Heres a fun one. Back in the late 90s, on my high school PCs they had installed "Foolproof Security System" this was a system that attempted to lock down windows (I believe Win98SE) and stop students from doing things. Problem was, it stopped teachers from working too. So bored in electronics class, we open the Fool.exe in notepad. There, in the middle of the code is the word "Backdoor"... no. couldnt be that easy. We type it as a password. no-go. Then I see the ! right after it.. So I try "Backdoor!" . It works. It not only works, but it works on every machine. Every. Machine. Fast forward 2 years and the school district is spending thousands reinstalling the "security system" due to a district-wide password being released. After the install? The exact same backdoor is still there. Its in every version of their software.
@@lwilton I bypassed my local public libraries incredibly weak "security login" simply by opening an open file dialog box in a web browser, navigating to System32, manually ran Task Manager, and killed its running "security login" exe process. They had the easy methods to open Task Manager and File Explorer blocked (no hotkey, or shortcuts) with some horrible login manager. I got caught after being on their computers for like 5 hours 3 days in a row, they had no idea how I did it, but I was banned for a week. Was like 12-13 years ago though. My wife works at the same library now lol.
I wouldn't be surprised if there were actual backdoors in Windows but I think it's more likely that there are backdoors in the Intel Management Engine or AMD PSP source code which is inside the CPU among other hardware backdoors such as microchips which were found to be inserted on server motherboards made by Supermicro a few years ago which led to Apple and Amazon cancelling contracts with SuperMicro to supply them with servers*. *according to Bloomberg Media, China Uncensored (America Uncovered LLC)
In windows 7 there was a method of opening a file dialog as admin while performing a crash diagnosis in recovery mode (idk what it was called). This allowed you to swap CMD with sticky keys and activate CMD as root on the login screen. What is this considered? Its not a backdoor, but it's definitely a security vulnerability.
It's a backdoor if you actually do it on someone else's machine. The ability to do it by itself is not a backdoor, first of all, because it was never intended. Maybe you could classify it as a vulnerability but imho it's not a serious risk since you'd need admin access on that machine in the first place to make that modification and if you had admin access you could just install some hidden remote access tool.
its probally a bug, for it to be considered a backdoor it needs a few things, first it need to be intentional, and second it msut be able to be done remote via internet without physical acess to the machine. that thing is a exploit in a local machine a vulnerability
What you're talking about are backdoors inserted by malicious actors behind the backs of architects or management. And like you said, it's very hard to add one and unlikely that any would slip through. But I think what most people are more worried about are backdoors which are intentional and generally known by the responsible developer teams, but not publicised otherwise - more like the NSAKey theory you mentioned. That kind of backdoor would actually pass through all the code review and audit processes, as for the insiders it would be an intended feature. So I'm waiting for the next part to see what you have to say on that topic.
indeed thats the ones that would be a far far greater risk as well since not only would they get pushed out with a stamped seal of approval by upper tards all too happy to screw over the public.. but the end result of such is beyond anmy doubt extremely nefarious.. and not just by the US alphabet agencies... The risk of such is MASSIVE exp for foreign bad actors like china.. and they are all pissy over the banning of Huawei 5g etc well beyond the avg.. which makes it look all the worse for china since even their gov dosnt worry as much about such things for a "private company" per se.
@@duckie4670 another possibilty is, if he would speak the thruth he would end up in the ecuadorian embassy because of sexual herasmment claim. And years later it reaveals as untenable (surprisingly unexpexted), but because he flew from the local authorities he will be jailed and high security prison and after that he will be handed out to the (fair) hands of the us legislativ. *Note: The brackets was irony
Nobody's worried about a rogue ms employee putting in a backdoor, the concern is a backdoor that Microsoft has added in secret, you gave no reason to think that hasn't happened.
Sorry for bad English. Chance that Windows has a builtin backdoor is very small because it's very risky and very complicated. Bugs are constantly fixed by a developers team. So rouge need to make a new backdoor every time his backdoor got caught. In case of Mircosoft (whole company not a rouge employee) intentionally wouldn't fix "three-letter-agencies-sponsored" security bugs - that's not real because it will damage company rep. then it will be known for a public. The same goes for manufacturing backdoor theory - damage for company rep. Anyway cybersecurity market doesn't work this way. There are 0day exploits for every system not just for Windows.
In my High School they installed a Alpha-Micro Mini-computer in the mid 80's. It was a cool new toy with capabilities well beyond the Commodore CBM machines that I had access to. This meant I had to learn everything I could about the system. I discovered within a few months that the source code for logging into the machine could be found by anyone with any access on the computer. I modified the code to allow me to login to any account without a password which gave me the keys to the kingdom. Code running outside of a logged in session required a special long string of characters in the assembly code source that the assembler recognized. While I never did anything malicious I certainly could have but it did teach me a lot about the reason that security by obscurity is so ineffective. In the many years since, I have worked at several companies including one where we created security monitoring software. This required writing some device drivers and patching Windows security DLLs. While the company had non-publicly available documentation and code from Microsoft to accomplish this there was absolutely no controls in place to who could access this information or make changes to code within the company. My job was creating installation processes for the companies products. This required me to understand how the applications worked at a lower level that most of the developers who maintained the software. No one reviewed my code and as long as it got the job done no one cared exactly how it worked. Because the company was small and they wanted to get a new product out very quickly they outsourced a new application to a Russian company. While the software produced worked well it was also a large mass of code and could easily have contained malicious code. Once again other that what I need to install the product no review of the code was done. Our customer installed these applications on their most trusted systems running under high privilege accounts without knowing that our code could easily have been compromised. While it did not create a back door it certainly could have been used to compromise a lot of very large companies. It is encouraging to hear the Microsoft took security much more serious than many companies I have worked for over the years, include a very large 3 letter company.
I thought I heard stories from this very channel about when Dave's company worked with a very large 3 letter company for OS/2, that their security was way more strict. At least in the physical sense.
if the large three-letter company is a large German enterprise software conglomerate in the general direction of Heidelberg, things have changed massively in the last ten years. A lot of effort has been put into formalising those processes and enforcing them so shit is being kept track of, audited and fixed.
Security by obscurity is very effective - until it's no longer obscure. What's not effective is single-layered security. Obscurity should only be one (very thin) layer of your security model. Your own example shows this - the systems you had at your school had the login source code available to everyone. That is more like open source software and isn't obscure at all provided you can interpret source code since it was available to everyone with any access level on the system. The problems you described in one of the companies you worked for are also interesting. I work at a much smaller and less widely known company, and we go through a fairly exhaustive security review before we even enter into contract negotiations with a third party vendor. Our governance, risk, and compliance team starts off with reviewing the potential vendor's security policies and procedures, their compliance with various applicable security frameworks, their audit results from those frameworks, and so forth, before our legal team even starts to review and negotiate contract terms. Then again, I also talk to various vendors who we consider working with, so I know that my situation isn't the norm and that I'm lucky to work at a company that has mature leadership that actually cares somewhat about quality, and that we have good team members on our security and GRC teams to provide those leaders with good information to make decisions with. But ultimately, security is hard, and it requires a great deal of attention, diligence, and effort to get it right. Companies as large as Microsoft typically have to do this because they have customers that are like my company, but ten times worse because they're government contractors or are governments themselves. Not every company has this, or understands that it's even necessary, yet.
Its not really a backdoor but i remember once i got my hands on some old decommisioned desktop running windows XP or 7 or something, when i turned it on it was password protected and i didnt know the password. At that time i was learning Linux a bit and what blew my mind was that when i booted the linux from usb i could see the files on the computer rendering the windows login screen almost completely pointless.
Dave tries to push 'code review' as the prevention against backdoors, but what about a scenario where legal says 'this code needs to be in there and no you can't ask questions or tell anyone'? In post patriot act USA that seems very possible.
@@eadweard. pretty sure the ones that say it can't happen are the crazies in this situation. Unless project PRISM doesn't exist, and carnivore didn't happen.
(a) they don't do that or the FBI could get into the iPhone's secure enclave, which you know they can't. (b) there's no world in which only one person would know, so it's still going to get code-reviewed!
Yes, you have code review but if NSA offers you cooperation or 25 years gulag then code reviews won't stop it and NDAs would prevent employees from talking about it.
Concerning the "opensource / pregnancy" comparison: Are you saying that a binary firmware blob for a GPU means the whole OS is no longer Open Source? You're using a qualifier, "fully,' so I assume that that's not your point. But with that qualifier I can say basically anything. Windows isn't fully secure, because it has an exploit. Windows isn't fully functional, because it has a bug. Windows isn't fully tested, because of a bug. Windows wasn't fully audited, the sky isn't fully blue (because of clouds), cats aren't fully furry because of the toes. Going the other way, .NET is open source. That means windows isn't fully closed source. Now that we've determined that both windows and linux are neither fully open source or fully closed source, we haven't actually determined anything because Linux is still open source unless you install something that isn't, Windows is still closed source unless you install something that isn't, and I still can't audit the windows file browser source code. Also: Out of the box the majority of Linux distros don't actually install any binary blobs without some kind of tool that installs them asking you if you want to. If you're running a proprietary GPU driver you know it, because you had to go to the "restricted software" or whatever the distro in question calls it and choose to install the proprietary driver. If you're concerned with Nvidia's closed source graphics driver, don't install it, the open source driver works fine for most purposes anyway. If you're saying that Linux and Windows both can't be audited because the user might install a proprietary GPU driver on Linux, than I can say Microsoft can't audit Windows because the user might install WeatherBug. Also, any and all security windows may have is invalidated by WeatherBug. If there's an argument that invalidates the WeatherBug argument, It'll also invalidate the binary blob arguement.
He is saying: If a driver contains a binary blob, you cannot read the contents of that blob, therefore that driver is not 100% open source. As the driver, let's say a GPU driver needs to be performant, it has low level access to the hardware. If it has low level access to the hardware, it can access whichever hardware component it wants - for instance read any physical memory address it wants or inspect whatever is typed on the keyboard. What Dave is saying: Just because Linux is mostly opened source, there are no guarantees that such drivers with either malicious blobs or just exploitable blobs do not exist. This undermines the argument that open source operating systems like Linus are reviewed for security issues by the general public (implying that Windows cannot be reviewed the same way, therefore it must be less secure).
@@todortodorov940 what the poster to whom you're replying to is pointing out: closed source/binary blob drivers aren't activated in Linux by default. Most distros require you to manually enable them.
@@Leo-sd3jt Are you saying that the most popular distros, i.e. the ones used by the majority of people, are 100% open source, they do not contain any blobs and do not contain a single line of executable code that is closed to the end user? I am sure that there is a hardened distro or one that is 100% open - but we are talking about what the majority of people are de-facto using.
The steps you cite protect against unauthorised backdoors, an authorised backdoor would go straight through because, it’s authorised. Think something like the fingerprint that Bill Gates put into the trig tables in Commodore BASIC, but that allows unauthenticated access to admin privileges.
@@eadweard. when the boss says jump you start moving upwards until told to stop. Darren has listed out some reasons that could be given, no doubt there are others. Beyond that, if you’re told to add something you do.
9:15 In most reputable open source projects, random submissions aren't committed, but instead the pull request is reviewed often by the bulk of a community of people. In the vast majority of cases it would be incredibly difficult to just sneak in malicious code. There are also a ton of ways to test code, especially in disposable dev environments.
Yes but often important projects are maintained and tested by very few people. Just look at the heartbleed buck. There was one person that reviewed the code written by a student. Now everybody acted in the best faith here and I don’t want to blame anybody. But this code then was shipped to basically the entire world and remained undetected for years. This is in part because OpenSSL in spite of being one of the most important software projects in the world was chronically underfunded and under maintained.
I disagree that I-heart-sex would be a backdoor. Based on the description, Regardless of whether it involves "security" per se, it provides no additional access to significant features or tools, bypassing documented user-facing commands. This would be an Easter Egg, providing secret trivial thrills to plebeian hackers. Personally, I love the idea of Easter Eggs and look down on stuck=up corporate weenies who ban them. There's no reason not to include a tiny bit of hidden fun in our work, especially software, and especially mass-marketed user-facing apps like a hugely popular operating system. If nothing else, it would give people some tiny reason not to hate your stuck-up, stuffy, evil, greedy corporation.
Most of the blue badge product support staff had read only access to a lot of the source - I had most of Windows, Visual Studio and Office source code up until 2009. Once, I was asked for the source code for Visual Basic 3.0 as somehow it had got lost and I had the only copy in the company.
@@MarkALong64 Ahh that's a shame, yes, whilst I adopted C# fairly quickly when .NET 2.0 was released (the first real usable version IMO), I still have a lot of old VB6 code that could benefit from a 64 bit recompile, I guess we can be thankful that Windows will still run a VB6 app for now! I haven't done anything new in it for years but I know companies that still use it for their latest business apps.
@@Wilksey37 VB6 had it's quirks and hiccups over the years and patches, but I still feel that it was the most intuitive, stable way to build a GUI Windows App. I've even used it as recent as about a year ago to make a program, LOL! I learned enough C# to build apps, but still find Visual Studio 6 much more streamlined for fast development.
@@aceenterprise Yes, it was a true pleasure to develop apps with VB6, there was a massive community behind it too, I used to spend about 12 hours a day coding with VB6 when I was young(er), I still have my copy of MS VS 6 Enterprise which I bought for £30 from a company clearance sale many years ago, pure luck that the person taking the cash didn't know what it was as it was just another box to him.
1:52 yes assuming that port is open what hacker need. block every thing and safe. thats how its done 10 years allready everything is blocked. its hard even manage own local network. need open everything you want use, but only need make email and attack you reversebackdoor lol. people seems click and instal them. whaat?
When I worked at a point of sale company, we had a tech backdoor for every system that went out. Walk up, press a key combination to bring up a password prompt you can't otherwise call, and a hardcoded password that worked to unlock everything. I bet it's exactly the same as it was too, and I could probably still walk up to a machine and do it.
As awful as that is, I'll bet it saved a number of contracts. Clients never gripe about security when they are locked out and a tech can get them running again the same day. If they get to the point of having to rebuild, they are just as likely to switch vendors.
@@toddmoore9841 For sure, it also unlocked a table editor so we could make edits to the DB's directly incase there was corrupted data or something hosing the system. Ah the joys of flat file FoxPro DB's, where if they are opened and the computer reboots, it can corrupt everything. Also access to the FoxPro 'console' window that would allow for minor commands to be executed. Wasn't quite as bad as the PCCharge password system. PCC required 5 different passwords to rotate once a month, so we had a 'hardcoded' prefix and then 0001, 0002, etc added at the end LOL. The old days were a lot different lol.
