Sign in / up

back to article Germany warns: You just CAN'T TRUST some Windows 8 PCs

Microsoft's new touchy Windows 8 operating system is so vulnerable to prying hackers that Germany's businesses and government should not use it, the country's authorities have warned in a series of leaked documents. According to files published in German weekly Die Zeit, the Euro nation's officials fear Germans' data is not …

COMMENTS

House rules Send corrections
This topic is closed for new posts.

Page:

    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Wait for the leak

      "If anyone is naive enough to think that the software vendors are /not/ in bed with the spooks has a deranged attitude far from reality"

      Yes. And NSA is an organization which doesn't exacttly _ask_ if the vendor is willing to do what they say: It asks for a FISA court order in ten minutes and then vendor does what is told or goes to jail.

      Of course, "You are not allowed to say anything" is slapped on top of everything as standard part of NSA/FISA orders. At company level and at personal level: No holes for leaks there.

      So when Microsoft claims that "No backdoor", not only they are lying, _they know_ they are lying: Of course there is, because NSA and we've already seen how that organization operates: It doesn't care at all what they legally may do.

      Microsoft openly admits that they are "collaborating" with NSA and _yet_ claim there is no backdoor? How absurd is that?

      5 0
    2. Charles Manning
      Reply Icon

      It has always been so, why should it change?

      In times past, commercial operators have always been part of the government spy system.

      This is most obvious in the way organisations like the Dutch East Inda Company etc operated. As part of the deals they got to explore and trade, they would be required to report back to the intelligence agencies of the time.

      Exactly the same happened during more modern times with large companies that had offices in foreign lands. They were all riddled with both commercial and governmental spooks. These helped before/during WW1, WW2, cold war,...

      So to think that the spooks are not deeply embedded in the large corporations of today, particularly those providing software, software-based services and communications, would be absurd. Human nature does not change that fast and intelligence organisations would not walk away from such resources - even if commanded to by the govt.

      Pretty much all info worth gathering is in computers. As with drones, there is no need to expose humans to threat. Just bury spying deep in the computer and you can remotely access just about anything from anywhere.

      1 0
  2. Tom 7

    "forcing Redmond to deny there was a backdoor"

    Judging from Lavabit Redmond would be legally obliged to say that come what may.

    31 0
    1. Pascal Monett Silver badge
      Reply Icon

      Yeah, but judging from Microsoft's past history in the DoD affair (and multiple others), they'd say that anyway.

      Now they're just saying that whilst thinking to themselves "and we really can't say anything else this time !".

      5 0
  3. Vociferous

    You'd think Europe would be used to be taken up the backdoor by the US by now.

    > " BSI released a statement that backtracked slightly, insisting that using Windows 8 in combination with a TPM may make a system safer, but noting that it is investigating "some critical aspects""

    Translation: the in-built crypto makes it harder for random russian mobsters to hack you, but easier for NSA, so it's fine for the plebs but corporations and government should avoid it.

    I am finding it hard to express how total my lack of surprise is at this news.

    29 1
  4. Anonymous Coward
    Anonymous Coward

    'How deep down the rabbit hole do you want to go?'

    7 0
    1. Destroy All Monsters Silver badge
      Reply Icon
      Big Brother

      As long as lube is involved and there are state-sponsored donuts at the end, we can go pretty far with nary a peep, just a stream of "denials" and "excuses" followed by "calls for investigation", then more "excuses" and "denials".

      7 1
  5. stizzleswick

    "privacy without good security".

    So to ensure privacy, MS suggests to completely remove privacy without raising the grade of securiy in any noticeable manner?

    The problem with that is that MS and the partners in the TCP group are not laying open the way the TPM works, so it is impossible for most people to check what all they can do to me. How about an Opensource alternative? I might go for that after sufficient peer review...

    8 0
  6. Andy The Hat Silver badge

    If it can be remotely updated by Micro$oft, who's to say it cannot be utilised by 'interested third parties' to simply prevent machines booting (in time of war by HM Gov or for the purpose of extortion by whoever and whenever ...)?

    Control of the OS by the OS that you have opted to install is one thing, control of the entire system via firmware by a few companies who's only connection to your machine is a few lines of code in one chip is another.

