bennyboy64 writes "In what may be one of the largest roll-outs yet of Microsoft's new Windows 7 Operating System, Australia's Federal Government decided to give 240,000 Lenovo IdeaPad S10e netbooks to Year 9-12 students. Officials are calling them 'unhackable.' iTnews reports that the laptops come armed with an enterprise version of the Windows 7 OS, Microsoft Office, the Adobe CS4 creative suite, Apple iTunes, and content geared specifically to students. New South Wales Department of Education CIO Stephen Wilson said that schools were 'the most hostile environment you can roll computers into.' While the netbooks are loaded with many hundreds of dollars worth of software, 2GB of RAM, and a 6-hour battery, the cost to the NSW Department of Education is under $435 (US) a unit. Wilson praised Windows' new OS: 'There was no way we could do any of this on XP,' he said. 'Windows 7 nailed it for us.' At the physical layer, each netbook is password-protected and embedded with tracking software that is embedded at the BIOS level of the machine. If a netbook were to be stolen or sold, the Department of Education is able to remotely disable the device over the network. Each netbook is also fitted with a passive RFID chip which will enable the netbooks to be identified 'even if they were dropped in a bathtub.' The Department of Education also uses the AppLocker functionality within Windows 7 to dictate which applications can be installed."
The main issue with the Atom is that it does not do Out of order execution [wikipedia.org]. ARM processors do, so an equivalently speed ARM will easily out perform the Atom
And, of course, since we're already into "thought crime" territory here, how long until they make it illegal to even talk about what happened (since you obviously must be thinking about the video in some way to comment on it, you sick pervert!) At some point soon, this will have to be stopped.
Lunch or deal. Some state politician and/or bureaucrat must be getting a nice thanks later in life.
The PR reads like pure MS marketing slop with a cute upgrade hint.
yeah, nuking the bios from a cd is ridiculously easy. It's actually a feature that people can do so. Hirens boot CD [hiren.info] comes with very simple methods for that.
I bet someone will just make an app that unlocks the laptop and wipes the firmware for them so that the laptops can have actual use.
by Anonymous Coward
on Sunday September 27, @09:45AM (#29556197)
I am not some guy, I am Anonymous Coward, I have more posts than anybody else here, and I am a trusted member of this community. Your sarcasm is completely out of place.
There were these guys that made this ship that was "unsinkable" which on its maiden voyage ran into an iceberg and sank. Compromising the BIOS in this case is analogous to the iceberg. "Unsinkable, Unhackable, Waterproof." BTW, isn't the Thinkpad supposed to work underwater?
"Tracking software embedded at the BIOS level"? Last I checked, those "tracking schemes" just force-fed Windows some driver/app at the BIOS level. Install any other OS and it becomes useless (not to mention that BIOSes these days aren't even hard to hack). As for the RFID, I don't see how disassembling it and taking it out is rocket science. Nevermind that the students themselves are going to be owning any kind of app installation protection in the blink of an eye.
Sorry, using software to secure a platform against its physical holder has never worked for long, but even just trying to do it on an insecure platform like an x86 PC is beyond useless. None of this is has even a remote chance of working without the heaviest-handed TPM-on-CPU-die functionality and signing of each and every piece of software, but that has no chance of working because no one would want such a platform, it would be painful and expensive to develop, and it could never exist given the buggy and insecure nature of PC software in general.
Video game consoles with strong hardware security and tightly controlled software environments with little interoperability requirements get cracked all the time to run homebrew and/or pirate games, what makes these people think their little netbook won't be?
For what it's worth, Linux vs. Windows here makes little difference. The entire scheme is doomed to fail from the start due to the nature of a PC solution like this. Sounds like Microsoft just sold these guys a bunch of nonexistent security.
Setting aside the fact that I don't think giving students laptops is the most efficient use of resources (smaller class sizes, more funding for teachers, arts and science programs etc would be better)...
I can't help but wonder if this will be as unhackable as $84 million porn filter [slashdot.org] released a couple years ago.
While the netbooks are loaded with many hundreds of dollars worth of software, 2GB of RAM, and a 6-hour battery, the cost to the NSW Department of Education is under $435 (US) a unit.
The netbooks have hundreds of dollars of software loaded and still only cost $435 a unit. So the cost of the unit is being subsidized and the department is hailing this as some big leap forward in cost of ownership? And some of the big changes are related to the BIOS.
Already, the department has noted the loss or damage of just six netbooks out of the 20,000 rolled out since August - and have tracked one teacher using their device on a field trip in New Zealand.
Yeah, really cool that the school can track and potentially monitor everyone using one of these devices, even if the machine is not physically turned on via the RFID tags. Now there's a big win.