It’s the highly specialized systems that are constantly being used by non technical employees that are at greatest risk of having a passcode full access back door… when a company is paying for unique software/hardware systems to be built, one horrible mid level managers demands, and attitude, can quickly lead to angry phone calls to the technical staff, and demands from higher up from either company demanding a solution to their own incompetence, damn the security consequences! See how quick a back door is created when you have technicians constantly degraded by a terrible mid level manger in charge of a highly technical project while being a massive Luddite. There is nothing more unpleasant to a tech, than the absurd and ignorant wrath of a narcissistic mid level manager at a company paying for your unique software/hardware that demands you fix ever problem they have. You show them at least once a day how to use some software/hardware, yet still manage to be yelled at about something not working, and it must be fixed immediately….Cue unplugged power cord, Capslock left on… etc… Yeah those business to business projects, where highly specialized unique hardware/software system solutions are being managed by morons… Yeah those systems all have back doors… No technical employee on a project like that would survive a single day without a back door to the system they are working on… Too many employees making decisions with zero technical skills or understanding of security. Those employees and managers just want to hit deadlines. They couldn’t careless about security, anyways that’s not their problem anyways, so why would they care… Ugh mid level managers do way more harm than good from my experience… I swear mid level, sales, marketing, and other bloated departments within many business spend more time preventing real quality work being done, along with crippling products, cutting costs in horrible areas, etc… And internal marketing departments… OMG I have seen hell, and it’s the inside of a mid sized business with an internal marketing department run by the owners nephew who just got their masters in “guerrilla marketing” with zero work experience… I mean the guy’s only work experience was handing out red bull from a Mini Cooper that was “getting a giant red bull can suppository up its trunk…”Yeah that man was destroying his uncles business from the inside, it was so funny because of its stunning absurdity… I couldn’t believe how competent employees just went along with his nonsense! I pulled one employees I respected aside, and said “really?!” And she just turned to me and said “Afraid so… But at least I will see you on Tuesday for that Voice Over session!” I stopped for a moment and realized she meant the session for another company, and already had a job at that fantastic company I was also doing work for, and she would now be leading the Voice Over session… I’m so glad she got out of there ASAP. The best employees are always looking for work opportunities for exactly this issue. If you have options to leave a job at any point for another one, you won’t become a slave to any one company!
@@letthetunesflow Ah, the joys of working for users who think "123456" is an acceptable business password, and give everyone their banking PIN because they can't even be arsed to do it themselves.
It’s amazing how much of this flys right over my head, but for what ever reason I find it fascinating and watch the whole thing. Looking forward to the NSA episode
In summary, backdoors when Dave was working at Microsoft were VERY unlikely due to seasoned professionals having full responsibility for, and reviewing all code changes in their department at all times. If someone tried to put a backdoor in, it would be spotted by the many code checking processes and you would be reamed for it.
@@arnox4554 But only backdoors unwanted by Microsoft. NSA wouldn't try to sneak backdoors under M's nose, they don't need to. They surely had access to Microsoft's highest levels of command who in turn made the NSA guys work directly with the people checking the code, and since the "masters of the kernel" were just a few people, it's way less likely that the backdoors would ever leak.
It is so ironic that this guy bashed on linux calling it insecure, right after a 0 click 0 day rce on Microsoft Office, not to mention the tons of exploits used "in the wild", privilege escalations which haven't been patched for a few years now LOL
Backdoors in the form of bugs are harder to spot. Also, need to mention “Nothing Up My Sleeve” (NUMS) principle for crypto parameters brought up by Microsoft - especially after the NSA/NIST DualEC DRBG debacle.
6:00 It actually makes more sense to have the source code accessible to all workers but limit who can modify which parts. That way any newly introduced back door would have to be visible to everybody but random employees couldn't modify any given file to introduce a new back door. The git model is to have somebody taking care of the whole repo and he or she is not writing code but checking and accepting code made by other people. Linux works mostly this way with Linus Torvalds very rarely writing any code nowadays. And Linux develops too fast for even Linus to properly go through all the changes by himself. Instead he trusts a group of other people where each member will take similar responsibility for a given subsystem. Update: I see you used word "ownership" for this later in the video, I think it's perfect.
The binary blobs are deployed onto the chips though and those chips are connected over USB or are behind an IOMMU making the system access of the closed source firmware controlled by the FOSS kernel. So yes, most modern Linux distros do contain proprietary binary blobs but said blobs do not run in kernel land and only have unrestricted access to the individual device they are running on.
A very good point. However some drivers that run inside the main system's kernel are also binary blobs - the most common being NVIDIA's graphics drivers. After the recent leak of all of NVIDIA's source code, NVIDIA announced they will be making their driver open source - so there is hope. A micro-kernel would be a better way to prevent unwanted escalation of bad drivers. That would make each driver effectively work like they were running on a separate computer.
@@markmuir7338 I wasn't referring to proprietary drivers. I understand those exist however the vast majority of Linux drivers are FOSS. My point was to refute Dave's comments about most distros not being fully open when the reality is as long as you avoid certain companies HW that's not quite the case. Having a fully open Linux system is basically just a matter of getting an AMD card as I don't know of much other mainstream HW that requires proprietary kernel code
The other point Dave made about the "many eyes" thing was actually tested by University of Minnesota. They made a number vulnerable Linux Kernel commits that weren't immediately picked up by anyone else. University of Minnesota got banned from making further contributions.
@@blkspade23 yes I'm aware of that but they did still get noticed eventually. I really wasn't trying to argue about that though as that's debatable as he pointed out. I just didn't like him taking shots at the firmware because it's not quite fair
@@Scoopta If his point was that "there will be code that you don't have access to that runs with unrestricted access" then it doesn't matter if "it only runs on the system that installs it", especially if that code is required for something to run, since you can't get around it. He also seemed to be using that as a way to point out "just use Linux which is open source" or "just use open source OS" aren't the end-all-be-all answers some people make them out to be.
As an avid Linux user I am, of course, aware that I dont use 100% open source software, even on Kernel level. I am not happy about that and I will always favor open source solutions, if viable. BTW you could also call the recent ms office rce that doesn't even use Macros a Backdoor. Or the fact that the msdt service has a buffer overflow preventing a Security check. Or that msdt is not disabled per registry by default.. CVE-2022-30190
A thing that is also kind of left out is that the source being open encourage curiosity and learning; thus having more domain experts. It is a particular skill set and for Windows it can only really start when (if) Microsoft hires or wants to expand their team. Tho Dave has point in that there are many places were an integrity check is just a "trust me bro" and that does not inspire a high level of confidence.
@@KeithBoehler This has changed quite a lot. Microsoft has long had a great reputation of providing good documentation on how their stuff works, but the thing that kept people from learning it was that Visual Studio cost in excess of $500 for a license to use it. Now you can do everything you need to be able to learn their systems using a free license of Visual Studio Code. Although I'll admit that their documentation has gone down the toilet since the good old days of TechNet subscriptions and getting quarterly bundles of CDs/DVDs with all the latest updates. Now there's a lot more information out there, but of varying quality, so finding the good stuff does take more effort, but it's still a lot more freely available than it ever was before and is completely competitive with open source stuff. Unless you want to look at or learn kernel-level stuff. You aren't getting access to a Windows kernel's source code anytime soon, so if you want to learn about schedulers and that kind of deep level esoterica, open source is still king by a wide margin. And while I think you're right about open source being a good thing for learning, I've known hundreds of Linux people in my lifetime, but I've only known 1 of those who ever used that access to become any kind of domain expert on anything with it. The rest either become users or zealots in some kind of operating system-based religious war, and they know as little about their chosen OS as most religious zealots know about their chosen religions. But even in spite of that, I think open source is a great thing and provides tremendous value to humanity - or at least to those wise enough to make use of it.
You spent a lot of time on back doors that people try to sneak past the devs. You spent no time takling about back doors that are put there by the devs at the behest of the government and their various intelligence agencies.
In 2007, I heard of a special windows project that the NSA asked microsoft to do. I enquired up to the VP level what this was all about and got no responses. Soon after that, I asked my boss and his boss for two months off w/o pay so I could take my family on one last trip to Europe before my son left the nest. (I had been there for 20 years) Both bosses were fine with the request but HR wouldn't let me go and I ended up quiting. My exit interview with HR was a no-show and I have always wondered if HR's stance against me was caused by my inquiries into the mysterious NSA project for windows.
You can pretty much assume that every government has full access to any computer, not necessarily through backdoors, but just up-to-date information on exploits. They probably know every one and have programs constantly updated to automatically apply these to the target machine.
Nah, they just saw an opportunity to let go a senior employee that could be partially replaced by a younger underpaid graduate, saving a huge severance package by forcing you to quit. HR people are garbage
1. No such thing as a conspiracy theory. 2. I Am a liar 🤥 3. Number 2 is false. 4. A conspiracy is a Felony in a Criminal Court. 5. 3 protocol changes took place 6. Learn to speak 🗣️ Octal 7. All your bases are belong to US 8. XaaS and you don’t even know it! 9. The Rights of the individual are only protected, as long as they don’t conflict with the state. 10. Rinse and Repeat 🔁 until 2035, you silly 🙃 flesh bags 💼 filled with mostly water. 11. See Number Three. ❤ 12. The moral of the story to “The Boy Who Cried Wolf” is 2 never tell the same lie twice. 14. What are you expecting? Number 13? 😂
In college my COBOL instructor (yeah, I'm old) gave us some coding rules, some were just syntax based, some were just good coding practice. One in particular was "Always give your variables meaningful names, tell the next programmer what it's for, and only use it for that. Do NOT call it something stupid like ZDPQ." COBOL background: every field has to have a name, but if you're never going to reference that field individually, say it's a subfield like a short part of a long header line, you can call it FILLER. Programs often have dozens to hundreds of FILLER lines. Out first coding assignment was to punch in (yeah, punch cards, I'm old) a program he gave us on a handout, and get it to compile then run it. Had some FILLER lines in it. On a whim I changed one of them from FILLER to ZDPQ. Did the assignment and turned it in. Came back with the change circled but no points off. Ended up doing that for all the assignments, and always circled. I carried this habit into my career. Nearly 30 years of COBOL programming, every program I wrote or touched has a ZDPQ in it somewhere. First time the reviewer asked and I said it was just a joke and explained it. He thought it was funny and OK'd it. And that's the last time anyone ever mentioned it to me. I have no doubt that many of my programs are still in production.
Yes you are old, so am i ;). Even tho i learned COBOL on the street so to say. COBOL was actually a great language. Simple and easy to learn. And meaningful names for variables were a must, if you still wanted to read and understand the code 6 months after you created the code. And yes, your code might still run somewhere. It wonders me how many banking systems exist, still running on old mainframes and still running COBOL and programs 30 odd years old.
That's a funny story. I'm old, too, with over 35 years as a COBOL programmer, both batch & CICS, I too started in the punch card days. Remember setting up the punch machine to automatically punch sequence numbers, in case you dropped your deck? Plus, use a black magic marker and make a diaganol stripe on the edge of the deck? It saved my butt, one time.
@@kg4wrq Funny how learning CICS coding set me up well to learn to program under Windows. Check your inbox (or get your message), do what they ask, wait for next message.
In light of all the review processing you described in this video I'm very interested in a more detailed discussion of how you went about the 1,000,000 lines of code commit that you once made.
2 года назад
As long as it is closed source, it is backdoored and the amount of malware that can easily target it, I won't change my mind.
Backdoors do not need to be inserted in the development arena, but rather in the manufacturing process. I'd also suggest you read a paper by Ken Thompson, 'On Trusting Trust". In this case the hack was in the compiler binary, not the compiler source or the login source.
But Microsoft wrote the compiler. It would (or should) have the same scrutiny as the kernel because it's used to develop everything else. One of the first things you do when writing a compiler is to compile the compiler on itself. It would be tremendously difficult to get a back door through that process.
@@babybirdhome And as the Ken Thompson paper points out, you are running a compiler that you did NOT create. The source may be clean, but the compiler itself can be tainted. In this day and age even the silicon may be tainted. Turtles all the way down.
@@Norman_Fleming Yeah Ken was technically correct (the best kind of correct) but somewhat paranoid in how far he took it. He wasn't wrong, but in real life things just tend to work (more or less). There probably are spies infesting the fabric of every society, but they leave things as they were afterwards, so you don't notice that they're there. Not saying that's a good thing, in fact it's terrible. Just that it's easy to live with it.
What about introducing an intentional, subtle bug? a bug such as the well known eternalblue smb bug that was present in windows? it's tricky, but couldn't you sneak a subtle edge condition past your code reviewers, given the right motivation and position?
This is where peer review should prevent such things. But this is true for any OS. Apple had a bug, where they did not validate SSL certificates correctly. It somehow got committed and was in the source tree for years. If this was a malicious act or just negligence, I don't know. The only way to prevent things like this is to perform peer review.
@@1971merlin Yet, statistically over the years it is also plausable that 1 was inserted by someone intentionally. The amount of money up for grabs, just from major world powers makes it pretty plausible that someone would take the job. And that doesn't consider the possibility of state sponsered espionage. It does seem more likely that espionage would wish for the source code to look for 0 day exploits.
is there any chance you've ever considered making a video on symbols and what they do? i heard you mention them when talking about building windows, and i remember running into issues with symbols when i was trying to find something that was causing my laptop to crash. it would be super cool to hear what they do since i have a hard time finding information on them!
Symbols are files (extension: .pdb) which tell a debugger details about the spurces used to create a binary. Microsoft distributes Windows symbols freely - search the web for "Microsoft Public Symbol Server". Note that these are public symbols, meaning thet only contain function and param names, and stripped of spurce code location or loval var info
All of this is great and all, but how do we know that what you're saying is true without access to the source code? How can we trust that what Microsoft says is running on PCs all over the world is what is actually running on them? There's a simple answer- we can't and won't ever know. That is why I use Linux, at least I know (most) of what is running on my system as opposed to none of it. (And for the basically unlimited freedom, but that's unrelated)
I agree with you, that open source != inherently secure. But the more eyes can scan code the higher the chance of catching some thing is objectively true, the saying “there’s always some one better than you” basically applies. If no one checks it than it doesn’t have any benefit of being open source, yes and in my opinion the Linux Kernel does have too much bloat in it, unknown DRM, unknown closed source blobs.. whereas at least the Kernel should be 100% open source imo.
@@AmyraCarter Maybe, but I don't buy pre manufactured PCs, I usually build my own without any of their bloatware and proprietary configurations and setups. I honestly don't think Microsoft would have a backdoor in their OS for themselves as that could lead to many legal ramifications. This isn't to say that they have not put any in their under the order of governments... Now as for hardware such as your CPUs, motherboards and chipsets with the pre installed firmware... there is no way of really knowing unless either A, you had the full spec sheets with ALL of the instruction sets and functionality of the hardware or B, you were able to fully reverse engineer it yourself. Take antivirus software programs for example... who benefits the most from those who write computer viruses? Those who write them or the those who sell software to protect against them? I'm not saying that this is always the case, but I wouldn't put it past some corporations to privately (off the record) hire people to write and design some of the computer viruses out there just so they can market and sell their products. At the end of the day the best we can do is hope for the best while expecting the worst case scenarios. We can not always assume that they have our best interests at heart!
