Microsoft: No Backdoor In Vista, Ever

By Ed Oswald | Published March 6, 2006, 3:37 PM

Microsoft late last week began to publicly deny reports that it was building a backdoor into Windows Vista in order for governments to gain access to private files. Calling it "simply not acceptable," Microsoft System Integrity Team developer and cryptographer Niels Ferguson said the official line is that the company does not, and would not, create backdoors.

Reports of such an issue within the next generation Windows release surfaced in mid-February following a report by BBC News. The story claimed the British government feared that new encryption technologies, specifically BitLocker in Vista, could set back terrorism investigations.

The report claimed that British authorities were talking with Microsoft about the issue, however it did not specify what the two parties were discussing.

While Ferguson did not deny talking with the British government, he did say that law enforcement officials were inquiring about the BitLocker technology. "They foresee that they will want to read BitLocker-encrypted data, and they want to be prepared," he said.

However, Microsoft would never install a backdoor in order to make this possible, Ferguson said. "Over my dead body," he wrote. Ferguson added that nobody in the team would be willing to either implement or test such a feature.

Microsoft says BitLocker is intended to preserve system security and "ensures that data stored on a computer running Windows Vista is not revealed if the machine is tampered with when the installed operating system is offline."

The technology will additionally prevent malicious software from being installed on computers without the user's consent.

Comments

View comments by with a score of at least

And they will never release your private data to the goverment.... even if it is a matter of "National Security" they will fight for your privacy rights with all their resources....oh way they already gave everything to the Bush Administration.... ummm, i wonder what kind of Favors they will get if they hide a small backdoor... or maybe a few "holes" that they didn't know about.

Score: 0

|

mere mortals ....
if MS really wanted to put a backdoor ....
they would ....
and we, probably wouldn't even know is there ...

Score: 0

|

ever wonder why all the holes are in all the versions of windos out there? it has long been a theroy that the holes were simply numerous back doors into windows by representatives of ms for the sole use of ms to keep track of what all was on your system and/or personal information.. as "hackers" found these holes ms had to say darnit, another "security feature" we have to patch..

Then again, it could always be a pl;ot from the evil republicans to overthrow the world lol

Score: 0

|

Alot of people say that Bill Gates will eat your soul if you get to close to him...Doesn't mean it is true.

Some of you really need to put down your tin foil hats for a while and relax. There is a good chance that you, as an "average" user of windows has little to nothing that a billion dollar company would want that they couldn't easily get through some other means. Your 200GB of porn is safe.

Score: 0

|

only 200GB?

Amateurs...

Score: 0

|

An with Gdrive all of your "prom" will be well kept, searchable......and above all accessible from any internet connected computer......

Score: 0

|

prom? Never went. Suprise anyone? Didn't think so.

You meant pr0n? Ahyes... All of mine is already searchable online... Easily available at news://alt.binaries.pictures.erotica.hamsters

Really, that's where they keep all the good stuff. The name is just there to scare away the n00bs. ;)

Score: 0

|

You realize of course, that this does not necessarily mean there won't be a backdoor. It simply means they will never admit to it, which is as it should be.

My two cents: There really is no backdoor. It seems like way too much of a risk for MS. If the backdoor was ever found/leaked, the entire O/S would be tanked for many people.

Score: 0

|

Even *I* would forever abandon Microsoft if it were discovered that a backdoor was intentional. Security risks are bad, but at least there is a response to fix those, and those are inevitable on any platform.

Score: 0

|

"There really is no backdoor."

I don't know about that, but I definately know there is no spoon.

Score: 0

|

Score: 0

|

"... and even if we would, we wouldn't tell you guys."

...seems like the likely truth if you ask me.

Score: 0

|

Where are you getting this quote?

Score: 0

|

it's not a quote, it's irony

Score: 0

|

Which begs the question:

Then why the quotation marks?

Score: 0

|

As I mentioned one time before, I got locked out of my machine and had to call MS for help. They had me logged on with administrative privileges in less than two minutes. This was done over the phone with me typing in the commands they gave me. I was pretty impressed since my machine was locked down pretty well. Don't even ask what the commands were. I would never tell and I did not have time to copy all of them down. Let it suffice that we did bypass all logon security with a few obscure DOS commands that I had not ever seen before or read about before.