DET also uses the AppLocker functionality within Windows 7 to dictate which applications can be installed on the device.
Even better. Add McAfee filtering to control content and MSFT's own antivirus technology...add up what all that would cost in a real world enterprise. Just the software costs alone would dwarf the cost of the device.
I look at the cost of the device, the software and all the centralized control and think, "Or just install Linux and get 95% of that functionality right out of gate." And the 5% you don't get is the spying and monitoring part. What lesson is the school teaching here?
This is certainly a win for someone, but I'm not sure it's the students and teachers.
Why would anyone issue a challenge like that over netbooks for students? Unhackable? Bullshit! Some hacker out there is going to take that as a challenge and hack into the thing in, I'm guessing, less than a week. And some poor student is going to have his netbook hacked because some nimrod decided to talk smack about how awesome-sauce these netbooks are and described it a "unhackable." Unreal...
I don't think too many kids will have their netbooks broken into by hackers - most school-age kids don't have credit cards. More likely someone will find a crack and release it to the world for the kids to use.
by Anonymous Coward
on Sunday September 27, @07:52AM (#29555299)
I work for one of the departments involved, hence the anonymous post.
This is typical government posturing, and has nothing little to do with the what's actually going on.
From what I've seen, the RFID chips are redundant, they're using the machine's BIOS UUID to track machines through software, I don't think they even record the embedded RFID codes at all, as that requires a physical reader device, and they're not handing them out to schools. Normally, RFID tags aren't used for anti-theft, but for inventory tracking.
The BIOS tracking is pretty standard and off-the-shelf, it's not designed to stop professionals, but it will catch stupid thieves. Software protection is not huge, but most 'problems' will be met with an F12 network boot and a fresh system image, so the harm students can do will be limited and easily reversible. Students get limited space to save their work, and that is backed up centrally, so they shouldn't lose any data. On top of that, most questionable sites are blocked by the internet proxies, so that cuts out lots of potential sources of harmful stuff.
Really, the true protection the laptop gets is that every student receives one for free, but a replacement laptop has to be paid for out of their parent's pockets. Students will learn to be careful with them or face punishment from their parents.
There's lots of other silliness going on though, especially as it's my tax dollars going to waste.
For example, the enterprise agreement for the Adobe CS4 suite was a big deal. They spent millions purchasing the software before anyone had actually tried running any of it on an actual laptop. Only after the government had signed the contracts did they bother, only to find out that the screens were too small. All of the Adobe dialog boxes were designed for a vertical height larger than the physical screen resolution, so the OK/Cancel buttons are cut off. The workaround was to install a driver that supports a larger virtual desktop and pans the screen around. It's hideous. This is what happens when you let politicians make technical purchasing decisions.
Similarly, the laptops are rather anemic, which is expected for a netbook, but a lot of the software and content they want to publish is very video-centric. Apparently some types of video, like Flash content and h264, don't always play well, and high-res content is a slide show.
There's lots of other silliness going on though, especially as it's my tax dollars going to waste.
I wonder how many 10's of millions of dollars will be spent on licencing fees? The entire infrastructure could have been built upon Linux distributions and tailored to the education departments requirements. As it stands I wonder if they even looked at a Linux distribution.
If Lenovo would build in back doors, and is found out, then at best they go bankrupt. I think that is enough of a reason for any company NOT to build in that kind of back doors. And they will be found: non-standard chips present in the hardware are a prime target for further investigation, and BIOSes can be flashed (or, presumably, the original software checked against known-good implementations or at the very least decompiled for investigation).
So even if the PLA is part-owner of Lenovo, why would you thi
Right, well, I actually attend one of the schools who have a deployment of these laptops.
There's a label on the bottom that threatens you that if you steal it the police will find you. There's tamper-proof screws, so normal phillipshead's wont do the job. The BIOS is obviously passworded, and I managed to break the bootloader of Windows 7 by pressing ESC twice. No OS found apparently.
For "secure" laptops, you can right click pretty much anything and run it as an admin. We ran cmd.exe as an admin to create a proper Admin account. Completely bypasses AppLocker. Apparently, according to the laptop admins, the government wont allow printer drivers that aren't already part of Windows 7, so no printing for you.
The laptop maintainers don't even have administrator access. They have to box the laptops up and ship them to a centre to be "fixed", even if it's as simple as reinstalling a driver. Pathetic.
It's only early days, and the nuking of the bios can be done easily, through Wubi or other means, but USB boot is disabled so you'll have to find alternative means. And I know it's likely moot to post so late after the rush, but I had to say it.
Btw, it's CS4 Elements, it's not the true suite. And it includes Dia, the open-source diagram editor, which I found odd. Open source deployments always amuse me.