@@AmyraCarter As for #1, you have to read especially the spec sheets, compatibility lists, and requirements for specific hardware. Also, having the schematic or diagram for the mainboard is a plus. Knowing is a combination of research and hands on. As for the fixed income I can understand that as I have a tight budget too. However, if I'm looking to acquire a new system, I'll start to put money away and save it just for that purpose. A barebones for about $400 - $600, not really worth it unless your own purpose of use is simple browsing, text editing and basic printing. You can build a custom mid-grade gaming pc for between $800 - $1,200 and is good for mild gaming. This is the average price range for a decent bang for your buck, but still lacks in overall capabilities. A mid to semi high end for about $1,200 - $2,800 will handle 95% of all current games with high graphics decently. These are the target pc builds that most people would generally be happy with as the tradeoff for cost and performance is fairly balanced. A fairly high end but not quite top of tier system might be around $3,000 - $5,000. These systems will handle all games without question and future games for a few years to come. They can also serve as a workstation such as 3D Modeling, Photo & Video Editing, Content Creation - Live Streaming, Software Developing Systems, Mild to Moderate Simulation Systems, etc... These are a bit pricey, however if you're looking to invest to do a fair amount of work both effectively and efficiently while being able to multitask with computationally and resource intensive applications such as running Visual Studio, Unity or Unreal, Photoshop, and several other applications simultaneously it can be worth the investment. Also the integrity of the hardware at this level is much better. For example a recommended power supply might be an 850W - 1200W Gold Rated or higher unit. These can run about $120 - $300 compared to a basic 450W - 700W low end power supply that costs about $30 - $50. The difference between the two isn't just the wattage and price difference, it's also the warranty and integrity of its internal parts. The higher end system can have a 7-10 year warranty while the lower ones can have a 1-3 year warranty and maybe 5 if you're lucky. They use cheaper capacitors in the lower ones. Top of the line tiers can run from about $5,000 - $10,000. Typically these are the highest tier components across the board with multiple GPUs, high end cooling systems, maxed ram, plenty of storage on the order of 12-50 TB and these are typically out of most people's price ranges... These are more like enthusiasts, system builders who want to show off ect. Anything beyond these would be high end server racks or server farms or modern supercomputers. I fully understand, I don't have the money and I'm looking to build a new system. I'm looking in the $2,800 - $4,200 range depending on which CPU - GPU combo I decide to go with and which type of RAM. I can probably save about $400 for sticking with DDR4 Ram or invest now and get the DDR5. I was thinking of getting an NVidia RTX 3080 Ti but from what I've been seeing, in the next couple of months, not just NVidia and Radeon(AMD) but also Intel and AMD are about to release their new lines of CPUs and GPUs and as I understand, Intel might even be entering into the fray with their own GPU. The bottom line is, it depends on your needs for what kind of system you should invest in regardless of the cost. Even if you're on a fixed income but if you have good credit, you could always take out a single credit card just to purchase it, and then make the monthly payments. Then again, adding an addition $20 - 50 / month right now can make or break someone, especially with the ridiculous fuel prices.
There was early windows 7? I think god mode which was awesome once it became known. I am not sure if it counts as a backdoor or leftover debug or an easter egg.
Windows doesn’t need a backdoor there’s a built in backdoor through intels management engine that can literally do whatever it wants even if the machine is still powered off. You see, we’ve been screwed since day -11 Do what idid, give up.
Get a pen and paper. Cover all cameras. Job is done. Respect the people disrespecting you and others just as much, when pen and paper is not good enough ofc. It is hard to make mics quite unless you go in and cut them out by hard. Anything you do on any device is visible if someone or something cares enough to look into what you do with your private devices and data. So better buy 10 stacks to write stuff on and pens to last you. Since with cameras gone they need to get physically into your place and look at the stacks of data on paper media. :) It is really scary to see what is just open to the users to do with modern phones. Scan data really clearly with just the camera. Talk into the mic and it knows exactly what you say etc etc. You really can just blank them off to win, but still without destroying the mic your out of luck trying to stop it listening in on your talking with loved ones. Best is to make a device that can be 100% trusted to write data on and off never online connected storage devices. That being shield it from anyone but you having access to it. 1TB of text files and images what not is allot. Hopefully keeping physical copies too just in case. And fits more or less anywhere making it impossible to physically find the hidden data you keep at a secret place! But papers and pens without cameras is totally the safest way to store text and possibly also images. No firewall needed for that feat! Ha! Just bulky and harder to keep from home intruders to get access to. But ho is really going to go into your home for your ketchup preference??? O I know they have no remorse doing that to your computer or just tracking you other ways since screw privacy or decency. Problem is trying to hide video from screwed -11 days. But what video files do one really care to hide away. Easy to find more movies and stuff if it is lost. But when having to pick up the pen agen just due to -11 day screwed is just a sad display of todays world.
Dave, I love your videos. But do you think you could please practice talking more slowly (like, say... about 75% of your current speed) to make it easier for us to understand you?
@@bravefastrabbit770 RISC-V is only a standard. Processor manufacturers can (and will) backdoor them too. Regardless if it's NSA, CCP, MOSSAD or some other secret organization, your machine is likely compromised.
@@install_gentoo Given that it's an open standard we will be faced with options rather than highly privileged proprietary firmware blobs (black boxes) necessary to even run the thing. That's the beauty of the beast. Now whether the overwhelming majority of them will be compromised or not, I definitely agree that they will. But at least we will have alternatives. Until then, there are a handful of options out there. Such as the ones from System76 & Purism, on top of the better (but more expensive alternative) raptorcs for desktops which promises to have removed all blobs with their OpenPOWER, a "fully libre firmware and hardware solution".
I don’t want to insult anybody but the day Windows dies, will be a good day. Windows is like a demented 95 year old. The fact that they charge for a product with non removable malware, adware and spyware is not even taken into account in that.
I really don't know much, but doesn't Linux has some specific experts or "owners" of sort who have to autorize pushs on repo? If yes, than Linux code is also reviewed by the right prepared people.
@@DavesGarage Makes sense, maybe the actual Linux team working closely and looking at it is smaller then Microsoft team looking at Windows. Thanks for the response.
@@ShuAbLe He's lying. There are more people who contribute and look at Linux code than the Windows kernel, including Microsoft whose major revenue comes from selling Linux VPS. Sure we can't look everywhere but it's still far more secure than Windows, where you're at the mercy of Microsoft prioritizing vulnerability fixes. The average time taken to patch Linux is a lot shorter than Windows. Sometimes Microsoft can take even months to fix a vulnerability while on Linux, it can be a next day update.
bugs are not vulnerabilities. Microsoft word has a zero day exploit that microsoft has known for months yet they refuse to fix it. good luck shilling, shill.
As a Linux user I 100% agree with your criticism of open source and of the mentality a lot of foss advocates have. Foss can be more secure if the right people actually audit the code, but it's not inherently more secure because people anyone can audit the code. But alas, this is something a significant percentage of the foss community just refuses to acknowledge. I don't know if it was last year or in 2020 that an 8 year old exploit was found in the Linux Kernel. There are a lot of competent people working on it, and this wasn't found in a propriatry blob, but, despite the code being there, it took 8 years before someone had a look at it and realized how it could be abused. I think there was another 7 years old vulnerability found a few years prior two. Also, as a linux user, I'd like to apologize for any and all misguided hate you might receive as a result of your comments on the topic from any of my fellow linux using nerds.
I agree, free software is not free of backdoors, thousands of volunteer programmers around the world can introduce backdoors in the software between millions of lines of code. Many eyes looking at the source code to protect software security and many more looking at how to break security and introduce malware.
@@franciscojavier6003 I've had the discussion more times than I care to count but most foss advocates just don't want to admit that code need to be audited by a trusted third party for one to be able to claim it's secure. Most foss advocates really do believe that just because more people can view open source code that makes it more secure by definition.
I was there during win2k development, and recall full federal reviews of the code looking for any undocumented features. That was also when the “no more Easter eggs” mandate came down. Which makes me think if there had been back doors we eliminated them at that time.
Datamation magazine claimed in 97 or 98 the remote support system in 3.11, 95, and NT allowed admin access given the correct hash, a hash based upon processor model, processor id (if present), ram installed, and number and sizes of drives. whether correct or not, the federal agency I then worked for blocked all in/out on the remote support logical network port used.
@@WilliamHostman that would have been just prior to the review, hence the strict requirement which came down that there be no code not called for in the specifications. (Hence why even innocent Easter egg code had to go, because the Easter eggs prior to that time were never in the product spec.) there was a very serious review of all the code.
@@thomasjefferson4195 ACtually, that's what I'm worried about. If some malicious hacker got past all the security features of MS, then they could easily close it later and they'd definitely tell us all about it. But if THEY put one in, then it would be on everyone else to find it and make enough noise for people to notice, because obviously MS wouldn't tell us.
As far as I know (correct me if I'm wrong), modern versions of Windows periodically send screenshots to Microsoft as part of something like a "user experience improvement program", or, more simply, telemetry. Are these images reviewed as carefully as the source code of the Windows components?))
Security is like Quantum Mechanics, the more you know the more clearly you can see that you can not see clearly enough. I don't think many real professionals claim that open source is anything more than the title suggests. A maintained open source product can be more secure than a non maintained proprietary product, but the opposite is also true. The difference between open and closed source is that I could take a ten year old open source project and try and try and make it secure or functional today. I can be pretty sure that a copy of Windows XP will not cut it for an Internet connected machine today and nobody outside of Microsoft could do anything meaningful to change that. If a project still has use then an open source project can be updated by an interested party whereas a closed source project dies when support ends.
Sure, but *Microsoft* could update XP to be secure far faster than the public could update a 10-year-old sku of Linux, because they're had to start from scratch, with no knowledge of whats in there. And being "updated by a third party" is only a good thing if those changes are proper, high quality, and benign. I just think we have less assurance of that under Linux. As for me, I run Ubuntu WSL2 under Windows, so I'm screwed no matter what! They'll get me one way or the other.
@@DavesGarage " so I'm screwed no matter what!" ... Indeed, that is the main reason why I wear the tin foil hat and trust no one ! Looking forward to your NSA key video ... assuming "they" don't get to you first :-)
@@jonshouse1 they already got him, what you see in this video is high quality CGA/CGI :D P.S. I'm wearing a stainless steel bowl i mean hat so I'm more protected... :P
re: "I can pretty sure that a copy of Windows XP will not cut it for an Internet connected machine today" And, you would be so wrong. Internet-connected Xp box is writing this comment. Maybe you are unaware of how DSL and cable modems incorporate firewalls for instance. That would explain a lot of your naivety.
@@DavesGarage Microsoft *could,* but they won't. That, I think, is the main advantage of OSS. Why would MS spend resources writing fixes for a legacy product that, if it were made secure and had sufficient driver support, could be a perfectly valid alternative -- even today -- to spending money on new versions? This is the thing I don't like about commercial software at all. You don't get a say in its destiny. I think Windows' UI peaked in XP, but Win 7 had some advantages, and either could be argued as the better one. Since then, there isn't really anything in the UI that has gotten better, and lots has gotten worse. OTOH, security, Bluetooth, high-DPI monitors, USB 3.0, Thunderbolt, a decent 64-bit kernel... None of those things are visible on the exterior, but they matter a lot. Would be nice if you had any choice whether you liked the look/feel of 2000, XP, 7, 8, 10, 11, or 3.0 for that matter, but could run any release targeted for a 386 up to a Threadripper. At least, if it was all OSS, and the community (or even one person) wanted it bad enough, that could've been the case. Given how many unofficial service packs, USB fixes, driver ports, and other things exist for the retro Windows community, they want it bad enough that that could've happened.
Maybe not a back door but certainly key ways, Task Manager and even the dev spy version both can easily be manipulated via dll calls to remove and hide processes. Why on earth would you ever make that a feature? Please why was that possible to call externally? hehe I even wrote a little program in VB called MS Hell to show how easy it was, can't remember what site source sharing site of the day I shared it on but its seems to be long gone. Urgh made so many apps like backoffice possible, and I just can't see a good reason why it was a feature that could be used externally.
5:00 -- my cousin once got thrown out of a public pool for peeing in it. My aunt had to go and pick him up and angrily told them, "ALL kids pee in the pool!" They said, "well sure, but most of them don't do it from the diving board."
I once stumbled across what could be a back door into a telco inventory database (not customer data) I tended to assume it to be a bug rather than an actual backdoor, although the resulting command line access to the SQL server needed skills I never learned. Yes one could really ruin the database, but I think that was the limit to it. My main interest was seeing how many revisions the software went through before it was corrected/changed, but I then was kind of let go, and I forgot all about it. Yes I could have reported it, however how to do so was so obscure it wasn't funny. and then I was 'severely side-shifted', and this was then the last thing on my mind. At least I didn't crack it like one poor sole did, who quietly left his managers office after getting the 'bad news', walked into the server room, pulled the main sever then dumped it down the back stairwell - well that's how the story goes, truth unknown, just sounds good.
Hey Dave, many (MOST)of the accusations about Windows having one or more back doors are not about some rogue employee... maliciously putting one in, but rather Microsoft officially having a way into users computers to sift through their files, gather data of any and all kinds at will! So a whole different scenario! In reading the EULA for Windows 10, it was very apparent that they did, and were telling you they do, can and will use it, and not just on the device with the Windows OS, but "And all connected devices"! I am speaking of the EULA, and it's wording (Their own words, no interpretation needed!). So maybe we should call that a side door then, or a skeleton key to the whole facility.... I can't say any more than what I have heard beyond that, because I ditched Windows just as Win 10 was being forced on people for Linux. It was not just for security and privacy, but also a financial decision, and well principals: If Microsoft (and unnamed partners) want that much power over users data, how they can and cannot use their devices... then saying "F the whole lot of them" is perfectly justified, and more should do so too, and tell M$ and others to stick it where the sun don't shine, and with it change the odds they will keep up the shenanigans in lieu of the loss they face by doing so! Stab me once, shame on you! Run into your knife repeatedly, and provide the sharpening stones: Well Duh hey, and WTF Man?!?!?! (
I remember going off the deep end when I first read the windows 10 EULA for that very reason. I think it goes way further than a backdoor to being all out access to your machine from theirs.
@@Bob-of-Zoid you can literal just goggle project prism, look into NSA enforced backdoors. People that DONT work for microsoft know its history but this dude worked there and pretends to have mo clue about NSA nonsense thats already been proven. You're so naiive it's painful
@@thomasjefferson4195 I didn't ask you to try to convince me of your belief, but to actually prove your claim! You are the naive one: Look up the word, then look up "Epistemology".
Or just patch the final binary you ship, no need for backdoor in the source. Or just put an extra master key/binary blob to the distribution config. It's much more easy to hide than commit it to the sources.
@@Luther7718 so you know everything the secret service doing? or the nsa? right, you don't. why? same reason why the windows source code not leaked already or anything similarly big. if you messing with national security level stuff you pretty much end up in Guantanamo without even a trial. look, if they spice the binary with a backdoor, it wont be the average Joe from accounting. but much higher up. or maybe Microsoft doesn't even know they are compromised by some 3 letter agency. :D
long time linux user- currently on a LFS build with a custom rolled libre kernel- no binary blobs here- but I am a huge minority in the community. you are right about that. also rolled my own window manager. Big fan of the channel despite not being a big fan of Microsoft :)
Haha, what about the smart-ass kid who would actually _try_ that and wait around eagerly to watch for the "color change" and then say, "Ha!" because the purple never showed up? And why not just say "yellow" since that would be natural?
