online banking account, don't access it from the same machine you surf the web for "warez" on.
3) Use virtualization technology to "sandbox" dangerous activities. If you're researching viruses or malware, or browsing unusual web sites, do that in a virtual machine with snapshots. Destroy the virtual machine or restore to a "known good" configuration frequently.
4) Turn on firewalls, run anti-virus, and use registry/configuration cleaners frequently. If you're blocking any inbound connections to your network, you're safer. If all files you download are scanned, you're safer. If you regularly scan for known exploits and malware, and remove infections or destroy the system, you're safer.
5) Use encryption for sensitive information. Full disk encryption on your traveling laptop would be a great start. Use disk or file based encryption on sensitive documents, and ALWAYS use SSL when transmitting over open networks (that means ssh instead of telnet, FTPS instead of FTP, etc.). Encrypt backups as well as primary data.
6) Keep your systems reasonably up to date and follow recommendations from your software vendors about best security practices.
I'm sure there's a thousand other tips that would help, but you're not paying me, so this is where I'll stop.
Um...clever hack, but should you really be bragging about bypassing a DoD security procedure on a public site with a registered login? If you were a civilian contractor, I would guess that sort of thing would probably be a Federal offense. Don't they come down ever harder on people caught doing that in the service? IANAL (civil or military), but I think that you should probably stop talking about this, like forever.
HA! I just wasted some of your bandwidth with a frivolous sig!
There's not enough information in the OP's question. Is this a home or business environment? What do you want to protect? What do you perceive as the most likely threats? As to your questions about snoopy corporations and government agencies, do you have a particularized reason to be paranoid about such things, or are you merely a concerned citizen? I would start with NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems. You could also watch "Privacy Is Dead, Get Over It."
Syn attacks might cause a buffer overflow and a root, but it's unlikely. It depends on the genre of the TCP stack, what service is being slaughtered in the stack, What it does do is chew up resources.
A Syn attack is just as much of a security issue as not parsing get/posts and blowing up an httpd. The job is to take someone offline or crash them intentionally, or root them, or make them cough data (that might be resold). Any DoS attack is a security problem because an asset is removed from production.
Syn attacks are indeed about security, just vastly less likely to make data vulnerable. There are theories about using other kinds of attacks to take down BIND or the DNS Services of Windows Servers, but that's a more onerous kind of attack.
---- Teach Peace. It's Cheaper Than War.
"No, the notion of "secure" computing is ridiculous"
Security is a spectrum from "totally promiscuous and do anything to this machine" to "no, you can't even turn it on, and if you do, it will cost you your life" kind of horror-show.
Sane people, when they talk about secure computing, talk about something in the middle. The insane say it's an all or nothing false dichotomy. These are the same people who implement stupid password policies as administrators that ultimately result in the recycling of insecure passwords,for example.
>me being belligerant
Only because I've been around the block a few times and spot nonsense easily. Like this "not being able to trust the firmware" stuff.
If it comes to the point where you can't trust the firmware, then you have either become clinically paranoid, or you have angered the wrong people. In either case, you are royally screwed and have much larger problems than simply being able to visit your bank's website securely.
--
BMO
I can see that a 70kg TV would make an excellent home defense system. Just suspend it above the door and rig it to fall on anyone who opens the door without disarming the trap first.
Clearly you are no master of fuzzy logic! In this case "I lie about everything" means "everything but lying about everything".
See, it's simple!
Galileo: "The Earth revolves around the Sun!"
Score: -1 100% Flamebait
I can hardly believe that, so far, nobody mentioned Qubes OS.
In the theoretical sense, security is possible. It's just very hard. Especially if you want to spend your time doing something other than building a secure computer system.
In practice, most people live with a reasonably amount of security by installing a reasonable alternate OS such as Debian, not installing unnecessary software such as the Java plugin, and regularly installing security updates.
But if you really want security, what you should be doing is isolating, isolating, isolating. If a program has no business using a resource, then it should not be possible for it to access that resource. Qubes is one attempt to do this while preserving application compatibility, by having applications and services isolated to their own virtual machines. Even the network card drivers are in separate virtual machines.
For maximum security with Qubes, you really need a processor with support for VT-d, such as a selected subset of Nehalem and better processors, but the AppVM security mechanism at least should work.
Have a nice time.
Resiliency is about staying up when you want it up. Security is about securing information from leaks or equipment from intrusion that would increase the likelihood of future breaches. There is a natural tug o' war between security and usability, and preventing syn attacks (presuming there is no resulting overflow or process crash allowing for breaches) is about usability, and unrelated to data loss.
I don't consider uptime a security issue. I understand that's not a popular opinion, but lumping usability and security together confuses people as to what good security is, so I separate them out at all times.
Learn to love Alaska
Which I believe your central fallacy is about. Systems produce work that serves a purpose, most often: making money.
