Microsoft Delivers Secure China-Only Cut of Windows 10 (theregister.co.uk)

Earlier this week, CEO of Microsoft Greater China, Alain Crozier, told China Daily that the company is ready to roll out a version of Windows 10 with extra security features demanded by China's government. "We have already developed the first version of the Windows 10 government secure system. It has been tested by three large enterprise customers," Crozier said. The Register reports: China used Edward Snowden's revelations to question whether western technology products could compromise its security. Policy responses included source code reviews for foreign vendors and requiring Chinese buyers to shop from an approved list of products. Microsoft, IBM and Intel all refused to submit source code for inspection, but Redmond and Big Blue have found other ways to get their code into China. IBM's route is a partnership with Dalian Wanda to bring its cloud behind the Great Firewall. Microsoft last year revealed its intention to build a version of Windows 10 for Chinese government users in partnership with state-owned company China Electronics Technology Group Corp. There's no reason to believe Crozier's remarks are incorrect, because Microsoft has a massive incentive to deliver a version of Windows 10 that China's government will accept. To understand why, consider that China's military has over two million active service personnel, the nation's railways employ similar numbers and Microsoft's partner China Electronics Technology Group Corp has more than 140,000 people on its books. Not all of those are going to need Windows, but plenty will.

Comments

Re:No need for Microsoft to spy on the Chinese

[Anonymous Coward]

You are correct. China does have an Islamic terrorism problem like most of the rest of the world. I was not far from this incident when it happened:

https://en.wikipedia.org/wiki/1997_Ürümqi_bus_boambings

Nine people were killed and 74 more injured.

Secure by name

[manu0601]

They call it secure, but provide no information about security features. From TFA:

The Register has asked Microsoft to explain the security features of Windows Red, but had not received a reply at the time of writing. You know the drill: we'll update this story if Microsoft sends any information.

Re:Secure by name

[Fire_Wraith]

China does have source code review rights, and are probably pretty concerned about anything that phones home to the USA.

What I'll find really ironic, though, is if they just end up with the China version of Windows 10 stripping out all the privacy invasion and ad related crap. If that's the case, I might just have to see if I can get my hands on a Chinese copy of Win 10 instead.

Re:Secure by name

[_merlin]

Role-based administration and privilege separation. Linux still sucks in this area. With windows you get a security token that gives you permission to do just what you need, on Linux you need to suid yourself to root to do just about anything, which allows you to do absolutely everything. The massive whitelist that is selinux is a backwards way of implementing security.

Re:Secure by name

[_merlin]

I know what sudo does. I know about filesystem capabilities. I know about NFSv4 ACLs.

But look at e.g. passwd - it needs to be suid so it can update your password hash. It doesn't just get a token that gives it permission to update your password hash, it gets permission to do whatever the fuck it wants on your system. Then you have a whitelist of what it's supposed to be able to do in SELinux that should hopefully stop it from doing anything besides updating a password hash, but there's nothing to stop it updating the password hash for a user other than the one who ran it, or blowing away the password hashes entirely or something. Without SELinux, a bug in passwd has the potential to totally pwn your system, and with SELinux it a bug could still wreak havoc with the password hash database.

By comparison, on Windows when you want to change your password, the program can get a security token that just gives it permission to change your password. It doesn't need to escalate all the way to root privileges, you don't need a separately maintained whitelist for what this program can do. A bug in a password change utility on Windows can at worst change your password to something stupid.

That's not to say that Windows is perfect, or that applications will always only request the rights they need (plenty of "enterprise" tools grab all the rights they can all the time because it's easier for developers), but fundamentally security tokens are a better model than the *NIX approach of suid and hope it doesn't have an exploitable bug.

How about the rest of us?

[wvmarle]

So let's take MS's claims of a more secure Windows at face value.

This means two things. First of all, the Windows they released to the market is unnecessarily insecure, and MS knows that.

Secondly, why would they only offer this enhanced security to the Chinese, and not to the rest of the world?

All software ought to be as secure as possible. If there are security enhancements available, a vendor ought to roll them out to all their users. Here MS is failing in both: Windows can be (much) more secure than it is, and they're not releasing this improvement to the rest of their users.

That, or MS is lying through their teeth to get into China. That may be possible, but while you can say a lot of bad things about the Chinese government, their people by and large are definitely not stupid so there has to be at least some weight to the claims of MS.

*facepalm*

[Gravis Zero]

You know, if anyone was going to ditch Windows because of secret backdoors, I figured it would have been the Chinese government. Besides, isn't Linux the ideal model for communism? I know they are communists in name only but you would figure they would at least try to keep up the appearance of objecting to capitalism.