I genuinely love when you tell stories like this. I have always been fascinated with the how and why things work, to the point that some of the first places I went after I got a modem (2400 baud, in 1998 - painful but usable) were 2600 and Phrack. I may never need to know what I've learned, but having the knowledge is very comforting to me. I will admit to shoulder-surfing my third grade teacher (Sorry, Mrs. Burr...) and learning the password to her Mac - it was APPLE. But I spent many an afternoon on the Oregon Trail because of it.
up until windows 7 there were multiple ways to bypass the login and get full admin. so there are no intentional backdoors, but many holes. One of the best was MSN Messenger.
I backdoored my own windows 10 system because my pin wouldn't be recognized after an update, and I couldn't remember my password, which I only ever used a few times. At that time I had no coding experience, and still managed to get full admin privileges, I considered switching to mac due to glaring security concerns, but eventually I ended up on arch linux, because I'm not rich enough to afford a good mac, and I don't want to deal with the unreliability of hackentoshing. The AUR has locked me here forever.
@@accountid9681 Can you explain how you "back doored" your Windows? To my knowledge, this is not possible, unless you have low level access to the hardware.
@@todortodorov940 I booted into recovery mode, and tampered with the filesystem to remap the visually impaired helper/reader button to open an admin terminal, then I used the admin terminal to change my password, and logged in. Pretty sure it's been patched, this was in august of 2021.
As always, love your videos, just want to ask you something @Dave's Garage, what is the chance of any operating system from microsoft has "Institutionalized" back doors.? Not backdoors from users, but any been setup as a company wise "policy" (even if kinda of secret)
Windows XP had a big and fairly well known back door. I think it might have been closed in one of the service packs; I know for sure it was gone in Windows 7. The was the "at" command (command line interface to the task scheduler). It could be run as a regular user, but processes started by it ran under the SYSTEM account. You could open a command prompt, type "at cmd", with being, e.g., current time plus one minute, and at the scheduled time, a new command prompt window would pop up, running as SYSTEM. From that you could start a task manager running as SYSTEM, kill explorer.exe and start a new one running as SYSTEM and you could do anything an administrator could do. Later Windows versions allow only administrators to run "at".
Maybe in the XP/2003 era (heck even the win7 if you stretch it a bit more), windows was quite "secure". Todays win10 and up do have a backdoor. It's called windows update. Windows update in the actuality can install driver level stuff, and even bios "updates" (the new "capsule" function include under the new UEFI releases) without any question and without any type of privilege escalation since wupdate runs under the system user.
Adding whitespace can be dangerous. Try a cmd line file with del /temp_folder/*.* with a space at the end. The company I was working at many years ago lost 2 servers as the extra space deleted the whole C drive until Windows fell over.
lol,all the stuff that is running on a lower abstraction level than the OS, the bios on steroids ("Lights Out Management"), is all you need for backdoors..
Microsoft has an obvious sort of backdoor into every Windows machine, in the form of Windows Update, which, on modern versions of Windows, is very difficult to disable and also most people would not want to disable it since having a not up to date system is a lot riskier, but still, suppose someone managed to gain access to the update servers, or suppose Microsoft was forced by a government agency, virtually all Windows machines connected to the Internet could be accessed.
@@Leo-sd3jt But the fact that they managed to sign the package in a way that made Windows Update accept it as a valid update package makes it a (serious) vulnerability in that case.
Back in the NT4 days I would regularly turn up at customer sites to install/upgrade applications only to discover the IT dept had not granted the required privileges. My usual strategy was to open a command prompt, enter "at [now+1 minute] /interactive explorer.exe". One minute later Windows explorer would pop up running under the system account. Everything executed from it also retained that privilege so the server was wide open.
That's not a backdoor, it's a security vulnerability. The difference is whether it was intentionally left by the developer or a bug/oversight. In that specific case I'm pretty sure it was the latter.
The Konami Code is probably my favorite classic example of a back door if you could call it that. It was originally intended for development purposes, but accidentally left in all the way to production.
I'd say it's usually left in on purpose. You get to a point where everything is running and it's as good as it's going to get and you're simply afraid to touch the code anymore lest you wreck something. Even putting NOPs over real code can mess up anything dependant on CPU timing.
I wouldn't call it a backdoor since it was a single player game and you'd only be cheating yourself. Not every undocumented feature is a backdoor, otherwise you could claim that most software has backdoors due to unremoved debug features, easter eggs etc. Backdoor are by definition features that allow you to risk or cause damage to others.
This video presents a very narrow example of how you can create a backdoor. Underhanded C Contest entries provide plenty of examples of how one can disguise backdoors as legitimate mistakes
Windows update can command all machines to download and execute an update, right? That is a backdoor, let's hope only Microsoft has the private keys to use it.
@@eadweard. If someone can cause your machine to run anything they wish, with full privileges, without your knowledge, without your credentials, it's a backdoor.
@@douggale5962 It sounds more like an update mechanism. I think a backdoor is supposed to be something malicious and hidden, and intended to allow an attacker access.
@@eadweard. It is specifically designed to allow Microsoft to force updates onto your machine, whether you like it or not. Is that malicious? Yes. It's my computer. It's mostly a huge national security risk. If an adversary got Microsoft's private keys, they could disable almost all computers, at least temporarily. They would be able to impersonate the update servers, and they would be able to sign modified updates.
So you don't think the book "Showstopper" was accurate? I didn't start at Microsoft until after NT3.51 released, but the culture at the time was indicative.
Open-source OS with binary driver blobs: This is a problem because of the monolithic nature of the Linux kernel (and Windows and recent versions of macOS) - drivers have privileged access to everything. Security is faith in the driver developers. This is the most compelling reason for why we should re-investigate the old idea of a micro-kernel - where each driver lives in its own private memory space (user space). Sure it has a small performance overhead, but these days I think it's worth it.
@@ea_naseer Yeah, I know. I'm also aware of the downsides of a micro kernel, but to me they seem reasonable in the modern world. When I wrote Linux device drivers a few years ago, I was amazed at how much destructive power I had at my fingertips. It's also why Android doesn't allow kernel modules - all drivers have to be baked into the device tree in the kernel image.
The main backdoor is simply the update mechanism of Windows. Whenever the NSA or similar demands it, all machines WILL contain backdoors after a simple update.
This is more probable, targeted updates. Leaving code on a machine is risky business that really ends as a double edged sword. Law enforcement and intelligence only care about comprising machines when they are of interest. Comprising every machine is just a liability.
okay...? but we have a BILLION (do you not know how insanely large of a number a billion is?) users and NONE of them have EVER actually proven ANYTHING youre talking about. 🙄🙄🙄 its as close impossible to slip by even a tiny backdoor without SOMEONE noticing without actually being impossible as you can get. so in 99.9999999999999% cases there is no fabled backdoor. possible, true, but so unlikely you might as well accept that it is impossible. and you all can spew all the ignorant and rambly unfounded conspiracy theories but NONE of you have EVER provided ANY actuall evidence for what youre rambling about whatsoever. stop watching faux news. stop listening to alex jones. start touching grass. know something? put up or shut up.
Open Source is the best defense against backdoors/zero days. If the problem is there, the hope is that someone altruistic will find it before someone with malice. Even if the malicious find a zero day first it won't take long for a world full of coders going over the source to find and patch the problem.
@@eadweard. Yes but he was wrong. Open Source is more secure by nature, closed source is by definition less secure as we have to trust that Microsoft Teams will pick up the attack, which they don't most of the time and take time to issue an update.
Great to hear that Microsoft had such strenuous security protocols to review the code coming into the main source repository before the kernel owners with gag orders placed against them are ordered by Microsoft (which was forced by the NSA) to intentionally include a backdoor.... You wouldn't want random employees and non-employees' backdoors to interfere with the intentional backdoors placed by the kernel module owners.
That about sums it up. Why Dave started the subject if he can't tell the truth abut it. It was the same deal with Facebook. There is famous video from the beginning of Facebook with either CIA director or NSA one in Zuckerberg office just hanging around. Are we to believe they were discussing weather or perhaps something else?
Fascinating video with good info, and it sounds very similar to how things work at SimCorp, which builds a many-million line application since 1993. However the concern is not whether one Microsoft employee can pull a fast one over another, but rather if Microsoft is pulling a fast one over its users. And to this we must say that the user simply cannot review the changes that will be forced unto their systems by Windows update. Fundamentally the deployment and installation of basic system components of Windows are outside user control, and that makes it a back door any way we slice it. Not a hidden one, obviously, but one nonetheless. And this was not the case when you were there Dave, so you go 100% free on all charges as far as I’m concerned.
@@MidnightThunderYT Hard to get in trouble when the man of this channel, and many of his colleagues then, have created a platform that is so good and lasting that it basically carries everything to the point where nobody can really do without it. Win32 has become a free IWIN button for Microsoft - they get far more leeway than they deserve because of it.
@@MidnightThunderYT I was writing a security paper and wanted to do Win10 privacy issues. There was no peer reviewed studies looking into this. The only articles I did find detailed the Chinese government's special version of Win10 that was designed to not invade on the user's privacy. They weren't even academic, they were from trade journals. In any case, the most secure version of Win10 you can get is a special version used on Chinese government computers. Interestingly, even though there are programs designed to harden Win10 against personal data breech, no academic papers were found in a search of 2 different college libraries. Maybe it has changed, but I known from experience that MS offers tons of grants to colleges, so it seems that they have purchased some good will against the curiosity of many researchers.
@@not_my_fn_real_name2689 highly doubt the Chinese windows is safer. maybe against the US but not against the Chinese government itself. I guess it's more of pick your poison.
NSA uses the Bitcoin Honey Pot. a lot computing power without admin and hardwarecost + the idiots that use the bitcoin for illlgal things. a brilliant thing indeed
Thanks for letting us in on the history at Microsoft. I'm not sure we'll be running it too much longer with Microsoft having to sign anything that runs under Secure Boot and TPM (Including Linux). That being said--it's not Microsoft that anyone needs to be weary in regards to backdoors, but instead, Intel, AMD and some degree Apple (and any other silicon manufacturer). The NSA has hardware backdoors that are much scarier and REAL from what I've managed to research.
Processors have become so complex and capable that it's simpler to embed the monitoring software there rather than in every OS. With microcode updates being encrypted and the silicon being proprietary, there's not much scrutiny they can be subjected to.
That was my thinking from the beginning. My career was in MVS System Administration, where there's a hardware flag bit to indicate whether the current app is running in Supervisor State. The CPU could be designed to recognise a special sequence of OpCodes and set the Supervisor flag bit for whatever follows in the innocent-looking user's app. That should be a fun exercise for the CPU design nerds (if they haven't already done it).
@@thomasjefferson4195 I think each of us is more likely to be impacted by hackers. However society is not at risk from hackers, but absolutely at risk from governments. Even if you wanted to, there's little you can to do to keep them from monitoring you if they decide to. There exploit surface is so large for any modern computer.
Heres a fun one. Back in the late 90s, on my high school PCs they had installed "Foolproof Security System" this was a system that attempted to lock down windows (I believe Win98SE) and stop students from doing things. Problem was, it stopped teachers from working too.
So bored in electronics class, we open the Fool.exe in notepad. There, in the middle of the code is the word "Backdoor"... no. couldnt be that easy. We type it as a password. no-go. Then I see the ! right after it.. So I try "Backdoor!" . It works.
It not only works, but it works on every machine.
Every. Machine.
Fast forward 2 years and the school district is spending thousands reinstalling the "security system" due to a district-wide password being released. After the install? The exact same backdoor is still there. Its in every version of their software.
It's interesting that backdoors are so much more common in 3rd party "security software" than in 1st party code.
It sucks there doesn't seem to be any info about it online, it sounds pretty funny, I wonder if it was ever found out
@@SkynetCyb after posting this. I searched for the software. There is surprisingly little information online about any of it.
@@lwilton I bypassed my local public libraries incredibly weak "security login" simply by opening an open file dialog box in a web browser, navigating to System32, manually ran Task Manager, and killed its running "security login" exe process. They had the easy methods to open Task Manager and File Explorer blocked (no hotkey, or shortcuts) with some horrible login manager. I got caught after being on their computers for like 5 hours 3 days in a row, they had no idea how I did it, but I was banned for a week. Was like 12-13 years ago though. My wife works at the same library now lol.
Tf do you open a exe on notepad
I wouldn't be surprised if there were actual backdoors in Windows but I think it's more likely that there are backdoors in the Intel Management Engine or AMD PSP source code which is inside the CPU among other hardware backdoors such as microchips which were found to be inserted on server motherboards made by Supermicro a few years ago which led to Apple and Amazon cancelling contracts with SuperMicro to supply them with servers*.
*according to Bloomberg Media, China Uncensored (America Uncovered LLC)
Funny. A window with doors
A Window is just another opening it may as well be a door. leave a window open even a crack and anyone with time can slip the latch and slip in
In windows 7 there was a method of opening a file dialog as admin while performing a crash diagnosis in recovery mode (idk what it was called). This allowed you to swap CMD with sticky keys and activate CMD as root on the login screen.
What is this considered? Its not a backdoor, but it's definitely a security vulnerability.
It's a backdoor if you actually do it on someone else's machine. The ability to do it by itself is not a backdoor, first of all, because it was never intended. Maybe you could classify it as a vulnerability but imho it's not a serious risk since you'd need admin access on that machine in the first place to make that modification and if you had admin access you could just install some hidden remote access tool.
Being able to replace the files on a computer you have a physical access to is not a vulnerability.
its probally a bug, for it to be considered a backdoor it needs a few things, first it need to be intentional, and second it msut be able to be done remote via internet without physical acess to the machine.
that thing is a exploit in a local machine a vulnerability
What you're talking about are backdoors inserted by malicious actors behind the backs of architects or management. And like you said, it's very hard to add one and unlikely that any would slip through. But I think what most people are more worried about are backdoors which are intentional and generally known by the responsible developer teams, but not publicised otherwise - more like the NSAKey theory you mentioned. That kind of backdoor would actually pass through all the code review and audit processes, as for the insiders it would be an intended feature. So I'm waiting for the next part to see what you have to say on that topic.
indeed thats the ones that would be a far far greater risk as well since not only would they get pushed out with a stamped seal of approval by upper tards all too happy to screw over the public.. but the end result of such is beyond anmy doubt extremely nefarious.. and not just by the US alphabet agencies...
The risk of such is MASSIVE exp for foreign bad actors like china.. and they are all pissy over the banning of Huawei 5g etc well beyond the avg.. which makes it look all the worse for china since even their gov dosnt worry as much about such things for a "private company" per se.
this videos seems like somethinng Microsoft would incentivize people to make, lol
He knows that, he is directing you attention away from that because he's a shill.
@@duckie4670 another possibilty is, if he would speak the thruth he would end up in the ecuadorian embassy because of sexual herasmment claim. And years later it reaveals as untenable (surprisingly unexpexted), but because he flew from the local authorities he will be jailed and high security prison and after that he will be handed out to the (fair) hands of the us legislativ.
*Note: The brackets was irony
& nobody cares..
or think about snowden..
did you learn something today? any idea why he is trying to shame linux? any idea how the world goes?
