The maintainers of the security-conscious FreeBSD operating system have declared that they will no longer rely on the random number generators in Intel and Via's chips, on the grounds that the NSA likely has weakened these opaque hardware systems in order to ease surveillance. The decision is tied to the revelations of the BULLRUN/EDGEHILL programs, wherein the NSA and GCHQ spend $250M/year sabotaging security in standards, operating systems, software, and networks.
"For 10, we are going to backtrack and remove RDRAND and Padlock backends and feed them into Yarrow instead of delivering their output directly to /dev/random," FreeBSD developers said. "It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more."
In separate meeting minutes, developers specifically invoked Snowden's name when discussing the change.
"Edward Snowdon [sic] -- v. high probability of backdoors in some (HW) RNGs," the notes read, referring to hardware RNGs. Then, alluding to the Dual EC_DRBG RNG forged by the National Institute of Standards and Technology and said to contain an NSA-engineered backdoor, the notes read: "Including elliptic curve generator included in NIST. rdrand in ivbridge not implemented by Intel... Cannot trust HW RNGs to provide good entropy directly. (rdrand implemented in microcode. Intel will add opcode to go directly to HW.) This means partial revert of some work on rdrand and padlock."
“We cannot trust” Intel and Via’s chip-based crypto, FreeBSD developers say [Dan Goodin/Ars Technica]
With the leak of exploits developed by The Equation Group, the long-secret, NSA-adjacent super-elite hacking squad — published by The Shadow Brokers, who have some extremely heterodox theories about auction design — it’s now possible to audit the source code of some of the NSA’s crown-jewel cyberweapons.
The more we learn about the Shadow Brokers, who claim to be auctioning off “cyberweapons” that crafted for the NSA’s use, the scarier the breach gets: some of the world’s biggest security companies are tacitly admitting that the exploits in the Shadow Brokers’ initial release can successfully penetrate their products, and they have no fix […]
As our Cory Doctorow reported previously, a previously unheard of hacker group calling themselves The Shadow Brokers announced this week it had stolen a trove of ready-to-use cyber weapons from The Equation Group (previously), an advanced cyberweapons dealer believed to be operating on behalf of, or within, the NSA. The Shadow Brokers are auctioning the […]
Finding quality icons is a challenge for designers, and can also get pretty costly if you use them often. And when you’ve got a lot to do, the last thing you want to spend your time on is creating new icons from scratch That’s why we recommend using the Noun Project ($49). Noun Project is a site […]
While Netflix and Hulu have seemingly dominated the streaming market with their limited selections, we’ve looked a little outside the box and found something pretty great as an alternative. SelectTV combines all the content of cable with the convenience of streaming, and it’s affordable too.SelectTV is an online subscription service that packs an impressive library of over […]
These days, the vape market is saturated with low-quality products, making it nearly impossible to separate the gems from the duds. The Atmos Rx Dry Herb Vaporizer stands out from crowd for two reasons: its impressive battery life and durable construction. This high-end little gadget is compact enough to fit in your pocket, and packs a powerful punch, […]