    21 2
  7. david 12 Silver badge

    http://cryptome.org/stoa-r3-5.htm

    According to this 1999 STOA report "The relevant committees of the European Parliament, should be asked to consider legal measures to prevent [Processor Serial Number]-equipped (or PSN-equivalent) chips from being installed in the computers of European citizens, firms and organisations."

    That had a chilling effect on the provision of computers with hardware ID. If you remember back then, the two main reasons for Hardware ID were (a) to prevent theft / inventory control, and (b) for e-commerce requirements (hardware signatures).

    Evidently the effect was not permanent, because ID-equiped processors are starting to appear: they are targeted at the smart meter market, where they are used (a) to prevent theft, and (b) for billing requirements

    This is the first time that I've seen the EU start to kick back against unique ID's The first time around, the objection was targeted at MS and Intel. This time around, their objection seems to be targeted at MS and Intel. I await further developments with interest.

    14 0
    1. Michael Habel
      Reply Icon
      Thumb Up

      Re: http://cryptome.org/stoa-r3-5.htm

      I remember it well 'twas AMD High water mark it was. When 3DNow! was all the rage! and my first foray into AMD-dom was with the short lived Slot-A 500Mhz K7 CPU running Win98SE. A damn fine Machine it was too!

      3 0
      1. Michael Habel
        Reply Icon

        Re: http://cryptome.org/stoa-r3-5.htm

        And no CPU-ID / Serial Number too... Didn't care for what it did then, and I reckon that I still don't...

        3 0
  8. Proud Father

    Whose system?

    ""simply no way to tell what exactly Microsoft does to its system through remote updates".

    "...does to its systems..."

    "...its..."

    No not Microsoft's, it's mine.

    I bought it, I own it, it's mine.

    20 1
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Whose system?

      Not anymore! Didn't you know that?

      Richard Stallman almost lost his voice barking this to all four cardinal points while we all of us had a good laugh at it.

      Live and learn, folks!

      20 1
      1. pepper
        Reply Icon

        Re: Whose system?

        Truth is, he has been right more then anyone likes. He might seems a bit extreme at first, but he has been right many times in the past few years, worryingly enough.

        5 0
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Whose system?

      "I bought it, I own it, it's mine".

      Except for the software, of course.

      1 1
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Whose system?

        >"I bought it, I own it, it's mine".

        >Except for the software, of course.

        Da. In Ameᴙica the software owns you.

        0 0
  9. Anonymous Coward
    Anonymous Coward

    The comment of there being no back doors for spooks sounds ominously familiar to we don't allow spooks into your data. Technically, that's correct. Microsoft employees gather the data and then hand it over to the gov.

    Questions that should be asked.

    - Does my PC's file index and the things I search for on my HD get sent back to the mothership?

    - Just how secure is Bitlocker?

    In the end, it does not matter. Win 7 is my last MS OS regardless. We are also going open source at the office.

    20 1
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      - Does my PC's file index and the things I search for on my HD get sent back to the mothership?

      Answer: "No, of course not", leaving out: - "That is what the Anti Virus Software really does"! -

      Or rather, it doesn't: It really search for hashes of files and returns "yes" or "no" - or " degrees of similarity", probably allows remote queries on "the kind of stuff" there is on a given computer. It gives a template of files that are on all computers, so one can find "interesting" computers (outliers) and maybe monitor the spread of ideas (same hash codes/similar documents propagating),

      0 0
  10. Test Man

    "Rumours about a backdoor in Windows are almost as old as Microsoft itself. In 2009, El Reg reported on the NSA's admission that it had worked with developers on Windows 7's operating system security, forcing Redmond to deny there was a backdoor left open to spooks."

    There was something in Windows 95 though?

    2 1
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Can't remember anything about backdoors in any of the windows-on-dos series and, frankly, why would they have bothered when those OSs scarcely even pretended to offer any semblance of security at all?

      Perhaps you're thinking of the NSA_KEY implanted in every 32bit Windows; from early in the conception of NT. Scott Culp of the "Microsoft Security Response Center" explained the existence of the NSA_KEY thus:

      "In 1992-93, Windows NT program management identified a need for a cryptographic API set that would allow third-party cryptographic modules to be installed. Because of the obvious parallels to the "crypto with a hole" case, we went to State Department, who confirmed that they would not grant export approval for our design unless it controlled which third-party cryptographic modules could be installed."

      http://cryptome.org/nsakey-ms-dc.htm

      1 0
  11. Salts

    Which PC's don't have TPM

    As I am looking at a new laptop and will be installing Linux, windows may get a VM but that's about it, does any one know which PC's don't have this chip and how do you find out? I have been looking at Lenovo.