Score: 0

|

LOL!! Yea...sure...:)

PS:

You watch way too much 24

Score: 0

|

You're so full of crap. I've been working on Windows systems for far too long to believe something like that. I know of plenty of 3rd party tools that can "assist" in the process when necessary, but none of them "easy" to use in a few minutes... and nothing Microsoft would readily help you with. Unless of course the solution were to reinstall Windows, lol.

Score: 0

|

lol...I think you've spent far too much time typing that up...his post wasn't worth that response. :)

Score: 0

|

Think what you like. I didn't lie or fabricate anything. It really happened just like I said. I'm not talking about any third party software. This was me to MS direct on the phone. When you think about back doors do you mean like in the movies? I don't. A back door can be un-documented commands that give you enough access to do the job. You've probably never seen anyone send modem commnands to be store in the memory of a modem either to cause it to dial out when idle. My son in law (working for IBM at the time) had that happen to him. Just because you can't do something doesn't mean that nobody can. So much for your "full of crap".

Score: 0

|

LOL yea right...ok I'll spend 10 seconds responding to your BS claim.

First of all, if such a backdoor existed, MS certainly would not tell YOU, a nobody home user what to do to access it...no matter how much you complained to them.

Second of all, if such a backdoor existed, trust me it would be huge news and would have been leaked even before the OS was released.

You say you have a son so I don't know if you're just old a senile or you're lying about having a son too and are really 10 years old trying to make up stories online...either way you're "full of crap".

Score: 0

|

Another angry and foul mouthed young man. Next microsoft seminar you attend amybe you should ask if they can get you into a system you accidentally got locked out of. Chances are if you use enough politeness and tact one of them will give you his name and number to try to help you. Un-published commands are a way around the safeguards a normal user has. Or maybe you don't attend MS seminars? I'm not saying I cracked anything. MS did help me out of a bad situation. I'm saying MS has a lot more in their bag of tricks than most of us will ever know. I just happened to be lucky enough to have had them share some long enough to get into my system. You might trying to go to some of those seminars. You often get free software, hardware, and betaware, in addition to a wealth of knowledge resources. Oh, and a final note. At the time I wasn't a home user I was working for a large business that had MS applications installed on over 500 machines at our location. I no longer work for that company because I found a better position.

Score: 0

|

I've been a systems engineer for over 10 years, working full time as well as consulting at companies ranging from 100-5000 employees and 10's to 1000's of servers, running Windows and various flavors of *nix. I've attended more seminars and expos then you'd be able to count...do I expect you to care? Nope, I hardly care that you worked for a "large" business with "MS applications" installed at 500 machines (that's LARGE??).

but keep going about your fantasy bonding with an MS employee who showed you a magical key combination to allow you to get into a locked out system without any passwords...it's kind of amusing, actually.

Score: 0

|

Dude, not only are you full of crap, but your so full of crap its covered your eyes and you've gone blind...sorry to tell you but the real world doesnt work that way. Niro is right, if such a workaround existed it would have been posted and exploited in more places then you can shake a stick at YEARS ago...and subsequently patched out of existance.

Score: 0

|

No, No, I wont have it, he tells the truth. The same thing happened to me, only MS made me eat the instructions and the computer after they had finished walking me through the process, I then had to cut off my own fingers so I couldn't tell anyone their dark secret. But I can use morse code by banging my head on my work desk to tell the world, so Bill your secret will be out Ha HA. Damn this straight jacket is tight :-)))

Score: 0

|

lol ;)

Score: 0

|

I bet he tells everyone at school his dad is a fireman or a policeman

Score: 0

|

that better position being going to school cause your 14 and lying on webforums to sound cool.

Score: 0

|

no you boot to dos then you go to the root hard drive, then type del *.*
it works i tell you

Score: 0

|

i remember hearing years ago they always had backdoors in there windows OS'es from 95 to NT 4.0 . probly was all BS anyway but who knows

Score: 0

|

Windows 95, 98 and ME did have a backdoor for stealing data. It's called DOS.

Score: 0

|

Windows Vista, coming from Microsoft's programmers, will have a million unintentional bakdoors anyway called SECURITY HOLES.

no need to write 'em on purpuose, save your effort you guys at microsoft...

Score: 0

|

Have you read any of the write-ups on the changes they've made to Vista?

Memory heaps?

Networking system?

Audio system?

No?

Read:
http://www.extremetech.c...2/0,1697,1931914,00.asp

Then comment, once you know something about what you're commenting on.

Anyone can bash MS, but at least try to be informed about it.