To finish, Firefox is not included by default and has many issues when installing, as you don't have access to Program Files, so it confuses the installer to no end unless you change where you're installing it to.
These laptops require ethernet access to activate and are mapped to a single username, so good luck using it if you don't have a Department of Education account. The all have filtering software so no porn for you kids, even when at home. Myspace and Facebook are blocked even from home connections. It's a rather horrible crippled setup that I'd wish upon no-one.
Welcome to the future of computing. Homeschool your kids.
Here though they have physical access to the device. You don't need to be an experienced black hat to take a hard drive, mount it in another machine, and modify/etc/shadow. Or possibly simply boot from a USB drive to do the same, in which case it really is script kiddie territory.
What is it with governments and hubris? If they had just shipped all these laptops without any mention of "unhackableness", you know what would have happened?
1: 240,000 kids would have gotten reasonably secure systems with useful software on them
2: People would have noticed how secure and safe the systems were, and appreciated the low rate of problems they experienced
3: Eventually, some smart students would have figured out how to bypass all the security so they can play world of warcraft or something, but nobody would have cared and it wouldn't have gotten any press
Instead, some asshat announces to the world "Bow to our unhackable laptops! We are awesome! HAHAHA!", and now thousands of hackers and security researchers out there have made it their personal crusade to find a way to totally decimate all the security on the box. You're right... It's gonna take about 1 month for an exploit for these things to make it to the front page on slashdot. Fucking idiots.
Footnote:
Yes, I'm aware that security through obscurity is no security at all, but that's not the issue here. The issue is that instead of nobody caring or trying to break the reasonable security they've implemented, now they've got thousands of people working on it. THAT does matter.
Footnote:
Yes, I'm aware that security through obscurity is no security at all, but that's not the issue here. The issue is that instead of nobody caring or trying to break the reasonable security they've implemented, now they've got thousands of people working on it. THAT does matter.
Security through obscurity's little brother? Security through "meh"?
And don't discount the importance of it, either. All security, no matter what type it is or how it is implemented, is basically designed to slow down anybody who might try to break it. Indeed, security through obscurity itself does this, but the actual slowdown it provides is minimal, and it adds an extra cost: it is difficult to tell when somebody out there has successfully broken your security. By opening up, you can get a bunch of people working on your security to strengthen it, to help offset the few people who might be interested in breaking it.
Anyway, why would you go to such great lengths to slow down any individuals who might see a profit in cracking your systems, then go and piss off a bunch of 1337 haxxorz all over the world and get thousands of them working on the problem in parallel? Kinda defeats the purpose of using strong security in the first place, doesn't it?
All security, no matter what type it is or how it is implemented, is basically designed to slow down anybody who might try to break it.
I think you're confusing real security with poor security. Granted, often real security is difficult or impossible...
It is possible to create a system which is actually impossible to crack, short of social engineering or unprecedented changes in technology. Example: SSH keypairs. The last major vulnerability in this was due to a stupid, stupid flaw in the implementation. You can argue that such flaws are inevitable, but I'd argue that this is an argument about human fallibility, not about the theoretical limitations of a software system. Depending how much you're willing to invest, it's possible to write a program in such a way that you can mathematically prove it to be correct.
The only other way SSH keypairs are likely to be defeated is when quantum computers become feasible.
That said, I think it's unlikely they've created a truly invincible system with all the software they mentioned. There's likely to be a bug somewhere in Win7, CS4, Office, or Tunes.
By opening up, you can get a bunch of people working on your security to strengthen it, to help offset the few people who might be interested in breaking it.
But that only works for software you can fix, or you can get the vendor to fix. I highly doubt that's the case here.
Nobody is out to burn my house down, because nobody cares. But if I go out and shout, "My House is UNBURNABLE....MUAHHAHAHA!", there's a chance that some asshat will put a torch to it just to prove me wrong.
Security through obscurity doesn't work. Security through provoking asshats into action really doesn't work, unless you have the power to fix what they break.
Exactly. The purpose of any lock is to provide a speed bump. Hopefully a big enough bump that you'll decide the effort isn't worth the payoff. This asshat increased the payoff 1000 fold in notoriety, and social recognition.
The Roku vidio player is an excellent example of security through "meh". It's almost an ideal box for a Boxee or MythTv frontend, but it is pretty much unhackable (cryptographically signed u-boot, kernel, and ramdisk). They've released their sources (but not their crypto key) months ago, yet not one single crack is available for it.
Why? Because (a) they don't make a big deal of the security features to the public, b) it's stupid cheap ($99 USD), and (c) It Just Works.
The combination of all three make 'meh'. Due to (a) there is no implicit challenge to the security community, (b) trumped the TiVo problem of trying to get 'more value for your money' out of an expensive piece of kit, and (c) prevents your Average Joe hacker from wanting to break a working (and useful to him) device.