When a system is unavailable, it's not doing work, probably not making money. Data also has an asset value, we'll both agree. Data theft is but one security problem, albeit a large one. Pushing systems offline or tying them up in DoS attacks of any kind, is also production loss.
There are many ways to foist an attack, and a few ways to get around them, depending on the nature of the attack. But security covers all that I've mentioned, and usability is an element of return on investment-- along with the cost of data acquisition and its intrinsic value both stored and lost (which are two different valuations).
Good security methods consider the productivity of the system as its ongoing ROI, and the asset value of the data in the same way that a profit/loss statement is different than a balance sheet. Both are differing views of the investment and its return, and the value of its assets. Security covers all of this, this is not confusing. Attempting to abstract leaks from intrusions are security disambiguations, as resiliency is a characteristic of the production, not the asset value of data processing.
---- Teach Peace. It's Cheaper Than War.
Insightful
Read it over. Understand it:
http://cm.bell-labs.com/who/ken/trust.html
You must decide what you trust unless you wrote it all yourself and built it yourself. You must also acknowledge that the system is insecure and work backwards from that trying to mitigate any damage and minimize risks.
I make sure I have a nice room with a more or less constant temperature and humidity, a sturdy table to set the computer on (I have an iMac) and a good chair to sit on. I always close the windows and lock the doors when I go out of the house. That's all I can do to make my computing environment secure.
-- Cheers!
Good security methods consider the productivity of the system as its ongoing ROI, and the asset value of the data in the same way that a profit/loss statement is different than a balance sheet. Both are differing views of the investment and its return, and the value of its assets. Security covers all of this, this is not confusing. Attempting to abstract leaks from intrusions are security disambiguations, as resiliency is a characteristic of the production, not the asset value of data processing.
Resiliancy is there to allow gains, security is there to prevent loss. That they look the same from the abstract level, and often have overlapping detail (a SQL injection attack would be able to do either or both, as would a rooting). But in practice, they are handled differently, from what I've seen. Some places put nines ahead of security (except where security overlaps availability), to the point it gets stupid. It would be trivial to throw a brick through a window and walk off with a server, but millions gets spent on power and cooling. As business generally separates out the two, even when they significantly overlap, I have tended to as well, and I find it works much better at budget time to be able to identify which of the groups some line item would fall under.
Learn to love Alaska
And really, was it a hack? I was authorized to use the system, I only replicated the original function and intention of the server's web pages. Only a complete dolt like a news reporter would call that a hack.
Only a complete dolt programmer would not know what the word 'hack' has multiple meanings. I suggest you look up all the definitions of the word before you go insulting people who are complimenting you. Way to parade your lack of knowledge, idiot...
hack 1 (hk) v. hacked, hacking, hacks v.intr. 1. To chop or cut something by hacking. 2. Informal a. To write or refine computer programs skillfully.
Also, those orders you have? Probably not the get out of jail free card that you think they are. I am pretty sure that if you knowingly break the law when ordered to do so, you are still guilty in the eyes of military justice.
HA! I just wasted some of your bandwidth with a frivolous sig!
Science & open-source build trust from peer review. Learn systems you can trust.
Then how do you prefer to communicate with a financial institution in another state?
There is no way you can avoid putting trust on something outside your own control, be it the C compiler
David A. Wheeler confirms it: the "trusting trust" attack is dead.
So what you really are asking is "where should I put my trust level". That depends extremely from person to person and is next to impossible to answer
Where should the median citizen of an industrialized country be expected to put his trust level?
...And if you don't replace it with any other OS...
Or, write your application in such a way that it doesn't require any operating system at all. Write and include your own device and I/O drivers, include them in the app. Boot up directly to the application. An OS isn't necessary to run a lump of code. Yes you'll be duplicating a lot of work and at great expense, but if you had a need to secure your system that tightly, you could conceivably justify omitting such frippery as a "start" button, a browser, or a file directory UI. And if security needs to be that tight, you can afford a dedicated computer to run it. Besides, you generally don't want to run anything else on a machine that is nailed to the floor with regard to security.
Do not mock my vision of impractical footwear
Or you could tape over the status led...
Wow! After reading all the commenting posts, which most of the information is way over my head, because I am just the average computer user, my situation not just seems bleak to get anything done about it, but it IS bleak and likely impossible. :(((
I have a serious problem with a person with a masters in computer science who is stalking me, invading my privacy, and has been doing so for nearing 6 years now. Not only has this person invaded my computerS, but is also accessing my "landline" phone! It's apparent and obvious that the person has some sort of perverse obsession with me. Ex: He sent an email to a close "male" friend of mine that was totally degrading, insulting, and slanderous against me and then very soon afterward, my male friend's email account was "mysteriously" deleted. Ex: If a male person online gets too friendly with me, things will happen, like getting told that I've blocked them, when I did not. Ex: When "male" friends on Facebook placed gifts on my Facebook wall, they disappeared; sometimes even the male friends! Meanwhile, gifts from female friends were left alone.
