<story><title>&quot;OpenSSL has exploit mitigation countermeasures to make sure it&apos;s exploitable&quot;</title><url>http://article.gmane.org/gmane.os.openbsd.misc/211963</url></story><parent_chain><item><author>bhouston</author><text>Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes?&lt;p&gt;The convoluted code of OpenSSL alone (from yesterday&amp;#x27;s Hackernews post) seems like a great way to add all sorts of &amp;quot;bugs&amp;quot; inadvertent or not.&lt;p&gt;Unfortunately with the Snowden disclosures, there isn&amp;#x27;t much that I rule out of bounds for the NSA when it comes to things critical to internet security.  OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA.&lt;p&gt;Remember that the Snowden docs says that the NSA can break SSL&amp;#x2F;TLS&amp;#x2F;https&amp;#x2F;VPN, etc., but we  do not know the full details: &lt;a href=&quot;http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;how-does-nsa...&lt;/a&gt;  But the one thing all of these technologies (SSL,TLS,https,VPNs) have in common is usually OpenSSL.</text></item></parent_chain><comment><author>TacticalCoder</author><text>There&amp;#x27;s a talk that was given in Belgium &amp;#x2F; Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he&amp;#x27;d do it if he had to create holes in software:&lt;p&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=fwcl17Q0bpk&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=fwcl17Q0bpk&lt;/a&gt;&lt;p&gt;He&amp;#x27;s talking specifically about OpenSSL quite a lot (basically saying it&amp;#x27;s too complex to ever be secure and probably received many &amp;quot;security patches&amp;quot; from NSA employees).&lt;p&gt;The entire talk is an eye opener. He explains how NSA shills are reading reddit &amp;#x2F; HN and poisoning communities &amp;#x2F; standards &amp;#x2F; protocols &amp;#x2F; etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things.&lt;p&gt;He talks about shills submitting a few correct patches over the months &amp;#x2F; years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose.&lt;p&gt;He mentions a few of the &amp;quot;common mantra&amp;quot; repeated often (including here) by people who have an interest in the status quo.&lt;p&gt;He explains why SSL&amp;#x2F;TLS is broken and says that the &amp;quot;SEC&amp;quot; part of &amp;quot;DNSSEC&amp;quot; is not going to be that secure ; )&lt;p&gt;I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating &amp;quot;bug happens&amp;quot; as if nothing malicious was ever going on.</text></comment>
<story><title>&quot;OpenSSL has exploit mitigation countermeasures to make sure it&apos;s exploitable&quot;</title><url>http://article.gmane.org/gmane.os.openbsd.misc/211963</url></story><parent_chain><item><author>bhouston</author><text>Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes?&lt;p&gt;The convoluted code of OpenSSL alone (from yesterday&amp;#x27;s Hackernews post) seems like a great way to add all sorts of &amp;quot;bugs&amp;quot; inadvertent or not.&lt;p&gt;Unfortunately with the Snowden disclosures, there isn&amp;#x27;t much that I rule out of bounds for the NSA when it comes to things critical to internet security.  OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA.&lt;p&gt;Remember that the Snowden docs says that the NSA can break SSL&amp;#x2F;TLS&amp;#x2F;https&amp;#x2F;VPN, etc., but we  do not know the full details: &lt;a href=&quot;http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.cryptographyengineering.com&amp;#x2F;2013&amp;#x2F;12&amp;#x2F;how-does-nsa...&lt;/a&gt;  But the one thing all of these technologies (SSL,TLS,https,VPNs) have in common is usually OpenSSL.</text></item></parent_chain><comment><author>ensmotko</author><text>Check out phk&amp;#x27;s fosdem talk[0]. I&amp;#x27;ve linked to the the part where he talks about openSSL, but I&amp;#x27;d suggest watching the whole thing. I&amp;#x27;m now starting to believe the talk wasn&amp;#x27;t a joke at all...&lt;p&gt;[0] &lt;a href=&quot;https://www.youtube.com/watch?v=fwcl17Q0bpk&amp;amp;feature=youtu.be&amp;amp;t=27m22s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=fwcl17Q0bpk&amp;amp;feature=youtu.be...&lt;/a&gt;</text></comment>