Lol. Purple. At least you weren't working on the color coded PPC stuff.
Nobody's worried about a rogue ms employee putting in a backdoor, the concern is a backdoor that Microsoft has added in secret, you gave no reason to think that hasn't happened.
Yeah he chose some very specific language in this one, it seems like there is some stuff he isn't telling us.
@*S U C T I O N* 💀
This was a misdirection video by a Microsoft shill
@@Mario583a Exactly that. If there was a secret key, for dubious intent, it would be highly unlikely that they named it that way.
Actual backdoors look like Dual_EC_DRBG. Or deliberately introducing a very subtle 0-day that will remain undetected through years of scrutiny.
Sorry for bad English.
Chance that Windows has a builtin backdoor is very small because it's very risky and very complicated.
Bugs are constantly fixed by a developers team. So rouge need to make a new backdoor every time his backdoor got caught.
In case of Mircosoft (whole company not a rouge employee) intentionally wouldn't fix "three-letter-agencies-sponsored" security bugs - that's not real because it will damage company rep. then it will be known for a public.
The same goes for manufacturing backdoor theory - damage for company rep.
Anyway cybersecurity market doesn't work this way. There are 0day exploits for every system not just for Windows.
In my High School they installed a Alpha-Micro Mini-computer in the mid 80's. It was a cool new toy with capabilities well beyond the Commodore CBM machines that I had access to. This meant I had to learn everything I could about the system. I discovered within a few months that the source code for logging into the machine could be found by anyone with any access on the computer. I modified the code to allow me to login to any account without a password which gave me the keys to the kingdom. Code running outside of a logged in session required a special long string of characters in the assembly code source that the assembler recognized. While I never did anything malicious I certainly could have but it did teach me a lot about the reason that security by obscurity is so ineffective.
In the many years since, I have worked at several companies including one where we created security monitoring software. This required writing some device drivers and patching Windows security DLLs. While the company had non-publicly available documentation and code from Microsoft to accomplish this there was absolutely no controls in place to who could access this information or make changes to code within the company. My job was creating installation processes for the companies products. This required me to understand how the applications worked at a lower level that most of the developers who maintained the software. No one reviewed my code and as long as it got the job done no one cared exactly how it worked.
Because the company was small and they wanted to get a new product out very quickly they outsourced a new application to a Russian company. While the software produced worked well it was also a large mass of code and could easily have contained malicious code. Once again other that what I need to install the product no review of the code was done. Our customer installed these applications on their most trusted systems running under high privilege accounts without knowing that our code could easily have been compromised. While it did not create a back door it certainly could have been used to compromise a lot of very large companies.
It is encouraging to hear the Microsoft took security much more serious than many companies I have worked for over the years, include a very large 3 letter company.
I thought I heard stories from this very channel about when Dave's company worked with a very large 3 letter company for OS/2, that their security was way more strict. At least in the physical sense.
if the large three-letter company is a large German enterprise software conglomerate in the general direction of Heidelberg, things have changed massively in the last ten years. A lot of effort has been put into formalising those processes and enforcing them so shit is being kept track of, audited and fixed.
A good reminder that it's third-party software that is the big threat.
Security by obscurity is very effective - until it's no longer obscure. What's not effective is single-layered security. Obscurity should only be one (very thin) layer of your security model.
Your own example shows this - the systems you had at your school had the login source code available to everyone. That is more like open source software and isn't obscure at all provided you can interpret source code since it was available to everyone with any access level on the system.
The problems you described in one of the companies you worked for are also interesting. I work at a much smaller and less widely known company, and we go through a fairly exhaustive security review before we even enter into contract negotiations with a third party vendor. Our governance, risk, and compliance team starts off with reviewing the potential vendor's security policies and procedures, their compliance with various applicable security frameworks, their audit results from those frameworks, and so forth, before our legal team even starts to review and negotiate contract terms.
Then again, I also talk to various vendors who we consider working with, so I know that my situation isn't the norm and that I'm lucky to work at a company that has mature leadership that actually cares somewhat about quality, and that we have good team members on our security and GRC teams to provide those leaders with good information to make decisions with. But ultimately, security is hard, and it requires a great deal of attention, diligence, and effort to get it right. Companies as large as Microsoft typically have to do this because they have customers that are like my company, but ten times worse because they're government contractors or are governments themselves. Not every company has this, or understands that it's even necessary, yet.
Yess, I knew Intel was always better
Its not really a backdoor but i remember once i got my hands on some old decommisioned desktop running windows XP or 7 or something, when i turned it on it was password protected and i didnt know the password. At that time i was learning Linux a bit and what blew my mind was that when i booted the linux from usb i could see the files on the computer rendering the windows login screen almost completely pointless.
Dave tries to push 'code review' as the prevention against backdoors, but what about a scenario where legal says 'this code needs to be in there and no you can't ask questions or tell anyone'? In post patriot act USA that seems very possible.
I think you're treating "post patriot act USA" as a kind of "abracadabra" magic word that converts flights of fancy into sober contingencies.
@@eadweard. pretty sure the ones that say it can't happen are the crazies in this situation. Unless project PRISM doesn't exist, and carnivore didn't happen.
@@adriansrealm None of this amounts to an argument. It's all very, "If we had some eggs we could have some ham and eggs, if we had some ham".
@@eadweard. buddy, none of what you are saying is an argument, just a pointless blowing off of the past. and that is just ignorance.
(a) they don't do that or the FBI could get into the iPhone's secure enclave, which you know they can't.
(b) there's no world in which only one person would know, so it's still going to get code-reviewed!
Yes, you have code review but if NSA offers you cooperation or 25 years gulag then code reviews won't stop it and NDAs would prevent employees from talking about it.
The Gulags are in Russia. On the archipelago. Americans don't have to go to the gulag.
Concerning the "opensource / pregnancy" comparison:
Are you saying that a binary firmware blob for a GPU means the whole OS is no longer Open Source?
You're using a qualifier, "fully,' so I assume that that's not your point. But with that qualifier I can say basically anything. Windows isn't fully secure, because it has an exploit. Windows isn't fully functional, because it has a bug. Windows isn't fully tested, because of a bug. Windows wasn't fully audited, the sky isn't fully blue (because of clouds), cats aren't fully furry because of the toes. Going the other way, .NET is open source. That means windows isn't fully closed source. Now that we've determined that both windows and linux are neither fully open source or fully closed source, we haven't actually determined anything because Linux is still open source unless you install something that isn't, Windows is still closed source unless you install something that isn't, and I still can't audit the windows file browser source code.
Also: Out of the box the majority of Linux distros don't actually install any binary blobs without some kind of tool that installs them asking you if you want to. If you're running a proprietary GPU driver you know it, because you had to go to the "restricted software" or whatever the distro in question calls it and choose to install the proprietary driver. If you're concerned with Nvidia's closed source graphics driver, don't install it, the open source driver works fine for most purposes anyway.
If you're saying that Linux and Windows both can't be audited because the user might install a proprietary GPU driver on Linux, than I can say Microsoft can't audit Windows because the user might install WeatherBug. Also, any and all security windows may have is invalidated by WeatherBug. If there's an argument that invalidates the WeatherBug argument, It'll also invalidate the binary blob arguement.
He is saying: If a driver contains a binary blob, you cannot read the contents of that blob, therefore that driver is not 100% open source. As the driver, let's say a GPU driver needs to be performant, it has low level access to the hardware. If it has low level access to the hardware, it can access whichever hardware component it wants - for instance read any physical memory address it wants or inspect whatever is typed on the keyboard.
What Dave is saying: Just because Linux is mostly opened source, there are no guarantees that such drivers with either malicious blobs or just exploitable blobs do not exist. This undermines the argument that open source operating systems like Linus are reviewed for security issues by the general public (implying that Windows cannot be reviewed the same way, therefore it must be less secure).
@@todortodorov940 what the poster to whom you're replying to is pointing out: closed source/binary blob drivers aren't activated in Linux by default. Most distros require you to manually enable them.
@@Leo-sd3jt Are you saying that the most popular distros, i.e. the ones used by the majority of people, are 100% open source, they do not contain any blobs and do not contain a single line of executable code that is closed to the end user?
I am sure that there is a hardened distro or one that is 100% open - but we are talking about what the majority of people are de-facto using.
@@todortodorov940 I'm saying that the closed source stuff is disabled by default and needs to be enabled by the user.
@@Leo-sd3jt That's only true for code which runs on the CPU. Device firmware blobs such as for Wi-Fi adapters _is_ usually loaded automatically.
Dave, your timing on this topic could not be better since there is "Follina" vulnerability detected right now.
The steps you cite protect against unauthorised backdoors, an authorised backdoor would go straight through because, it’s authorised. Think something like the fingerprint that Bill Gates put into the trig tables in Commodore BASIC, but that allows unauthenticated access to admin privileges.
What do you mean by "authorised"? Who would authorise such a thing, and for what reason?
@@eadweard. product management, legal and for “product support and improvement”.
@@c1ph3rpunk I think someone would ask why such things need unauthenticated access to admin privileges.
@@eadweard. when the boss says jump you start moving upwards until told to stop.
Darren has listed out some reasons that could be given, no doubt there are others. Beyond that, if you’re told to add something you do.
@@StephenBoothUK These are just phrases. The scenario doesn't seem very coherent.
Windows is the backdoor
9:15 In most reputable open source projects, random submissions aren't committed, but instead the pull request is reviewed often by the bulk of a community of people. In the vast majority of cases it would be incredibly difficult to just sneak in malicious code. There are also a ton of ways to test code, especially in disposable dev environments.
Yes but often important projects are maintained and tested by very few people. Just look at the heartbleed buck. There was one person that reviewed the code written by a student. Now everybody acted in the best faith here and I don’t want to blame anybody. But this code then was shipped to basically the entire world and remained undetected for years. This is in part because OpenSSL in spite of being one of the most important software projects in the world was chronically underfunded and under maintained.
This aged like fine milk
I disagree that I-heart-sex would be a backdoor. Based on the description, Regardless of whether it involves "security" per se, it provides no additional access to significant features or tools, bypassing documented user-facing commands. This would be an Easter Egg, providing secret trivial thrills to plebeian hackers. Personally, I love the idea of Easter Eggs and look down on stuck=up corporate weenies who ban them. There's no reason not to include a tiny bit of hidden fun in our work, especially software, and especially mass-marketed user-facing apps like a hugely popular operating system. If nothing else, it would give people some tiny reason not to hate your stuck-up, stuffy, evil, greedy corporation.
So, all this says is that individual devs were not allowed to insert random code. I can definitely believe that.
The register will add a new article windows has a backdoor ex developer tidbits from Dave. Then conclude there are none.
Most of the blue badge product support staff had read only access to a lot of the source - I had most of Windows, Visual Studio and Office source code up until 2009. Once, I was asked for the source code for Visual Basic 3.0 as somehow it had got lost and I had the only copy in the company.
Don't suppose you still have VB6 source code? haha, there was a mass call for MS to open source it when they decided to kill it off in favour of .NET.
@@Wilksey37 I spent many happy hours debugging in WinDbg but sadly, no. There was soooo much COM goo in there.
@@MarkALong64 Ahh that's a shame, yes, whilst I adopted C# fairly quickly when .NET 2.0 was released (the first real usable version IMO), I still have a lot of old VB6 code that could benefit from a 64 bit recompile, I guess we can be thankful that Windows will still run a VB6 app for now! I haven't done anything new in it for years but I know companies that still use it for their latest business apps.
@@Wilksey37 VB6 had it's quirks and hiccups over the years and patches, but I still feel that it was the most intuitive, stable way to build a GUI Windows App. I've even used it as recent as about a year ago to make a program, LOL! I learned enough C# to build apps, but still find Visual Studio 6 much more streamlined for fast development.
@@aceenterprise Yes, it was a true pleasure to develop apps with VB6, there was a massive community behind it too, I used to spend about 12 hours a day coding with VB6 when I was young(er), I still have my copy of MS VS 6 Enterprise which I bought for £30 from a company clearance sale many years ago, pure luck that the person taking the cash didn't know what it was as it was just another box to him.
1:52 yes assuming that port is open what hacker need. block every thing and safe. thats how its done 10 years allready everything is blocked. its hard even manage own local network. need open everything you want use, but only need make email and attack you reversebackdoor lol. people seems click and instal them. whaat?
When I worked at a point of sale company, we had a tech backdoor for every system that went out. Walk up, press a key combination to bring up a password prompt you can't otherwise call, and a hardcoded password that worked to unlock everything. I bet it's exactly the same as it was too, and I could probably still walk up to a machine and do it.
That's quite the vulnerability. All it takes is one disgruntled engineer.
As awful as that is, I'll bet it saved a number of contracts. Clients never gripe about security when they are locked out and a tech can get them running again the same day. If they get to the point of having to rebuild, they are just as likely to switch vendors.
@@toddmoore9841 For sure, it also unlocked a table editor so we could make edits to the DB's directly incase there was corrupted data or something hosing the system. Ah the joys of flat file FoxPro DB's, where if they are opened and the computer reboots, it can corrupt everything. Also access to the FoxPro 'console' window that would allow for minor commands to be executed.
Wasn't quite as bad as the PCCharge password system. PCC required 5 different passwords to rotate once a month, so we had a 'hardcoded' prefix and then 0001, 0002, etc added at the end LOL.
The old days were a lot different lol.
It’s the highly specialized systems that are constantly being used by non technical employees that are at greatest risk of having a passcode full access back door… when a company is paying for unique software/hardware systems to be built, one horrible mid level managers demands, and attitude, can quickly lead to angry phone calls to the technical staff, and demands from higher up from either company demanding a solution to their own incompetence, damn the security consequences!
See how quick a back door is created when you have technicians constantly degraded by a terrible mid level manger in charge of a highly technical project while being a massive Luddite. There is nothing more unpleasant to a tech, than the absurd and ignorant wrath of a narcissistic mid level manager at a company paying for your unique software/hardware that demands you fix ever problem they have. You show them at least once a day how to use some software/hardware, yet still manage to be yelled at about something not working, and it must be fixed immediately….Cue unplugged power cord, Capslock left on… etc…
Yeah those business to business projects, where highly specialized unique hardware/software system solutions are being managed by morons… Yeah those systems all have back doors… No technical employee on a project like that would survive a single day without a back door to the system they are working on… Too many employees making decisions with zero technical skills or understanding of security. Those employees and managers just want to hit deadlines. They couldn’t careless about security, anyways that’s not their problem anyways, so why would they care…
Ugh mid level managers do way more harm than good from my experience… I swear mid level, sales, marketing, and other bloated departments within many business spend more time preventing real quality work being done, along with crippling products, cutting costs in horrible areas, etc…
And internal marketing departments…
OMG I have seen hell, and it’s the inside of a mid sized business with an internal marketing department run by the owners nephew who just got their masters in “guerrilla marketing” with zero work experience…
I mean the guy’s only work experience was handing out red bull from a Mini Cooper that was “getting a giant red bull can suppository up its trunk…”Yeah that man was destroying his uncles business from the inside, it was so funny because of its stunning absurdity… I couldn’t believe how competent employees just went along with his nonsense! I pulled one employees I respected aside, and said “really?!” And she just turned to me and said “Afraid so… But at least I will see you on Tuesday for that Voice Over session!”