Good counterexamples are TiVo, Linksys routers, and the Wii.
For TiVo, it was expensive enough that people wanted to get more value for their money, and felt it was time well spent to hack it.
With Linksys routers, It just Doesn't Work caused people to spend a lot of time finding a way to make some perfectly good equipment work at all for them.
The Wii advertised to the community that it was unhackable, which promptly cause all manner of security professionals to take up arms and figure out how to hack it.
Instead, some asshat announces to the world "Bow to our unhackable laptops! We are awesome! HAHAHA!", and now thousands of hackers and security researchers out there have made it their personal crusade to find a way to totally decimate all the security on the box. You're right... It's gonna take about 1 month for an exploit for these things to make it to the front page on slashdot. Fucking idiots.
Perhaps. But then again, this is Australia we're talking about. You know, the country who's government is despe
>What is it with governments and hubris? If they had just shipped all these laptops without any mention of "unhackableness", you know what would have happened?
Here are some clues for why they announced such a thing. From the article:
'There was no way we could do any of this on XP,' he said. 'Windows 7 nailed it for us.'
*and*
the cost to the NSW Department of Education is under $435 (US)
Care to make a wager as to whether or not a certain large corporation in the Pacific Northwest gave them an extra special deal on the hardware & software on the condition that they praise Windows 7 over XP? I mean, they're purchasing netbooks and running Windows 7 on them instead of the lighter weight XP? Anybody else see anything wrong with this picture?
No, they have challenged people all over the world to find all imaginable security holes in THESE LAPTOPS. Nobody cares about Windows 7, everyone knows that there will be hacks galore available for the next few years (though maybe fewer than XP?). The point is that they've said "Hey, anybody want to prove you're the world's greatest hacker? Pwn our boxen!". Guess what? Somebody will... and it's going to be big news, and the Aussies have set themselves up to look really stu
It seems to to me that, given the Slashdot summary, GradiusCVK is correct when
he said this in his original comment, although he could have shown more
elegant manners:
'Instead, some[one] announces to the world "Bow to our
unhackable laptops! We are awesome! HAHAHA!", and now thousands of hackers and
security researchers out there have made it their personal crusade to find a
way to totally decimate all the security on the box.'
However, the problem is with kdawson, the Slashdot editor, not
the Australian government or the article to which the Slashdot summary links.
The article says, "[government] seeks to build 'unhackable'
netbook network". The meaning is that the Australian government is doing
the best it can in building a network.
kdawson, the Slashdot editor says, "... Government To Build
"Unhackable" Netbooks".
kdawson made the title sensationalist and misleading. This amazes me:
In all these years, Slashdot editors seem to have learned nothing about being
editors. kdawson turned a wonderful story into a misleading experience.
However, the problem is with kdawson, the Slashdot editor
kdawson, the Slashdot editor says, "... Government To Build "Unhackable" Netbooks".
kdawson made the title sensationalist and misleading.
kdawson turned a wonderful story into a misleading experience
Your obvious derision for kdawson notwithstanding, the "NSW seeks to build 'unhackable' netbook network" headline came from the itnews.com.au site, which you would have discovered for yourself if you had clicked the second link in the article.
Your anti-kdawson rant also misses the real point, which is that this "wonderful story," as you describe it, is nothing more than part of Microsoft's Windows 7 launch campaign. The real story lies in this paragraph:
incredibly, while the netbooks are loaded with many hundreds of dollars worth of software, 2GB of RAM and a six hour battery, the cost to the NSW Department of Education is under $500 a unit.
Wow! That is incredible, and a real coincidence that this is occurring just as Microsoft prepares to roll out Windows 7.
What you should be taking Slashdot to task for is allowing this advertisement - replete with Microsoft marketing phrases like "Total Cost of Ownership (TCO) " and quotes from DET executives gushing that "There was no way we could do any of this on XP" - to run, instead of an insightful analysis of what this little Microsoft publicity stunt was really all about. Of course your TCO will be way down when Microsoft gives you enterprise versions of their software for free.
As someone mentioned above, this is a victory for "trusted computing," and other technologies for enabling corporations to control your hardware. Someone should write an article about that.
Well yes, it's a well-known fact among computer scientists (and apparently not by politicians) that the following inequality is a physical property of the universe:
physical access >> root access
What I was referring to was the potentially useful but soon to be pummeled security the laptop could have offered to students who didn't lose or wipe their laptops. Too bad too.
I dont understand why this would be considered unhackable.
Exploits have already been released for windowed 7.
It is quite simple: Microsoft said that it was unhackable, so as far as the idiot politicians were concerned it must be true.