    Also wonder if this is why huawei are being black listed in US, so that all kit installed is US built with back doors etc for NSA?

    14 2
    1. Suricou Raven
      Reply Icon

      Re: Which PC's don't have TPM

      The TPM itsself can't do very much without cooperation from the OS - all it can do is make sure BIOS updates are signed and enforce Secure Boot - a feature which, for now, Microsoft still generously permits you to disable. So if you run linux, it won't bother you. On the upside, the TPM does include a cryptographic accelerator and RNG (True R, not PR) - so if you get the linux drivers working, it could be used to give an SSL webserver or something a performance boost.

      5 0
      1. Havin_it
        Reply Icon
        Linux

        Re: Which PC's don't have TPM

        Now there's a thought ... I have a server that I think has a TPM, and an embedded cpu with no AES-NI/AVX extensions, that could definitely benefit from access to such hardware. However, I wonder

        A) Can Linux drivers actually harness the crypto components in useful ways?

        B) Do all TPM chips have these components, or just 2.0 versions?

        ...Oh, and of course ...

        C) Can we even trust them to do out-of-spec crypto tasks such as this, without backdoors or other compromise?

        0 0
        1. El Andy
          Reply Icon

          Re: Which PC's don't have TPM

          @Havin_it "Do all TPM chips have these components, or just 2.0 versions?"

          A TPM without encryption capabilities would be pointless, given that's the only thing they *actually* do, as opposed to what the tin-foil hat brigade would like you to believe....

          0 3
          1. Tuomas Hosia
            Reply Icon

            Re: Which PC's don't have TPM

            "given that's the only thing they *actually* do"

            So you have a whole TPM chip and you _know_ what it *actually* does, despite half of the functions being officially not documented and who knows how many functions totally secret, the NSA segment?

            Nice idea, borders to being gullible.

            5 0
            1. Anonymous Coward
              Reply Icon
              Anonymous Coward

              Re: Which PC's don't have TPM

              >Nice idea, borders to being gullible.

              I wonder how much longer the I-believe-what-I'm-told-to-believe brigade are going to go on calling people with a bit of common sense "the tinfoil hat brigade"?

              That whole "people who think the government are spying on us must be nutters" meme must been reversed somewhat of late. Shirley anyone who still hasn't realised it must be the nutter?

              5 0
              1. El Andy
                Reply Icon

                Re: Which PC's don't have TPM

                @AC12:10 "That whole "people who think the government are spying on us must be nutters" meme must been reversed somewhat of late. Shirley anyone who still hasn't realised it must be the nutter?"

                Do government spies spy? Er, yes, of course. Do you think they care about the minutia of every thing you do in your life? Really? Can you even begin to conceive how many people it would actually require to spy on every single moment of even a single individual's life and all their interactions? Do you think that it is even remotely plausible that even one person is dedicating their existence to monitoring yours?

                If you do, then yes you belong firmly in the tin-foil-hat brigade. If, on the other hand, you look at espionage as an occasionally necessary evil and consider the practical limitations on the reality of what is ever going to be possible, then you should really see why there isn't actually much to be worried about.

                0 4
            2. El Andy
              Reply Icon
              Facepalm

              Re: Which PC's don't have TPM

              @Tuomas Hosia: "So you have a whole TPM chip and you _know_ what it *actually* does, despite half of the functions being officially not documented and who knows how many functions totally secret, the NSA segment?"

              TPM is an ISO spec. Every part of TPM is documented, because it'd be a pointless spec if it weren't.

              If you want to believe the NSA are putting "secret" extra bits inside the PC that let them spy on you, that's up to you, but there would be no need for that to be a part of TPM, nor for it to be removed/disabled in machines without a TPM or with TPM disabled. It wouldn't even have to stop functioning when you ran Linux. Heck, it's probably buried deep within every x86 and ARM CPU ever manufactured and deliberately sending details of everything you ever do to a bunch of people who have nothing better to do in life than check exactly what you're doing every single minute of the day,

              Have a nice afternoon thinking that through....