I stopped for a moment and realized she meant the session for another company, and already had a job at that fantastic company I was also doing work for, and she would now be leading the Voice Over session… I’m so glad she got out of there ASAP. The best employees are always looking for work opportunities for exactly this issue. If you have options to leave a job at any point for another one, you won’t become a slave to any one company!
@@letthetunesflow Ah, the joys of working for users who think "123456" is an acceptable business password, and give everyone their banking PIN because they can't even be arsed to do it themselves.
is there ADS where they even wanted them i mean coded, but still there. is there backdoors even they did not make them
It’s amazing how much of this flys right over my head, but for what ever reason I find it fascinating and watch the whole thing. Looking forward to the NSA episode
In summary, backdoors when Dave was working at Microsoft were VERY unlikely due to seasoned professionals having full responsibility for, and reviewing all code changes in their department at all times. If someone tried to put a backdoor in, it would be spotted by the many code checking processes and you would be reamed for it.
@@arnox4554 But only backdoors unwanted by Microsoft. NSA wouldn't try to sneak backdoors under M's nose, they don't need to. They surely had access to Microsoft's highest levels of command who in turn made the NSA guys work directly with the people checking the code, and since the "masters of the kernel" were just a few people, it's way less likely that the backdoors would ever leak.
It is so ironic that this guy bashed on linux calling it insecure, right after a 0 click 0 day rce on Microsoft Office, not to mention the tons of exploits used "in the wild", privilege escalations which haven't been patched for a few years now LOL
Backdoors in the form of bugs are harder to spot. Also, need to mention “Nothing Up My Sleeve” (NUMS) principle for crypto parameters brought up by Microsoft - especially after the NSA/NIST DualEC DRBG debacle.
Has there been an update if the rumors are true? Is this even still used?
9:15 Why GNU/Linux is the most used os on planet(s) if it's that insecure?
Since when 2% of the marketshare is the 'most used'?
@@IkarusKommt Only looking at consumer space
I just think they're neat ~~ Marge Simpson.
@@Masaliantiikeri In server space? Because it is free and can run primitive server applications like webservers and databases.
6:00 It actually makes more sense to have the source code accessible to all workers but limit who can modify which parts. That way any newly introduced back door would have to be visible to everybody but random employees couldn't modify any given file to introduce a new back door.
The git model is to have somebody taking care of the whole repo and he or she is not writing code but checking and accepting code made by other people. Linux works mostly this way with Linus Torvalds very rarely writing any code nowadays. And Linux develops too fast for even Linus to properly go through all the changes by himself. Instead he trusts a group of other people where each member will take similar responsibility for a given subsystem.
Update: I see you used word "ownership" for this later in the video, I think it's perfect.
Do you need backdoors where all windows are wide open? I guess not :-)
The binary blobs are deployed onto the chips though and those chips are connected over USB or are behind an IOMMU making the system access of the closed source firmware controlled by the FOSS kernel. So yes, most modern Linux distros do contain proprietary binary blobs but said blobs do not run in kernel land and only have unrestricted access to the individual device they are running on.
A very good point. However some drivers that run inside the main system's kernel are also binary blobs - the most common being NVIDIA's graphics drivers. After the recent leak of all of NVIDIA's source code, NVIDIA announced they will be making their driver open source - so there is hope.
A micro-kernel would be a better way to prevent unwanted escalation of bad drivers. That would make each driver effectively work like they were running on a separate computer.
@@markmuir7338 I wasn't referring to proprietary drivers. I understand those exist however the vast majority of Linux drivers are FOSS. My point was to refute Dave's comments about most distros not being fully open when the reality is as long as you avoid certain companies HW that's not quite the case. Having a fully open Linux system is basically just a matter of getting an AMD card as I don't know of much other mainstream HW that requires proprietary kernel code
The other point Dave made about the "many eyes" thing was actually tested by University of Minnesota. They made a number vulnerable Linux Kernel commits that weren't immediately picked up by anyone else. University of Minnesota got banned from making further contributions.
@@blkspade23 yes I'm aware of that but they did still get noticed eventually. I really wasn't trying to argue about that though as that's debatable as he pointed out. I just didn't like him taking shots at the firmware because it's not quite fair
@@Scoopta If his point was that "there will be code that you don't have access to that runs with unrestricted access" then it doesn't matter if "it only runs on the system that installs it", especially if that code is required for something to run, since you can't get around it. He also seemed to be using that as a way to point out "just use Linux which is open source" or "just use open source OS" aren't the end-all-be-all answers some people make them out to be.
Its not about someone sneaking a backdoor in to windoes, its about Microsoft purposely putting it there.
As an avid Linux user I am, of course, aware that I dont use 100% open source software, even on Kernel level. I am not happy about that and I will always favor open source solutions, if viable.
BTW you could also call the recent ms office rce that doesn't even use Macros a Backdoor. Or the fact that the msdt service has a buffer overflow preventing a Security check. Or that msdt is not disabled per registry by default..
CVE-2022-30190
A thing that is also kind of left out is that the source being open encourage curiosity and learning; thus having more domain experts. It is a particular skill set and for Windows it can only really start when (if) Microsoft hires or wants to expand their team.
Tho Dave has point in that there are many places were an integrity check is just a "trust me bro" and that does not inspire a high level of confidence.
@@KeithBoehler This has changed quite a lot. Microsoft has long had a great reputation of providing good documentation on how their stuff works, but the thing that kept people from learning it was that Visual Studio cost in excess of $500 for a license to use it. Now you can do everything you need to be able to learn their systems using a free license of Visual Studio Code. Although I'll admit that their documentation has gone down the toilet since the good old days of TechNet subscriptions and getting quarterly bundles of CDs/DVDs with all the latest updates. Now there's a lot more information out there, but of varying quality, so finding the good stuff does take more effort, but it's still a lot more freely available than it ever was before and is completely competitive with open source stuff.
Unless you want to look at or learn kernel-level stuff. You aren't getting access to a Windows kernel's source code anytime soon, so if you want to learn about schedulers and that kind of deep level esoterica, open source is still king by a wide margin.
And while I think you're right about open source being a good thing for learning, I've known hundreds of Linux people in my lifetime, but I've only known 1 of those who ever used that access to become any kind of domain expert on anything with it. The rest either become users or zealots in some kind of operating system-based religious war, and they know as little about their chosen OS as most religious zealots know about their chosen religions. But even in spite of that, I think open source is a great thing and provides tremendous value to humanity - or at least to those wise enough to make use of it.
@@babybirdhome atheist detected.
Opinion rejected
You spent a lot of time on back doors that people try to sneak past the devs. You spent no time takling about back doors that are put there by the devs at the behest of the government and their various intelligence agencies.
In 2007, I heard of a special windows project that the NSA asked microsoft to do. I enquired up to the VP level what this was all about and got no responses.
Soon after that, I asked my boss and his boss for two months off w/o pay so I could take my family on one last trip to Europe before my son left the nest. (I had been there for 20 years) Both bosses were fine with the request but HR wouldn't let me go and I ended up quiting. My exit interview with HR was a no-show and I have always wondered if HR's stance against me was caused by my inquiries into the mysterious NSA project for windows.
You can pretty much assume that every government has full access to any computer, not necessarily through backdoors, but just up-to-date information on exploits. They probably know every one and have programs constantly updated to automatically apply these to the target machine.
Sounds more like HR people being HR people rather than some grand conspiracy against you.
Nah, they just saw an opportunity to let go a senior employee that could be partially replaced by a younger underpaid graduate, saving a huge severance package by forcing you to quit.
HR people are garbage
1. No such thing as a conspiracy theory.
2. I Am a liar 🤥
3. Number 2 is false.
4. A conspiracy is a Felony in a Criminal Court.
5. 3 protocol changes took place
6. Learn to speak 🗣️ Octal
7. All your bases are belong to US
8. XaaS and you don’t even know it!
9. The Rights of the individual are only protected, as long as they don’t conflict with the state.
10. Rinse and Repeat 🔁 until 2035, you silly 🙃 flesh bags 💼 filled with mostly water.
11. See Number Three. ❤
12. The moral of the story to “The Boy Who Cried Wolf” is 2 never tell the same lie twice.
14. What are you expecting? Number 13? 😂
There's no way HR would be told about an NSA conspiracy.
Thanks for making this video. Interesting to hear about.
In college my COBOL instructor (yeah, I'm old) gave us some coding rules, some were just syntax based, some were just good coding practice. One in particular was "Always give your variables meaningful names, tell the next programmer what it's for, and only use it for that. Do NOT call it something stupid like ZDPQ." COBOL background: every field has to have a name, but if you're never going to reference that field individually, say it's a subfield like a short part of a long header line, you can call it FILLER. Programs often have dozens to hundreds of FILLER lines. Out first coding assignment was to punch in (yeah, punch cards, I'm old) a program he gave us on a handout, and get it to compile then run it. Had some FILLER lines in it. On a whim I changed one of them from FILLER to ZDPQ. Did the assignment and turned it in. Came back with the change circled but no points off. Ended up doing that for all the assignments, and always circled.
I carried this habit into my career. Nearly 30 years of COBOL programming, every program I wrote or touched has a ZDPQ in it somewhere. First time the reviewer asked and I said it was just a joke and explained it. He thought it was funny and OK'd it. And that's the last time anyone ever mentioned it to me. I have no doubt that many of my programs are still in production.
So YOU'RE the reason that iron smelting plant in the Philippines shut down a month before Y2K - ha!
Yes you are old, so am i ;). Even tho i learned COBOL on the street so to say. COBOL was actually a great language. Simple and easy to learn. And meaningful names for variables were a must, if you still wanted to read and understand the code 6 months after you created the code. And yes, your code might still run somewhere. It wonders me how many banking systems exist, still running on old mainframes and still running COBOL and programs 30 odd years old.
That's a funny story. I'm old, too, with over 35 years as a COBOL programmer, both batch & CICS, I too started in the punch card days. Remember setting up the punch machine to automatically punch sequence numbers, in case you dropped your deck? Plus, use a black magic marker and make a diaganol stripe on the edge of the deck? It saved my butt, one time.
@@kg4wrq Funny how learning CICS coding set me up well to learn to program under Windows. Check your inbox (or get your message), do what they ask, wait for next message.
@Thomas Fischer I had a COBOL course but then migrated to SAS, SQL, etc.
.
I should have stuck with COBOL. It's quite lucrative I hear.
Wow, the idea with encoding a kind of a signature within the whitespace is brilliant. If there's no tool for it, I will make it ;)
In light of all the review processing you described in this video I'm very interested in a more detailed discussion of how you went about the 1,000,000 lines of code commit that you once made.
As long as it is closed source, it is backdoored and the amount of malware that can easily target it, I won't change my mind.
Backdoors do not need to be inserted in the development arena,
but rather in the manufacturing process.
I'd also suggest you read a paper by Ken Thompson, 'On Trusting Trust".
In this case the hack was in the compiler binary,
not the compiler source or the login source.
But Microsoft wrote the compiler. It would (or should) have the same scrutiny as the kernel because it's used to develop everything else. One of the first things you do when writing a compiler is to compile the compiler on itself. It would be tremendously difficult to get a back door through that process.
@@babybirdhome And as the Ken Thompson paper points out, you are running a compiler that you did NOT create. The source may be clean, but the compiler itself can be tainted. In this day and age even the silicon may be tainted. Turtles all the way down.
@@Norman_Fleming Yeah Ken was technically correct (the best kind of correct) but somewhat paranoid in how far he took it. He wasn't wrong, but in real life things just tend to work (more or less). There probably are spies infesting the fabric of every society, but they leave things as they were afterwards, so you don't notice that they're there.
Not saying that's a good thing, in fact it's terrible. Just that it's easy to live with it.
@@Norman_Fleming these shills in the comments pretending they don't know lol
@@Norman_Fleming Three words: Intel Management Engine.
Maybe the screen could be considered a back door, but my Windows don't have doors at all..
Y'all must have them fancy Windows..
What about introducing an intentional, subtle bug? a bug such as the well known eternalblue smb bug that was present in windows? it's tricky, but couldn't you sneak a subtle edge condition past your code reviewers, given the right motivation and position?
That was my thought. There have been plenty of exploits found over the years. How can we be sure that they were really all mistakes?
If there would be OS without any bugs, we would all use it 😂
Occam's razor - because errors are far more likely than someone that smart and capable.
This is where peer review should prevent such things. But this is true for any OS. Apple had a bug, where they did not validate SSL certificates correctly. It somehow got committed and was in the source tree for years. If this was a malicious act or just negligence, I don't know. The only way to prevent things like this is to perform peer review.
@@1971merlin Yet, statistically over the years it is also plausable that 1 was inserted by someone intentionally.
The amount of money up for grabs, just from major world powers makes it pretty plausible that someone would take the job. And that doesn't consider the possibility of state sponsered espionage. It does seem more likely that espionage would wish for the source code to look for 0 day exploits.
is there any chance you've ever considered making a video on symbols and what they do? i heard you mention them when talking about building windows, and i remember running into issues with symbols when i was trying to find something that was causing my laptop to crash. it would be super cool to hear what they do since i have a hard time finding information on them!
Symbols are files (extension: .pdb) which tell a debugger details about the spurces used to create a binary. Microsoft distributes Windows symbols freely - search the web for "Microsoft Public Symbol Server". Note that these are public symbols, meaning thet only contain function and param names, and stripped of spurce code location or loval var info
@@jonathanbarner121 that helps a lot thank you so much!!!
All of this is great and all, but how do we know that what you're saying is true without access to the source code? How can we trust that what Microsoft says is running on PCs all over the world is what is actually running on them? There's a simple answer- we can't and won't ever know. That is why I use Linux, at least I know (most) of what is running on my system as opposed to none of it. (And for the basically unlimited freedom, but that's unrelated)
I agree with you, that open source != inherently secure. But the more eyes can scan code the higher the chance of catching some thing is objectively true, the saying “there’s always some one better than you” basically applies. If no one checks it than it doesn’t have any benefit of being open source, yes and in my opinion the Linux Kernel does have too much bloat in it, unknown DRM, unknown closed source blobs.. whereas at least the Kernel should be 100% open source imo.
Maybe the OS doesn't, but that only speaks for the software. Hardware back doors are a much deeper meta.
I was looking for this comment. How much do you trust Intel, AMD, ARM, NVidia, etc.?
@@skilz8098 ...
In truth, it goes down to the base manufacturers like DELL.
@@AmyraCarter Maybe, but I don't buy pre manufactured PCs, I usually build my own without any of their bloatware and proprietary configurations and setups.
I honestly don't think Microsoft would have a backdoor in their OS for themselves as that could lead to many legal ramifications. This isn't to say that they have not put any in their under the order of governments...
Now as for hardware such as your CPUs, motherboards and chipsets with the pre installed firmware... there is no way of really knowing unless either A, you had the full spec sheets with ALL of the instruction sets and functionality of the hardware or B, you were able to fully reverse engineer it yourself.