What grates with me is that the Australian Federal Government is spending money training kids to use MS s/ware - something that will stay with them for the rest of their lives. The MS marketing department must be overjoyed.
What education should be about is understanding, if you just train someone in one version of s/ware many just adopt a point and click approach with little understanding of what they are doing. You need different sorts of s/ware to make them think. Schools should use a mixture of: MS, Mac & Linux PCs.
What education should be about is understanding, if you just train someone in one version of s/ware many just adopt a point and click approach with little understanding of what they are doing. You need different sorts of s/ware to make them think. Schools should use a mixture of: MS, Mac & Linux PCs.
You seem to have severely misunderstood the purpose of these machines.
What education should be about is understanding, if you just train someone in one version of s/ware many just adopt a point and click approach with little understanding of what they are doing. You need different sorts of s/ware to make them think. Schools should use a mixture of: MS, Mac & Linux PCs.
I think it's a little more subtle than that. 90% of the kids using these things will go on to be standard users in life, treating computers as one tool among many. Have you seen how regular users treat computers? Most of them are uncomfortable using a new app without formal training -- even today's twentysomethings. Even on a Mac (yes, I'm a Mac guy).
What concerns me more are the other 10%, who will become power users, sysadmins, and developers. If all they know is MS and their pitifully low standards for s
If they're so locked down that the students can't do what they want with them, then no, they won't.
They will just teach the students to accept spoon-fed information and not to try to investigate anything for themselves.
To run a live CD of Linux... wouldn't the BIOS have to be set to boot from CD-ROM? The locked BIOS?
So, now you're cracking the case open, and disconnecting the (possibly soldered) battery and hoping the BIOS resets to factory defaults that haven't been set to include the lockouts.
Or, pull out the hard drive, plug it into another machine and do what you will - which might not do a lot of good if they've got the processor set to run signed code only.
I'd try pulling the hard drive and cloning it then playing
When the communities say I told you so, I wanna see Bill Gates cry.
The problem is that won't happen.
This was issued with great fanfare, press releases all around. What happens next week when it gets broken?
Nothing. Nobody will hear about it. The government isn't gonna issue a press release saying "oops, we were wrong", and the hackers that pull it off either won't have the resources to buy a feed in PR Newswire, or if they do, nobody will publish it, out of fear of offending their advertisers (ie. MS.)
It will be published on Ars and BoingBoing, and the people who make t
Sure... (Score:5, Insightful)
Re:Sure... (Score:5, Informative)
Parent
Re:Sure... (Score:5, Interesting)
The main issue with the Atom is that it does not do Out of order execution [wikipedia.org].
ARM processors do, so an equivalently speed ARM will easily out perform the Atom
Parent
Re:Sure... (Score:4, Insightful)
Famous last words.
Parent
Re:Sure... (Score:4, Funny)
In fact, it sounds kind of like naming your daughter, "Chastity" . . .
hawk
Parent
I long for the day... (Score:5, Insightful)
...when Slashdot news beginning with "Australian Government" won't necessarily end with a rephrasing of "shows off its technological naivety".
Same Govt. (Score:5, Informative)
Ignorance and arrogance seem to always walk hand in hand.
Re:Same Govt. (Score:4, Insightful)
And, of course, since we're already into "thought crime" territory here, how long until they make it illegal to even talk about what happened (since you obviously must be thinking about the video in some way to comment on it, you sick pervert!) At some point soon, this will have to be stopped.
Parent
MS must have given a great (Score:5, Insightful)
The PR reads like pure MS marketing slop with a cute upgrade hint.
Too late (Score:5, Interesting)
I just spoke to a friend in Australia.. its been pwned already using the nuke the bios and boot from a livecd method.
They even disabled the RFID.
Re:Too late (Score:5, Informative)
yeah, nuking the bios from a cd is ridiculously easy. It's actually a feature that people can do so. Hirens boot CD [hiren.info] comes with very simple methods for that.
I bet someone will just make an app that unlocks the laptop and wipes the firmware for them so that the laptops can have actual use.
Parent
Re:Too late (Score:5, Funny)
hey - some guy on slashdot said he talked to some other guy
who Australia who heard from somewhere that these computers
could be hacked
It *must* be true!
Parent
Re:Too late (Score:4, Funny)
I am not some guy, I am Anonymous Coward, I have more posts than anybody else here, and I am a trusted member of this community. Your sarcasm is completely out of place.
Parent
Re:Too late (Score:5, Funny)
Parent
Get me one of these and find out how long it lasts (Score:5, Insightful)
"Tracking software embedded at the BIOS level"? Last I checked, those "tracking schemes" just force-fed Windows some driver/app at the BIOS level. Install any other OS and it becomes useless (not to mention that BIOSes these days aren't even hard to hack). As for the RFID, I don't see how disassembling it and taking it out is rocket science. Nevermind that the students themselves are going to be owning any kind of app installation protection in the blink of an eye.