              0 4
          2. Havin_it
            Reply Icon

            Re: Which PC's don't have TPM

            Sorry, not well-phrased perhaps. My focus was on the "what can it do for me" angle, not ... well, everything that followed.

            What I was asking was, I suppose, can one of these things handle constant (think disk encryption) crypto workloads, and do so better than the CPU, on Linux? Or is it only built for verifying a key once in a blue moon? And is there a generational difference in what bits Linux can actually use?

            But I'm glad everyone had fun with their little digression session... FFS

            0 0
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Which PC's don't have TPM

        >The TPM itsself can't do very much without cooperation from the OS - all it can do is make sure BIOS updates are signed and enforce Secure Boot - a feature which, for now, Microsoft still generously permits you to disable.

        Hence the "need" for a high availability remote code execution mechanism. Or AMT for short. What a combination: A "perfect storm" of "trust".

        2 0
      3. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Which PC's don't have TPM

        "The TPM itsself can't do very much without cooperation from the OS - all it can do is make sure BIOS updates are signed and enforce Secure Boot - a feature which, for now, Microsoft still generously permits you to disable. So if you run linux, it won't bother you."

        NOT if you're gullible enough to to own ARM hardware blessed by the beast of Redmond. No generous permission to disable the M$ lock-in on that. If M$ has "certified" your ARM kit it's Win or bin.

        1 0
  12. Michael Habel

    All the more reason (as if I needed any...) that I should keep my aging C2D Systems up and running for as along as I can. Neither of which have any of this TPM BS on it that I would know of.

    As for US Companies I suppose Ubuntu is a South African Outfit. But what about Mint?

    Whats the BEST non-US backed Linux?

    And on that token why hasn't anyone ever brought up SELinux yet?

    I mean who do you think donated most of the Code for that?

    Why haven't we been hearing more about this??

    2 0
    1. Vociferous
      Reply Icon

      Any Linux you can inspect the source code of is pretty much guaranteed to not contain back doors. It can still contain vulnerabilities of course, but not back doors, there's simply too many people vetting it.

      7 1
      1. Michael Habel
        Reply Icon

        Which then begs One of Two further Questions...

        1) Can we trust these "People" who are "veting the Code"? (i.e. Who's watching the Watchmen?)

        2) Are these "People" actually skilled enough to actually find well intentioned (I'm sure...), but very cleverly hidden Code?

        Bonus Question who here would continue to use SE(NSA)Linux?

        2 4
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        "Any Linux you can inspect the source code of is pretty much guaranteed to not contain back doors. It can still contain vulnerabilities of course, but not back doors, there's simply too many people vetting it."

        A million eyes looking at something are only useful if they are looking in the direction of the problem. How many people actually download the code and then confirm that the binaries they've downloaded are the resultant binaries from that code? I don't know a single person or company who does, with the exception of one security specialist who admits that "it's a time consuming ball ache". Did you know that the KDE project recently lost everything because they were using a replicating git hub as backup for their codebase. The only reason they didn't lose everything when a corruption was replicated was because they'd by complete chance removed a node the previous day.

        3 1
        1. Destroy All Monsters Silver badge
          Reply Icon
          Paris Hilton

          > Did you know that the KDE project recently lost everything

          What. They have less sysop nous than a fly-by-night outfit that sells packages of Bami Goreng on the side?

          1 1
          1. Destroy All Monsters Silver badge
            Reply Icon
            Childcatcher

            Holy shit it actually happened http://jefferai.org/2013/03/29/distillation/

            0 0
      3. Anonymous Coward
        Reply Icon
        Anonymous Coward

        "Any Linux you can inspect the source code of is pretty much guaranteed to not contain back doors. It can still contain vulnerabilities of course, but not back doors, there's simply too many people vetting it."

        That turns out not to be the case. See http://cm.bell-labs.com/who/ken/trust.html

        Ken Thompson's point is clearly summarized at the end of that short paper:

        "You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect".