Take antivirus software programs for example... who benefits the most from those who write computer viruses? Those who write them or the those who sell software to protect against them? I'm not saying that this is always the case, but I wouldn't put it past some corporations to privately (off the record) hire people to write and design some of the computer viruses out there just so they can market and sell their products.
At the end of the day the best we can do is hope for the best while expecting the worst case scenarios. We can not always assume that they have our best interests at heart!
@@skilz8098 ...
Yes, I would build my own if...
1) I knew enough about it
2) I wasn't on a fixed and limited income.
@@AmyraCarter As for #1, you have to read especially the spec sheets, compatibility lists, and requirements for specific hardware. Also, having the schematic or diagram for the mainboard is a plus. Knowing is a combination of research and hands on.
As for the fixed income I can understand that as I have a tight budget too. However, if I'm looking to acquire a new system, I'll start to put money away and save it just for that purpose.
A barebones for about $400 - $600, not really worth it unless your own purpose of use is simple browsing, text editing and basic printing.
You can build a custom mid-grade gaming pc for between $800 - $1,200 and is good for mild gaming. This is the average price range for a decent bang for your buck, but still lacks in overall capabilities.
A mid to semi high end for about $1,200 - $2,800 will handle 95% of all current games with high graphics decently. These are the target pc builds that most people would generally be happy with as the tradeoff for cost and performance is fairly balanced.
A fairly high end but not quite top of tier system might be around $3,000 - $5,000. These systems will handle all games without question and future games for a few years to come. They can also serve as a workstation such as 3D Modeling, Photo & Video Editing, Content Creation - Live Streaming, Software Developing Systems, Mild to Moderate Simulation Systems, etc... These are a bit pricey, however if you're looking to invest to do a fair amount of work both effectively and efficiently while being able to multitask with computationally and resource intensive applications such as running Visual Studio, Unity or Unreal, Photoshop, and several other applications simultaneously it can be worth the investment.
Also the integrity of the hardware at this level is much better. For example a recommended power supply might be an 850W - 1200W Gold Rated or higher unit. These can run about $120 - $300 compared to a basic 450W - 700W low end power supply that costs about $30 - $50. The difference between the two isn't just the wattage and price difference, it's also the warranty and integrity of its internal parts. The higher end system can have a 7-10 year warranty while the lower ones can have a 1-3 year warranty and maybe 5 if you're lucky. They use cheaper capacitors in the lower ones.
Top of the line tiers can run from about $5,000 - $10,000. Typically these are the highest tier components across the board with multiple GPUs, high end cooling systems, maxed ram, plenty of storage on the order of 12-50 TB and these are typically out of most people's price ranges... These are more like enthusiasts, system builders who want to show off ect. Anything beyond these would be high end server racks or server farms or modern supercomputers.
I fully understand, I don't have the money and I'm looking to build a new system. I'm looking in the $2,800 - $4,200 range depending on which CPU - GPU combo I decide to go with and which type of RAM. I can probably save about $400 for sticking with DDR4 Ram or invest now and get the DDR5. I was thinking of getting an NVidia RTX 3080 Ti but from what I've been seeing, in the next couple of months, not just NVidia and Radeon(AMD) but also Intel and AMD are about to release their new lines of CPUs and GPUs and as I understand, Intel might even be entering into the fray with their own GPU.
The bottom line is, it depends on your needs for what kind of system you should invest in regardless of the cost. Even if you're on a fixed income but if you have good credit, you could always take out a single credit card just to purchase it, and then make the monthly payments. Then again, adding an addition $20 - 50 / month right now can make or break someone, especially with the ridiculous fuel prices.
There was early windows 7? I think god mode which was awesome once it became known. I am not sure if it counts as a backdoor or leftover debug or an easter egg.
Windows doesn’t need a backdoor there’s a built in backdoor through intels management engine that can literally do whatever it wants even if the machine is still powered off. You see, we’ve been screwed since day -11 Do what idid, give up.
Get a pen and paper. Cover all cameras. Job is done. Respect the people disrespecting you and others just as much, when pen and paper is not good enough ofc. It is hard to make mics quite unless you go in and cut them out by hard. Anything you do on any device is visible if someone or something cares enough to look into what you do with your private devices and data. So better buy 10 stacks to write stuff on and pens to last you. Since with cameras gone they need to get physically into your place and look at the stacks of data on paper media. :)
It is really scary to see what is just open to the users to do with modern phones. Scan data really clearly with just the camera. Talk into the mic and it knows exactly what you say etc etc. You really can just blank them off to win, but still without destroying the mic your out of luck trying to stop it listening in on your talking with loved ones.
Best is to make a device that can be 100% trusted to write data on and off never online connected storage devices. That being shield it from anyone but you having access to it. 1TB of text files and images what not is allot. Hopefully keeping physical copies too just in case. And fits more or less anywhere making it impossible to physically find the hidden data you keep at a secret place! But papers and pens without cameras is totally the safest way to store text and possibly also images. No firewall needed for that feat! Ha! Just bulky and harder to keep from home intruders to get access to. But ho is really going to go into your home for your ketchup preference??? O I know they have no remorse doing that to your computer or just tracking you other ways since screw privacy or decency.
Problem is trying to hide video from screwed -11 days. But what video files do one really care to hide away. Easy to find more movies and stuff if it is lost. But when having to pick up the pen agen just due to -11 day screwed is just a sad display of todays world.
Cut the mic? just open the device and remove the cable(s).
Dave, I love your videos. But do you think you could please practice talking more slowly (like, say... about 75% of your current speed) to make it easier for us to understand you?
What about Intel management engine?
What's that got to do with windows lol!
What about it?
RISCV is our only hope bro.
@@bravefastrabbit770 RISC-V is only a standard.
Processor manufacturers can (and will) backdoor them too.
Regardless if it's NSA, CCP, MOSSAD or some other secret organization, your machine is likely compromised.
@@install_gentoo Given that it's an open standard we will be faced with options rather than highly privileged proprietary firmware blobs (black boxes) necessary to even run the thing. That's the beauty of the beast.
Now whether the overwhelming majority of them will be compromised or not, I definitely agree that they will. But at least we will have alternatives. Until then, there are a handful of options out there. Such as the ones from System76 & Purism, on top of the better (but more expensive alternative) raptorcs for desktops which promises to have removed all blobs with their OpenPOWER, a "fully libre firmware and hardware solution".
@@install_gentoo There are also open source implementatins of the RISC-V standard, So we can make use of those and audit them if we want to.
I don’t want to insult anybody but the day Windows dies, will be a good day. Windows is like a demented 95 year old. The fact that they charge for a product with non removable malware, adware and spyware is not even taken into account in that.
I really don't know much, but doesn't Linux has some specific experts or "owners" of sort who have to autorize pushs on repo?
If yes, than Linux code is also reviewed by the right prepared people.
I explain that... some is, but a surprisingly low percentage, at least in the timeframe we're comparing.
@@DavesGarage Makes sense, maybe the actual Linux team working closely and looking at it is smaller then Microsoft team looking at Windows. Thanks for the response.
@@ShuAbLe He's lying. There are more people who contribute and look at Linux code than the Windows kernel, including Microsoft whose major revenue comes from selling Linux VPS.
Sure we can't look everywhere but it's still far more secure than Windows, where you're at the mercy of Microsoft prioritizing vulnerability fixes. The average time taken to patch Linux is a lot shorter than Windows. Sometimes Microsoft can take even months to fix a vulnerability while on Linux, it can be a next day update.
@@yoman9446 yeah thats why it took 20 years to find linux bugs😂
bugs are not vulnerabilities. Microsoft word has a zero day exploit that microsoft has known for months yet they refuse to fix it. good luck shilling, shill.
As a Linux user I 100% agree with your criticism of open source and of the mentality a lot of foss advocates have. Foss can be more secure if the right people actually audit the code, but it's not inherently more secure because people anyone can audit the code. But alas, this is something a significant percentage of the foss community just refuses to acknowledge.
I don't know if it was last year or in 2020 that an 8 year old exploit was found in the Linux Kernel. There are a lot of competent people working on it, and this wasn't found in a propriatry blob, but, despite the code being there, it took 8 years before someone had a look at it and realized how it could be abused. I think there was another 7 years old vulnerability found a few years prior two.
Also, as a linux user, I'd like to apologize for any and all misguided hate you might receive as a result of your comments on the topic from any of my fellow linux using nerds.
I agree, free software is not free of backdoors, thousands of volunteer programmers around the world can introduce backdoors in the software between millions of lines of code.
Many eyes looking at the source code to protect software security and many more looking at how to break security and introduce malware.
@@franciscojavier6003 I've had the discussion more times than I care to count but most foss advocates just don't want to admit that code need to be audited by a trusted third party for one to be able to claim it's secure. Most foss advocates really do believe that just because more people can view open source code that makes it more secure by definition.
I was there during win2k development, and recall full federal reviews of the code looking for any undocumented features. That was also when the “no more Easter eggs” mandate came down. Which makes me think if there had been back doors we eliminated them at that time.
Datamation magazine claimed in 97 or 98 the remote support system in 3.11, 95, and NT allowed admin access given the correct hash, a hash based upon processor model, processor id (if present), ram installed, and number and sizes of drives. whether correct or not, the federal agency I then worked for blocked all in/out on the remote support logical network port used.
You know damn well that's not what people are worried about
"Which makes me think if there had been back doors we eliminated them at that time."
Is it possible that people often say to you that you are naive?
@@WilliamHostman that would have been just prior to the review, hence the strict requirement which came down that there be no code not called for in the specifications. (Hence why even innocent Easter egg code had to go, because the Easter eggs prior to that time were never in the product spec.) there was a very serious review of all the code.
@@thomasjefferson4195 ACtually, that's what I'm worried about.
If some malicious hacker got past all the security features of MS, then they could easily close it later and they'd definitely tell us all about it.
But if THEY put one in, then it would be on everyone else to find it and make enough noise for people to notice, because obviously MS wouldn't tell us.
As far as I know (correct me if I'm wrong), modern versions of Windows periodically send screenshots to Microsoft as part of something like a "user experience improvement program", or, more simply, telemetry. Are these images reviewed as carefully as the source code of the Windows components?))
Security is like Quantum Mechanics, the more you know the more clearly you can see that you can not see clearly enough. I don't think many real professionals claim that open source is anything more than the title suggests. A maintained open source product can be more secure than a non maintained proprietary product, but the opposite is also true. The difference between open and closed source is that I could take a ten year old open source project and try and try and make it secure or functional today. I can be pretty sure that a copy of Windows XP will not cut it for an Internet connected machine today and nobody outside of Microsoft could do anything meaningful to change that. If a project still has use then an open source project can be updated by an interested party whereas a closed source project dies when support ends.
Sure, but *Microsoft* could update XP to be secure far faster than the public could update a 10-year-old sku of Linux, because they're had to start from scratch, with no knowledge of whats in there.
And being "updated by a third party" is only a good thing if those changes are proper, high quality, and benign. I just think we have less assurance of that under Linux.
As for me, I run Ubuntu WSL2 under Windows, so I'm screwed no matter what! They'll get me one way or the other.
@@DavesGarage " so I'm screwed no matter what!" ... Indeed, that is the main reason why I wear the tin foil hat and trust no one ! Looking forward to your NSA key video ... assuming "they" don't get to you first :-)
@@jonshouse1 they already got him, what you see in this video is high quality CGA/CGI :D
P.S. I'm wearing a stainless steel bowl i mean hat so I'm more protected... :P
re: "I can pretty sure that a copy of Windows XP will not cut it for an Internet connected machine today"
And, you would be so wrong. Internet-connected Xp box is writing this comment. Maybe you are unaware of how DSL and cable modems incorporate firewalls for instance. That would explain a lot of your naivety.
@@DavesGarage Microsoft *could,* but they won't. That, I think, is the main advantage of OSS. Why would MS spend resources writing fixes for a legacy product that, if it were made secure and had sufficient driver support, could be a perfectly valid alternative -- even today -- to spending money on new versions?
This is the thing I don't like about commercial software at all. You don't get a say in its destiny. I think Windows' UI peaked in XP, but Win 7 had some advantages, and either could be argued as the better one. Since then, there isn't really anything in the UI that has gotten better, and lots has gotten worse.
OTOH, security, Bluetooth, high-DPI monitors, USB 3.0, Thunderbolt, a decent 64-bit kernel... None of those things are visible on the exterior, but they matter a lot. Would be nice if you had any choice whether you liked the look/feel of 2000, XP, 7, 8, 10, 11, or 3.0 for that matter, but could run any release targeted for a 386 up to a Threadripper.
At least, if it was all OSS, and the community (or even one person) wanted it bad enough, that could've been the case. Given how many unofficial service packs, USB fixes, driver ports, and other things exist for the retro Windows community, they want it bad enough that that could've happened.
Maybe not a back door but certainly key ways, Task Manager and even the dev spy version both can easily be manipulated via dll calls to remove and hide processes. Why on earth would you ever make that a feature? Please why was that possible to call externally? hehe I even wrote a little program in VB called MS Hell to show how easy it was, can't remember what site source sharing site of the day I shared it on but its seems to be long gone. Urgh made so many apps like backoffice possible, and I just can't see a good reason why it was a feature that could be used externally.
5:00 -- my cousin once got thrown out of a public pool for peeing in it.
My aunt had to go and pick him up and angrily told them, "ALL kids pee in the pool!"
They said, "well sure, but most of them don't do it from the diving board."
I once stumbled across what could be a back door into a telco inventory database (not customer data) I tended to assume it to be a bug rather than an actual backdoor, although the resulting command line access to the SQL server needed skills I never learned.
Yes one could really ruin the database, but I think that was the limit to it. My main interest was seeing how many revisions the software went through before it was corrected/changed, but I then was kind of let go, and I forgot all about it.
Yes I could have reported it, however how to do so was so obscure it wasn't funny. and then I was 'severely side-shifted', and this was then the last thing on my mind.
At least I didn't crack it like one poor sole did, who quietly left his managers office after getting the 'bad news', walked into the server room, pulled the main sever then dumped it down the back stairwell - well that's how the story goes, truth unknown, just sounds good.
Hey Dave, many (MOST)of the accusations about Windows having one or more back doors are not about some rogue employee... maliciously putting one in, but rather Microsoft officially having a way into users computers to sift through their files, gather data of any and all kinds at will! So a whole different scenario! In reading the EULA for Windows 10, it was very apparent that they did, and were telling you they do, can and will use it, and not just on the device with the Windows OS, but "And all connected devices"! I am speaking of the EULA, and it's wording (Their own words, no interpretation needed!). So maybe we should call that a side door then, or a skeleton key to the whole facility....
I can't say any more than what I have heard beyond that, because I ditched Windows just as Win 10 was being forced on people for Linux. It was not just for security and privacy, but also a financial decision, and well principals: If Microsoft (and unnamed partners) want that much power over users data, how they can and cannot use their devices... then saying "F the whole lot of them" is perfectly justified, and more should do so too, and tell M$ and others to stick it where the sun don't shine, and with it change the odds they will keep up the shenanigans in lieu of the loss they face by doing so!
Stab me once, shame on you! Run into your knife repeatedly, and provide the sharpening stones: Well Duh hey, and WTF Man?!?!?! (
I remember going off the deep end when I first read the windows 10 EULA for that very reason. I think it goes way further than a backdoor to being all out access to your machine from theirs.