Sorry, using software to secure a platform against its physical holder has never worked for long, but even just trying to do it on an insecure platform like an x86 PC is beyond useless. None of this is has even a remote chance of working without the heaviest-handed TPM-on-CPU-die functionality and signing of each and every piece of software, but that has no chance of working because no one would want such a platform, it would be painful and expensive to develop, and it could never exist given the buggy and insecure nature of PC software in general.
Video game consoles with strong hardware security and tightly controlled software environments with little interoperability requirements get cracked all the time to run homebrew and/or pirate games, what makes these people think their little netbook won't be?
For what it's worth, Linux vs. Windows here makes little difference. The entire scheme is doomed to fail from the start due to the nature of a PC solution like this. Sounds like Microsoft just sold these guys a bunch of nonexistent security.
Unhackable like the Australian Porn Filter? (Score:5, Insightful)
so let me get this straight (Score:5, Insightful)
While the netbooks are loaded with many hundreds of dollars worth of software, 2GB of RAM, and a 6-hour battery, the cost to the NSW Department of Education is under $435 (US) a unit.
The netbooks have hundreds of dollars of software loaded and still only cost $435 a unit. So the cost of the unit is being subsidized and the department is hailing this as some big leap forward in cost of ownership? And some of the big changes are related to the BIOS.
Already, the department has noted the loss or damage of just six netbooks out of the 20,000 rolled out since August - and have tracked one teacher using their device on a field trip in New Zealand.
Yeah, really cool that the school can track and potentially monitor everyone using one of these devices, even if the machine is not physically turned on via the RFID tags. Now there's a big win.
DET also uses the AppLocker functionality within Windows 7 to dictate which applications can be installed on the device.
Even better. Add McAfee filtering to control content and MSFT's own antivirus technology...add up what all that would cost in a real world enterprise. Just the software costs alone would dwarf the cost of the device.
I look at the cost of the device, the software and all the centralized control and think, "Or just install Linux and get 95% of that functionality right out of gate." And the 5% you don't get is the spying and monitoring part. What lesson is the school teaching here?
This is certainly a win for someone, but I'm not sure it's the students and teachers.
Why? (Score:5, Insightful)
Re:Why? (Score:4, Insightful)
Parent
Haha.. no (Score:5, Informative)
I work for one of the departments involved, hence the anonymous post.
This is typical government posturing, and has nothing little to do with the what's actually going on.
From what I've seen, the RFID chips are redundant, they're using the machine's BIOS UUID to track machines through software, I don't think they even record the embedded RFID codes at all, as that requires a physical reader device, and they're not handing them out to schools. Normally, RFID tags aren't used for anti-theft, but for inventory tracking.
The BIOS tracking is pretty standard and off-the-shelf, it's not designed to stop professionals, but it will catch stupid thieves. Software protection is not huge, but most 'problems' will be met with an F12 network boot and a fresh system image, so the harm students can do will be limited and easily reversible. Students get limited space to save their work, and that is backed up centrally, so they shouldn't lose any data. On top of that, most questionable sites are blocked by the internet proxies, so that cuts out lots of potential sources of harmful stuff.
Really, the true protection the laptop gets is that every student receives one for free, but a replacement laptop has to be paid for out of their parent's pockets. Students will learn to be careful with them or face punishment from their parents.
There's lots of other silliness going on though, especially as it's my tax dollars going to waste.
For example, the enterprise agreement for the Adobe CS4 suite was a big deal. They spent millions purchasing the software before anyone had actually tried running any of it on an actual laptop. Only after the government had signed the contracts did they bother, only to find out that the screens were too small. All of the Adobe dialog boxes were designed for a vertical height larger than the physical screen resolution, so the OK/Cancel buttons are cut off. The workaround was to install a driver that supports a larger virtual desktop and pans the screen around. It's hideous. This is what happens when you let politicians make technical purchasing decisions.
Similarly, the laptops are rather anemic, which is expected for a netbook, but a lot of the software and content they want to publish is very video-centric. Apparently some types of video, like Flash content and h264, don't always play well, and high-res content is a slide show.
Re: (Score:3, Interesting)
I wonder how many 10's of millions of dollars will be spent on licencing fees? The entire infrastructure could have been built upon Linux distributions and tailored to the education departments requirements. As it stands I wonder if they even looked at a Linux distribution.
What waste of money.
From Lenovo? (Score:5, Insightful)
If I recall, China's People's Liberation Army is part-owner of Lenovo.
Exactly why do the Aussies thing there won't be back doors built into the hardware or BIOS?