        3 1
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Do tell

          Whoever downvoted my comment with the Ken Thompson quote, it would be nice if you would take the time to reply and let us know whether you:

          1. Disagree with Thompson's assertions;

          2. Believe that Thompson's assertions, as quoted, are irrelevant or misleading;

          3. Were just feeling bloody minded.

          1 1
          1. Anonymous Coward
            Reply Icon
            Anonymous Coward

            Re: Do tell

            OK then - bloody minded it is.

            1 1
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      OpenBSD, it's not Linux though

      1 0
    3. Anonymous Coward
      Reply Icon
      Anonymous Coward

      >Whats the BEST non-US backed Linux?

      Well, Linux (i.e. the kernel) is very much a distributed multinational effort but since its spiritual and de-facto leader has migrated right into the hart of the axis of evil, I'll presume you mean "distro" rather than the kernel and whole heartedly point you in the direction of OpenSUSE.

      Mandriva/Mageia and KNOPPIX spring immediately to mind too. Probably both more "enthusiast" than "best" but that's a pretty subjective distinction. Ubuntu is "based" (registered - for tax reasons, etc) on the Isle of Man but main offices are London. Not that I'd let that bother you - (F)OSS is effectively a game of whack-a-mole for big-gov and their mega-corp minions... try to piss about with it and it'll just slip through your fingers and pop up again (sans pissing about) in ten different places. Just ask MS, Oracle, SCO, etc... That's what those "virus/cancer" licences are all about.

      There are some significant government (national or regional) supported offerings from Spain, Greece, Germany, Turkey, Brazil, amongst others.

      distrowatch.com is an excellent reference of all things distro. You can search its (surprisingly well maintained considering) database by all manner of criteria, including "country of origin."

      Good hunting.

      2 0
    4. Anonymous Coward
      Reply Icon
      Anonymous Coward

      >And on that token why hasn't anyone ever brought up SELinux yet?

      Probably because:

      a) It's offered (publicly) to an open project which thoroughly and openly reviews it (as it does ALL contributions). Not secretly escrowbared into some take-it-or-leave-it immense binary blob by clandestine decree from upper ECHELONs.

      b) It's optional. Use AppArmour if you prefer. Or ACLs, or something offered by whichever filesystem you favour, or hypervisors, or whatever. There are myriad ways to crack the nut and the diversity of (F)OSS is it's greatest strength. Choose whatever best suits YOU... rather than the M$ "you'll do it this way" doctrine. Have a quick squint at Qubes for an example... a new, simple yet ingenious and rather exciting approach at addressing these sort of trust problems by means of rigorous abstraction.

      3 0
  13. Anomalous Cowshed

    You just can't trust them windows 8 computers...

    At a time when it has been shown that the American and British governments spy on their citizens, it's good to know you are a German citizen, for once. You can trust us implicitly.

    Now this windows 8 ain't no good. I don't want to go into the reasons, which are classified, but as a good citizen, you should seriously consider using Windows 98 or 3.1, our systems are optimised for them which are far more secure.

    Understood? You may go now!

    2 3
  14. Anonymous Coward
    Anonymous Coward

    I was told that the reason why MS still supports XP was because most regimes (which the NSA are interested in) are still heavily dependent on XP. MS was forced to support XP against their business model.

    3 1
    1. Mr. Peterson
      Reply Icon

      your Uncle is more informative than my Uncle

      1 0
  15. Destroy All Monsters Silver badge
    Big Brother

    Disquieting frankness on your webzine

    Microsoft denied there was any backdoor. In a lengthy statement, a spokeswoman insisted that users cannot expect "privacy without good security".

    Indeed. We want privacy with excellent security, not "no privacy" with just "good security".

    Mickey's soft: just say no to this package..

    8 2
  16. Robert Helpmann??
    Childcatcher

    What's in a Name?

    Microsoft's new touchy Windows 8 operating system is so vulnerable to prying hackers...

    There are few who understand the word "hacker" to mean "the programmers writing the software being hacked." The issue here is not that there is a suspected problem with the OS not working as advertised, it is with the design itself (and so is not a hack). It seems that it all comes down to trust which seems to be in short supply these days.

    0 0
  17. M Gale

    WHo actually thought TPM was about security?

    And not an attempt at making it awkward to run anything except Windows? Or at least to run anything without paying a Microsoft tax?

    11 0

Page:

This topic is closed for new posts.

Other stories you might like