Score: 0

|

I did. Funny thing is it's the same old kernel. What a waste.

Score: 0

|

Yep, just like Linux, Unix, OS X and the rest have SECURITY HOLES that can be used as backdoors. I assume you accidentally forgot to include that in your post and we're just trying for a quick cool cheap jab at MS.

Score: 0

|

"I did. Funny thing is it's the same old kernel. What a waste."

Yes and no. MS has to build off of the XP kernel otherwise Windows XP applications would be ~%$#@! trying to make them to work properly. Technically, the core is from about 1995, as Windows 200 was built on the NT 4.0 kernel, and Windows XP was built from Windows 2000...

Score: 0

|

Its not really the "same old kernel" with all the changes that have been made. Its like saying the linux kernel is the same old kernel since it hasn't been rebuilt from scratch for ages.

Score: 0

|

Good read. I wonder how long it'll be after release before people strip all the junk off it and turn it into an Omega 1337 gaming OS?

Score: 0

|

I was under the impression that they completely re-wrote the vista kernel.

I thought it was mentioned in an article recently, but I'm too lazy tonight to look for it.

Score: 0

|

Stick to art...a security hole and a backdoor are NOT the same thing...

Score: 0

|

lmao...

In the article I posted above, actually...

*shrug*

I don't think it was a complete rewrite, but they did completely rewrite some major portions of it.

Things like the memory heaping, as I mentioned above, which is a MAJOR source of problems with both security and development within Windows.

These rewrites *should* make Vista a *lot* more stable and a *lot* more secure. But then again, money *should* grow on trees, and tap-water *should* be drinkable.

Eh...ya win some, ya lose some.

Score: 0

|

Course 1: Reading Comprehension

Curriculum: We will be studying methods used to increase one's ability to read text and understand the obvious meanings of said text.

Please show up. You *really* need this one.

Score: 0

|

you mean an:

"()m364 L337 64m1n6 ()5"

Score: 0

|

LOL, no but I'm so lazy today that I'll take it.

haha

Score: 0

|

I don't think any OS maker would every create a backdoor to their software. Just the liability alone would keep them from doing it. BitLocker sounds awesome and I'm definately going to use the technology.

Score: 0

|

BitFailure will be broken in less then a month by the dude at Elcomsoft. Subsiquently, about a few dosen other tools (both commercial and open-source) will be released that somehow reverse, trick, disable, break, or otherwise circumvent the BitSh*t encryption algo. Microsoft is totally USELESS at encryption technology. They can't even seem to hire good help from the outside. They really are cluless and of course, thats the WAY I LIKE IT!

Score: 0

|

Man you must be a super good hacker to break 128-bit encryption. Moron. Do you know how long it would take and how many computers it takes to break an encryption algorithm of 128-bit strength. Don't reply unless you actually know what you are talking about.

Score: 0

|

dont bother, that one always make dumb uneducated "im a super hacker" posts.

he is most likely a 14 year old with an active imagination, and little else going for him.

and any of his claims are probably word-for-word copies of the third entry out of a google search along the same catagory as the discusion.

Score: 0

|

Like they don't already have a backdoor for XP that nobody knows about....

How would you know about it since it's all closed code?

Score: 0

|

And how would you necessarily know about it, if it were open source? People routinely find 5-year-old bugs in open source projects which are a fraction of the size of the Windows code base. For large projects, open source is advantageous in that you can recompile to incorporate small changes, you can port to other platforms by fixing only portions which don't work as-is, and you can (depending on specific license) reuse chunks of code which were designed, written, and tested by someone else.

But it's a fallacy that large volumes of open source code are actually inspected on a continual, comprehensive, and accurate basis. Notice how many of the popular open source sites have stopped hosting tarballs and/or buried the tarball links behind warnings that "regular users" don't need to download source. This is because they are wasting money on hosting bandwidth, due to 99.9% of tarball downloads being done by people who don't even know what a compiler is. The population of people who truly participate in open source projects at the coding level is much smaller than open source cheerleaders would have you believe. Individual pieces like the Linux kernel may be closely watched, but the kernel is never used alone. Even embedded scenarios require a minimal amount of added programs to become usable. Many distros are assembled and maintained on such a dynamic, ad-hoc basis that any number of backdoors may have slipped into various releases of various distros.

On the other hand, even without open source, Windows XP is so widely used and scrutinized that everything Microsoft has openly documented (including weaknesses) about NTFS, EFS, and the communication possible between XP components and the Internet has been independently confirmed.