Re:From Lenovo? (Score:5, Insightful)
If I recall, China's People's Liberation Army is part-owner of America.
Fixed that for ya.
Parent
Re: (Score:3, Insightful)
If Lenovo would build in back doors, and is found out, then at best they go bankrupt. I think that is enough of a reason for any company NOT to build in that kind of back doors. And they will be found: non-standard chips present in the hardware are a prime target for further investigation, and BIOSes can be flashed (or, presumably, the original software checked against known-good implementations or at the very least decompiled for investigation).
So even if the PLA is part-owner of Lenovo, why would you thi
Unhackable laptop? (Score:5, Funny)
etch-a-sketch!
There sure are a lot of stories on /. that... (Score:5, Interesting)
I've used one (Score:5, Informative)
There's a label on the bottom that threatens you that if you steal it the police will find you. There's tamper-proof screws, so normal phillipshead's wont do the job. The BIOS is obviously passworded, and I managed to break the bootloader of Windows 7 by pressing ESC twice. No OS found apparently.
For "secure" laptops, you can right click pretty much anything and run it as an admin. We ran cmd.exe as an admin to create a proper Admin account. Completely bypasses AppLocker. Apparently, according to the laptop admins, the government wont allow printer drivers that aren't already part of Windows 7, so no printing for you.
The laptop maintainers don't even have administrator access. They have to box the laptops up and ship them to a centre to be "fixed", even if it's as simple as reinstalling a driver. Pathetic.
It's only early days, and the nuking of the bios can be done easily, through Wubi or other means, but USB boot is disabled so you'll have to find alternative means. And I know it's likely moot to post so late after the rush, but I had to say it.
Btw, it's CS4 Elements, it's not the true suite. And it includes Dia, the open-source diagram editor, which I found odd. Open source deployments always amuse me.
To finish, Firefox is not included by default and has many issues when installing, as you don't have access to Program Files, so it confuses the installer to no end unless you change where you're installing it to.
These laptops require ethernet access to activate and are mapped to a single username, so good luck using it if you don't have a Department of Education account. The all have filtering software so no porn for you kids, even when at home. Myspace and Facebook are blocked even from home connections. It's a rather horrible crippled setup that I'd wish upon no-one.
Welcome to the future of computing. Homeschool your kids.
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Here though they have physical access to the device. You don't need to be an experienced black hat to take a hard drive, mount it in another machine, and modify /etc/shadow. Or possibly simply boot from a USB drive to do the same, in which case it really is script kiddie territory.
So stupid (Score:5, Insightful)
1: 240,000 kids would have gotten reasonably secure systems with useful software on them
2: People would have noticed how secure and safe the systems were, and appreciated the low rate of problems they experienced
3: Eventually, some smart students would have figured out how to bypass all the security so they can play world of warcraft or something, but nobody would have cared and it wouldn't have gotten any press
Instead, some asshat announces to the world "Bow to our unhackable laptops! We are awesome! HAHAHA!", and now thousands of hackers and security researchers out there have made it their personal crusade to find a way to totally decimate all the security on the box. You're right... It's gonna take about 1 month for an exploit for these things to make it to the front page on slashdot. Fucking idiots.
Footnote:
Yes, I'm aware that security through obscurity is no security at all, but that's not the issue here. The issue is that instead of nobody caring or trying to break the reasonable security they've implemented, now they've got thousands of people working on it. THAT does matter.
Parent
Re:So stupid (Score:5, Funny)
Footnote: Yes, I'm aware that security through obscurity is no security at all, but that's not the issue here. The issue is that instead of nobody caring or trying to break the reasonable security they've implemented, now they've got thousands of people working on it. THAT does matter.
Security through obscurity's little brother? Security through "meh"?
Parent
Absolutely (Score:5, Insightful)
Anyway, why would you go to such great lengths to slow down any individuals who might see a profit in cracking your systems, then go and piss off a bunch of 1337 haxxorz all over the world and get thousands of them working on the problem in parallel? Kinda defeats the purpose of using strong security in the first place, doesn't it?
Parent
Re:Absolutely (Score:4, Insightful)
All security, no matter what type it is or how it is implemented, is basically designed to slow down anybody who might try to break it.
I think you're confusing real security with poor security. Granted, often real security is difficult or impossible...
It is possible to create a system which is actually impossible to crack, short of social engineering or unprecedented changes in technology. Example: SSH keypairs. The last major vulnerability in this was due to a stupid, stupid flaw in the implementation. You can argue that such flaws are inevitable, but I'd argue that this is an argument about human fallibility, not about the theoretical limitations of a software system. Depending how much you're willing to invest, it's possible to write a program in such a way that you can mathematically prove it to be correct.