He has threatened me a number of times with, basically, if I didn't shut my mouth about what I know, he would have me thrown off the Internet, that he would permanently slander my name all across the Internet, which he is now doing and has been for quite some time.
I've filed reports with the FBI (IC3 - Cyber Crime Unit of the FBI) and with my state police. But because he lives in a foreign country, apparently doing anything about it would be more involved than anyone wants to take on.
I've worked with several techs from: Dell Tech Service, iYogi Tech Service, Kaspersky, AOL Techs, Verizon/Verizon Wireless Techs, to name a few, and I've been told by all that I have a SERIOUS problem.
I do not understand "how" he is getting into my computers and my phone, but I KNOW he is. Since I haven't been able to get any help with this, I've learned to be my own investigator and so, I've saved and documented MEGA amounts of data that points continuously to ONE very common, "common denominator", who IS this "person of interest".
I've started to put some of this data out there, but because I'm so discouraged I don't avidly work at it. In regards to my phone, however, here's a tip of the iceberg: http://truth-time.elftown.org/
"A person's true worth is by what is in their heart." ~ Artsie_ladie ©
I've had some luck using Knoppix for this purpose -- they have a nice CD-booting distro. But then it occurs to me that I don't know if I can really trust Knoppix.
Also, nobody seems to be able to tell me where I can get a trustworthy USB stick. I think this is where I am most unreasonably paranoid. I've heard so many stories about USB sticks being the source of viral infections. Is there some methodical, easy way to inspect the damn things for exploits?
I like this idea, but the cost sounds a little prohibitive.
I'm also wondering how we know a given MOBO is safe -- or a given linux distro. I realize this is paranoid and a really broad question soliciting bazillions of possible responses, but would like to hear people's approach to verifying the security of hardware, firmware, and OS.
And, btw, what browser would you expect to use on this banking computer? I wouldn't recommend Chrome.
But where do you get the trustworthy USB stick?
Sane people, when they talk about secure computing, talk about something in the middle. The insane say it's an all or nothing false dichotomy. These are the same people who implement stupid password policies as administrators that ultimately result in the recycling of insecure passwords,for example.
It's like they say about a crowd getting chased by a bear: you don't have to be the fastest runner, you just have to be faster than the slowest guy. Security definitely admits of degrees and all of this all-or-nothing discussion is all well and good if we are talking theoreticals, but the binary mentality is not particularly useful on a day-to-day basis for ordinary developers.
That said, I think the firmware question has been overlooked a bit -- certainly as it relates to USB sticks. This seems like such a common (and obvious) exploit vector. Building USB sticks costs almost nothing and there seem to be so many cases where exploits have been propagated this way.
You *make* one, using known good disk images from an uninfected computer.
dd if=~/disk.images/knoppix.iso (or whatever you want) of=/dev/sdc1 (or wherever your usb thumbdrive is)
[return]
No, I don't use unetbootin. It seems that simply using dd to fling an iso at a thumbdrive is sufficient.
Done.
--
BMO
> Building USB sticks costs almost nothing and there seem to be so many cases where exploits have been propagated this way.
USB sticks have been vectors because people loaded them up with rootkits and threw them in the parking lot or left them at desks/reception areas, etc. It's not the firmware in the disk itself, which is just generic. It's the contents.
I know you're hinting at poisoned firmware, but that means a manufacturer has to poison an entire product line to make sure that some secret embedded firmware (like emedding stuxnet in the hardware instead as a bit of software) gets out to where it needs to go, and at this point, it's company suicide if this gets discovered.
It's unfeasible and involves too many people to be reliable as a way to infect machines to be kept secret.
"Three people can keep a secret if two of them are dead" - Franklin. And it still holds today.
--
BMO
Unless I'm mistaken, the USB stick itself might present an exploit before you've written any data to it. I.E., it is not unheard of for USB memory sticks to arrive from the manufacturer already containing an exploit. There's another post somewhere in this thread about it. I seem to recall this happening frequently. E.g.,: https://isc.sans.edu/diary.html?storyid=4247
20 years ago I had a computer built by a company here in RI and it came pre-infected because they were using a drive cloner that cloned an infected drive (and they were reputable, too! - CR Bard got all their machines built by them). I always nuke drives when I get them. Always. It's just good practice.
If you have autorun turned off (as you should) , and you blast dd at the disk and zero it out or write an image to it, whatever was there is gone. "Because dd bears no doubt, cares not if you have prepared your way, and leaves crushed Zagnut nodules in the carpet. " - to paraphrase Blair (he was really talking about kill -9, but I love the quote so).
It's not magic.
--
BMO
Don't tell complete strangers what arrangements you make to keep yourself secure. The more they know, the closer they are to getting past your defenses.