He knows all of that, he was paid to make a misdirection video
@@thomasjefferson4195 Prove it!
@@Bob-of-Zoid you can literal just goggle project prism, look into NSA enforced backdoors.
People that DONT work for microsoft know its history but this dude worked there and pretends to have mo clue about NSA nonsense thats already been proven.
You're so naiive it's painful
@@thomasjefferson4195 I didn't ask you to try to convince me of your belief, but to actually prove your claim! You are the naive one: Look up the word, then look up "Epistemology".
LOL, "boss in DOS"!
I understand that any person can't insert backdoor, but what about official Microsoft backdoor?
Or just patch the final binary you ship, no need for backdoor in the source. Or just put an extra master key/binary blob to the distribution config. It's much more easy to hide than commit it to the sources.
Too many people would need to be in on the conspiracy. If you tell a secret to two people it's no longer a secret
@@Luther7718 so you know everything the secret service doing? or the nsa? right, you don't. why? same reason why the windows source code not leaked already or anything similarly big. if you messing with national security level stuff you pretty much end up in Guantanamo without even a trial. look, if they spice the binary with a backdoor, it wont be the average Joe from accounting. but much higher up. or maybe Microsoft doesn't even know they are compromised by some 3 letter agency. :D
Hands down, this is the most interesting channel on RUclips.
long time linux user- currently on a LFS build with a custom rolled libre kernel- no binary blobs here- but I am a huge minority in the community. you are right about that. also rolled my own window manager. Big fan of the channel despite not being a big fan of Microsoft :)
Did you fork dwm or start from scratch?
Haha, what about the smart-ass kid who would actually _try_ that and wait around eagerly to watch for the "color change" and then say, "Ha!" because the purple never showed up?
And why not just say "yellow" since that would be natural?
I genuinely love when you tell stories like this. I have always been fascinated with the how and why things work, to the point that some of the first places I went after I got a modem (2400 baud, in 1998 - painful but usable) were 2600 and Phrack. I may never need to know what I've learned, but having the knowledge is very comforting to me. I will admit to shoulder-surfing my third grade teacher (Sorry, Mrs. Burr...) and learning the password to her Mac - it was APPLE. But I spent many an afternoon on the Oregon Trail because of it.
Isn't Backdoors more likely to be made into hardware and not software?
up until windows 7 there were multiple ways to bypass the login and get full admin.
so there are no intentional backdoors, but many holes.
One of the best was
MSN Messenger.
I backdoored my own windows 10 system because my pin wouldn't be recognized after an update, and I couldn't remember my password, which I only ever used a few times. At that time I had no coding experience, and still managed to get full admin privileges, I considered switching to mac due to glaring security concerns, but eventually I ended up on arch linux, because I'm not rich enough to afford a good mac, and I don't want to deal with the unreliability of hackentoshing. The AUR has locked me here forever.
@@accountid9681 literally just encrypt your hard drive and that wouldn't be possible anymore.
@@accountid9681 Your pfp hurts my brain
@@accountid9681 Can you explain how you "back doored" your Windows? To my knowledge, this is not possible, unless you have low level access to the hardware.
@@todortodorov940 I booted into recovery mode, and tampered with the filesystem to remap the visually impaired helper/reader button to open an admin terminal, then I used the admin terminal to change my password, and logged in. Pretty sure it's been patched, this was in august of 2021.
Yes please on the NSAKey episode! Love your videos Dave!
As always, love your videos, just want to ask you something @Dave's Garage, what is the chance of any operating system from microsoft has "Institutionalized" back doors.? Not backdoors from users, but any been setup as a company wise "policy" (even if kinda of secret)
They don't need any since they have Windows Update.
Backdoor does not have to be in the Windows source. Maybe the build tools insert the backdoor. Did you build the build tools from source?
Windows XP had a big and fairly well known back door. I think it might have been closed in one of the service packs; I know for sure it was gone in Windows 7. The was the "at" command (command line interface to the task scheduler). It could be run as a regular user, but processes started by it ran under the SYSTEM account. You could open a command prompt, type "at cmd", with being, e.g., current time plus one minute, and at the scheduled time, a new command prompt window would pop up, running as SYSTEM. From that you could start a task manager running as SYSTEM, kill explorer.exe and start a new one running as SYSTEM and you could do anything an administrator could do. Later Windows versions allow only administrators to run "at".
Thank you for answering the question without a 17 minute video!
could not it be a bug instead of abackdoor? cause a backdoor its something did 100% intentional.
Dave knows he mispronounced Trisquel, but nobody pointed out the fact that Guix is pronounced like the word 'geeks'
Maybe in the XP/2003 era (heck even the win7 if you stretch it a bit more), windows was quite "secure". Todays win10 and up do have a backdoor. It's called windows update.
Windows update in the actuality can install driver level stuff, and even bios "updates" (the new "capsule" function include under the new UEFI releases) without any question and without any type of privilege escalation since wupdate runs under the system user.
Who needs backdoors when you got Windows? :P
Adding whitespace can be dangerous.
Try a cmd line file with del /temp_folder/*.* with a space at the end.
The company I was working at many years ago lost 2 servers as the extra space deleted the whole C drive until Windows fell over.
lol,all the stuff that is running on a lower abstraction level than the OS, the bios on steroids ("Lights Out Management"), is all you need for backdoors..
Microsoft has an obvious sort of backdoor into every Windows machine, in the form of Windows Update, which, on modern versions of Windows, is very difficult to disable and also most people would not want to disable it since having a not up to date system is a lot riskier, but still, suppose someone managed to gain access to the update servers, or suppose Microsoft was forced by a government agency, virtually all Windows machines connected to the Internet could be accessed.
The Flame malware used the Windows Update system as a backdoor so you're exactly right.
@@Leo-sd3jt But the fact that they managed to sign the package in a way that made Windows Update accept it as a valid update package makes it a (serious) vulnerability in that case.
@@d-tech3190 why the "but"?
Back in the NT4 days I would regularly turn up at customer sites to install/upgrade applications only to discover the IT dept had not granted the required privileges. My usual strategy was to open a command prompt, enter "at [now+1 minute] /interactive explorer.exe". One minute later Windows explorer would pop up running under the system account. Everything executed from it also retained that privilege so the server was wide open.
That's not a backdoor, it's a security vulnerability. The difference is whether it was intentionally left by the developer or a bug/oversight. In that specific case I'm pretty sure it was the latter.
The Konami Code is probably my favorite classic example of a back door if you could call it that. It was originally intended for development purposes, but accidentally left in all the way to production.
I'd say it's usually left in on purpose. You get to a point where everything is running and it's as good as it's going to get and you're simply afraid to touch the code anymore lest you wreck something. Even putting NOPs over real code can mess up anything dependant on CPU timing.
I wouldn't call it a backdoor since it was a single player game and you'd only be cheating yourself. Not every undocumented feature is a backdoor, otherwise you could claim that most software has backdoors due to unremoved debug features, easter eggs etc. Backdoor are by definition features that allow you to risk or cause damage to others.
@@d-tech3190 And here I thought they were a method of gaining unrestricted access without a trace...
This video presents a very narrow example of how you can create a backdoor. Underhanded C Contest entries provide plenty of examples of how one can disguise backdoors as legitimate mistakes
Windows update can command all machines to download and execute an update, right? That is a backdoor, let's hope only Microsoft has the private keys to use it.
"hope", when it comes to corporations, is a dangerous thing
That's not a backdoor.
@@eadweard. If someone can cause your machine to run anything they wish, with full privileges, without your knowledge, without your credentials, it's a backdoor.
@@douggale5962 It sounds more like an update mechanism. I think a backdoor is supposed to be something malicious and hidden, and intended to allow an attacker access.
@@eadweard. It is specifically designed to allow Microsoft to force updates onto your machine, whether you like it or not. Is that malicious? Yes. It's my computer. It's mostly a huge national security risk. If an adversary got Microsoft's private keys, they could disable almost all computers, at least temporarily. They would be able to impersonate the update servers, and they would be able to sign modified updates.
So you don't think the book "Showstopper" was accurate? I didn't start at Microsoft until after NT3.51 released, but the culture at the time was indicative.
Open-source OS with binary driver blobs: This is a problem because of the monolithic nature of the Linux kernel (and Windows and recent versions of macOS) - drivers have privileged access to everything. Security is faith in the driver developers. This is the most compelling reason for why we should re-investigate the old idea of a micro-kernel - where each driver lives in its own private memory space (user space). Sure it has a small performance overhead, but these days I think it's worth it.
Linus flogged Tannenbaum out of the OS community for screaming this for years. You're beating an almost dead horse.
@@ea_naseer Yeah, I know. I'm also aware of the downsides of a micro kernel, but to me they seem reasonable in the modern world. When I wrote Linux device drivers a few years ago, I was amazed at how much destructive power I had at my fingertips. It's also why Android doesn't allow kernel modules - all drivers have to be baked into the device tree in the kernel image.
And Dave disappeared shortly after the making of this video.
Forcing black box updates that can change OS configuration and settings is a backdoor imho.
It's just an update mechanism.
@@eadweard. Changing the user settings, without permission, and without even letting them know, is pretty unethical.
I wonder who was the mystery intern that left the message - Was Borat ever at Microsoft?
The main backdoor is simply the update mechanism of Windows. Whenever the NSA or similar demands it, all machines WILL contain backdoors after a simple update.
remember when they pushed the stuxnet backdoor and then provide the removal tool for it?
This is more probable, targeted updates. Leaving code on a machine is risky business that really ends as a double edged sword. Law enforcement and intelligence only care about comprising machines when they are of interest. Comprising every machine is just a liability.
okay...?
but we have a BILLION (do you not know how insanely large of a number a billion is?) users and NONE of them have EVER actually proven ANYTHING youre talking about. 🙄🙄🙄
its as close impossible to slip by even a tiny backdoor without SOMEONE noticing without actually being impossible as you can get. so in 99.9999999999999% cases there is no fabled backdoor. possible, true, but so unlikely you might as well accept that it is impossible.
and you all can spew all the ignorant and rambly unfounded conspiracy theories but NONE of you have EVER provided ANY actuall evidence for what youre rambling about whatsoever.
stop watching faux news.
stop listening to alex jones.
start touching grass.
know something? put up or shut up.
You dropped your tinfoil hat
I'm already subscribed and I liked the video about 5 minutes into it, but YES please make a video about the NSA & their alleged back doors!
Open Source is the best defense against backdoors/zero days. If the problem is there, the hope is that someone altruistic will find it before someone with malice. Even if the malicious find a zero day first it won't take long for a world full of coders going over the source to find and patch the problem.
This was addressed in the video.
@@eadweard. Yes but he was wrong. Open Source is more secure by nature, closed source is by definition less secure as we have to trust that Microsoft Teams will pick up the attack, which they don't most of the time and take time to issue an update.
@@simhz2221 That is a mantra we've all been taught to repeat. There is no evidence things actually work that way.
Backdoors completely destroy the purpose of security on your platform. Your product shouldn’t have any security features if it has one back door
Great to hear that Microsoft had such strenuous security protocols to review the code coming into the main source repository before the kernel owners with gag orders placed against them are ordered by Microsoft (which was forced by the NSA) to intentionally include a backdoor....
You wouldn't want random employees and non-employees' backdoors to interfere with the intentional backdoors placed by the kernel module owners.
That about sums it up. Why Dave started the subject if he can't tell the truth abut it. It was the same deal with Facebook. There is famous video from the beginning of Facebook with either CIA director or NSA one in Zuckerberg office just hanging around. Are we to believe they were discussing weather or perhaps something else?
We need a program that makes fake and obfuscated anti-government nonsense so that they can’t afford to violate our rights anymore
Fascinating video with good info, and it sounds very similar to how things work at SimCorp, which builds a many-million line application since 1993. However the concern is not whether one Microsoft employee can pull a fast one over another, but rather if Microsoft is pulling a fast one over its users. And to this we must say that the user simply cannot review the changes that will be forced unto their systems by Windows update. Fundamentally the deployment and installation of basic system components of Windows are outside user control, and that makes it a back door any way we slice it. Not a hidden one, obviously, but one nonetheless.
And this was not the case when you were there Dave, so you go 100% free on all charges as far as I’m concerned.
You know, I somehow that Microsoft would do that because if they did was Microsoft would get in a lot of trouble.
@@MidnightThunderYT Hard to get in trouble when the man of this channel, and many of his colleagues then, have created a platform that is so good and lasting that it basically carries everything to the point where nobody can really do without it. Win32 has become a free IWIN button for Microsoft - they get far more leeway than they deserve because of it.
@@MidnightThunderYT I was writing a security paper and wanted to do Win10 privacy issues. There was no peer reviewed studies looking into this.
The only articles I did find detailed the Chinese government's special version of Win10 that was designed to not invade on the user's privacy. They weren't even academic, they were from trade journals.
In any case, the most secure version of Win10 you can get is a special version used on Chinese government computers.
Interestingly, even though there are programs designed to harden Win10 against personal data breech, no academic papers were found in a search of 2 different college libraries.
Maybe it has changed, but I known from experience that MS offers tons of grants to colleges, so it seems that they have purchased some good will against the curiosity of many researchers.
Hasbara posting
@@not_my_fn_real_name2689 highly doubt the Chinese windows is safer. maybe against the US but not against the Chinese government itself.
I guess it's more of pick your poison.
NSA uses the Bitcoin Honey Pot. a lot computing power without admin and hardwarecost + the idiots that use the bitcoin for illlgal things. a brilliant thing indeed
NSA key, now that is a juicy story I want clarified.
Great video.
Thanks for letting us in on the history at Microsoft. I'm not sure we'll be running it too much longer with Microsoft having to sign anything that runs under Secure Boot and TPM (Including Linux). That being said--it's not Microsoft that anyone needs to be weary in regards to backdoors, but instead, Intel, AMD and some degree Apple (and any other silicon manufacturer). The NSA has hardware backdoors that are much scarier and REAL from what I've managed to research.
Processors have become so complex and capable that it's simpler to embed the monitoring software there rather than in every OS. With microcode updates being encrypted and the silicon being proprietary, there's not much scrutiny they can be subjected to.
That was my thinking from the beginning. My career was in MVS System Administration, where there's a hardware flag bit to indicate whether the current app is running in Supervisor State. The CPU could be designed to recognise a special sequence of OpCodes and set the Supervisor flag bit for whatever follows in the innocent-looking user's app. That should be a fun exercise for the CPU design nerds (if they haven't already done it).
This video is misdirection propaganda. He is paid to make people worry about hackers when it's evil government entities we are worried about.
@@thomasjefferson4195 I think each of us is more likely to be impacted by hackers. However society is not at risk from hackers, but absolutely at risk from governments. Even if you wanted to, there's little you can to do to keep them from monitoring you if they decide to. There exploit surface is so large for any modern computer.
@@gblargg that doesn't make it okay and doesn't change the fact that this video was specifically designed to distract from that basic fact.
I don't know if Dave is willing to talk about this, but did anybody check in source code with a serious bug they created and it got out to the public?