That's not to say that people can't come up with different opinions based on the facts. The author of XP-AntiSpy, for example, isn't claiming that XP performs secret/backdoor communication; he just distrusts ANYTHING "automatic." Some people feel that the ability to bypass NTFS security by booting a different OS is bad, but Microsoft has documented this consideration for a decade, starting years before any other OS existed which would read NTFS. Some people feel that the encryption strength of EFS (the maximum legally exportable at the time of XP's RTM) has become obsolete because it can be brute-forced in "only" 20-30 years, or that the "recovery agent" feature which allows corporate administrators to keep a secondary private key (only when set up in advance, and only within the confines of the domain) is a "backdoor" for the corporation (who owns the machines and the work produced by its employees on them) even if not for Microsoft. It's fine if you want to form such an opinion based on the facts, but don't try to confuse the facts themselves; the real chances of a backdoor existing in XP are the same as the chances of a backdoor existing in XYZ Linux distro.

Score: 0

|

I am glad they didn't give a political answer, like "not to my knowledge" or "why would we do that?" when asked. He isn't lying--because with his strong statements, if it were a lie, Microsoft would lose what (little) credibility they have.

Score: 0

|

I would be the first to congratulate Microsoft on recent turns towards better consumer oriented products. BitLocker sounds like a great feature and I am hoping that Microsoft does not implement a backdoor.

Score: 0

|

"Implement"

Haha! You almost talk as if it was a feature! Very funny... I like you.

More seriously... Although I really doubt Microsoft will intentionaly "implement" a backdoor in its OS, I'm pretty sure they'll be plenty of 'em. Didn't they say "Oh, we've done a complete security check, and there's no holes now"? Well, just after that, what did we learn? The WMF hideous sec-hole affected Vista as well!

I understand that it's almost impossible not to have sec-holes in an OS, especially in one with as much as (useless) feature as Windows... But some things are... just so obvious. I'm looking at you UPnP, Active X, Windows Print and Sharing System and my dear WMF. What were the devellopers thinking of when they designed features that allowed arbitrary code to be executed without the user's agreement??? (yeah yeah, I know, I named some features that didn't allowed you to do that) And those "features" weren't designed 30 years ago, when security wasn't a problem! I just don't know what they are thinking. It puzzle me...

But fortunately, they did that security check, so guys, we're allright!

Score: 0

|

Breakthrough: AMD and Intel settle antitrust dispute, reach new cross-license agreement

UPDATED Only exclusionary business practices, not some rebates, may be covered by a new agreement on Intel's future business conduct.

Windows Marketplace for Mobile now available in browser, iTunes' App Store still not

You can now check out what Windows Marketplace for Mobile has to offer without a Windows Phone.

Microsoft damage control after marketer claims Win7 inspired by Mac

Have you ever said anything you wish you could take back? Ever? No? Not even once? Well then, you won't sympathize with a mid-level Microsoft manager today.

Facebook for iPhone developer goes from Apple supporter to 'I quit!' in 3 months

Fed up with Apple's App Store policies, the developer of Facebook for iPhone has bailed on the iPhone.

Google acquires Gizmo5, builds IP telephony portfolio

Google Voice today confirmed rumors that it would acquire IP telephony company Gizmo5

'A pivot from war to peace:' The AMD + Intel armistice, in their own words

An extraordinary day in technology history is recognized by two long-time rivals that mutually decided it's futile to fight anyplace else except the marketplace.

PS3, Xbox to soon get Twitter, Facebook integration

Both Microsoft's Xbox 360 and Sony's PlayStation 3 will integrate with Facebook in the near future.

The iTunes App Store at 100,000: Can we stop counting, already?

Carmi Levy | Wide Angle Zoom: Is a six-digit number truly reflective of a healthy applications ecosystem? Or is it another type of bloat?

Analysis: The end of business-by-litigation?

The AMD v. Intel case ended neither with a bang nor a whimper, but almost with a song. Is it catchy enough for the rest of the PC world to sing in perfect harmony?

The agreement: Intel and AMD 'wipe the slate clean'

As the Securities and Exchange Commission document shows, AMD did indeed make some compromises in favor of Intel, especially with regard to conduct.

EC still holds Intel accountable even after AMD settlement

Though the future of relations between AMD and Intel may be peaceful now, the EC believes Intel may still owe restitution for its past conduct.