The only other way SSH keypairs are likely to be defeated is when quantum computers become feasible.
That said, I think it's unlikely they've created a truly invincible system with all the software they mentioned. There's likely to be a bug somewhere in Win7, CS4, Office, or Tunes.
Parent
Re:Absolutely (Score:5, Insightful)
By opening up, you can get a bunch of people working on your security to strengthen it, to help offset the few people who might be interested in breaking it.
But that only works for software you can fix, or you can get the vendor to fix. I highly doubt that's the case here.
Nobody is out to burn my house down, because nobody cares. But if I go out and shout, "My House is UNBURNABLE....MUAHHAHAHA!", there's a chance that some asshat will put a torch to it just to prove me wrong.
Security through obscurity doesn't work. Security through provoking asshats into action really doesn't work, unless you have the power to fix what they break.
Parent
Re:So stupid (Score:4, Insightful)
Exactly. The purpose of any lock is to provide a speed bump. Hopefully a big enough bump that you'll decide the effort isn't worth the payoff. This asshat increased the payoff 1000 fold in notoriety, and social recognition.
Parent
Roku is a perfect example of 'Meh' (Score:5, Insightful)
The Roku vidio player is an excellent example of security through "meh". It's almost an ideal box for a Boxee or MythTv frontend, but it is pretty much unhackable (cryptographically signed u-boot, kernel, and ramdisk). They've released their sources (but not their crypto key) months ago, yet not one single crack is available for it.
Why? Because (a) they don't make a big deal of the security features to the public, b) it's stupid cheap ($99 USD), and (c) It Just Works.
The combination of all three make 'meh'. Due to (a) there is no implicit challenge to the security community, (b) trumped the TiVo problem of trying to get 'more value for your money' out of an expensive piece of kit, and (c) prevents your Average Joe hacker from wanting to break a working (and useful to him) device.
Good counterexamples are TiVo, Linksys routers, and the Wii.
For TiVo, it was expensive enough that people wanted to get more value for their money, and felt it was time well spent to hack it.
With Linksys routers, It just Doesn't Work caused people to spend a lot of time finding a way to make some perfectly good equipment work at all for them.
The Wii advertised to the community that it was unhackable, which promptly cause all manner of security professionals to take up arms and figure out how to hack it.
Parent
Titanic Syndrome (Score:5, Insightful)
It's analogous to the Streisand Effect. And when the machines get hacked, the id10t who declared them "unsinkable" will experience Titanic Syndrome.
Parent
Re: (Score:3, Insightful)
Perhaps. But then again, this is Australia we're talking about. You know, the country who's government is despe
Re:So stupid (Score:5, Interesting)
>What is it with governments and hubris? If they had just shipped all these laptops without any mention of "unhackableness", you know what would have happened?
Here are some clues for why they announced such a thing. From the article: 'There was no way we could do any of this on XP,' he said. 'Windows 7 nailed it for us.' *and* the cost to the NSW Department of Education is under $435 (US)
Care to make a wager as to whether or not a certain large corporation in the Pacific Northwest gave them an extra special deal on the hardware & software on the condition that they praise Windows 7 over XP? I mean, they're purchasing netbooks and running Windows 7 on them instead of the lighter weight XP? Anybody else see anything wrong with this picture?
Parent
Re: (Score:3, Insightful)
find all imaginable security holes in Windows 7
No, they have challenged people all over the world to find all imaginable security holes in THESE LAPTOPS. Nobody cares about Windows 7, everyone knows that there will be hacks galore available for the next few years (though maybe fewer than XP?). The point is that they've said "Hey, anybody want to prove you're the world's greatest hacker? Pwn our boxen!". Guess what? Somebody will... and it's going to be big news, and the Aussies have set themselves up to look really stu
The Slashdot editor degraded the story. (Score:5, Informative)
'Instead, some[one] announces to the world "Bow to our unhackable laptops! We are awesome! HAHAHA!", and now thousands of hackers and security researchers out there have made it their personal crusade to find a way to totally decimate all the security on the box.'
However, the problem is with kdawson, the Slashdot editor, not the Australian government or the article to which the Slashdot summary links.
The article says, "[government] seeks to build 'unhackable' netbook network". The meaning is that the Australian government is doing the best it can in building a network.
kdawson, the Slashdot editor says, "... Government To Build "Unhackable" Netbooks".
kdawson made the title sensationalist and misleading. This amazes me: In all these years, Slashdot editors seem to have learned nothing about being editors. kdawson turned a wonderful story into a misleading experience.
Parent
Re:The Slashdot editor degraded the story. (Score:4, Informative)
Your obvious derision for kdawson notwithstanding, the "NSW seeks to build 'unhackable' netbook network" headline came from the itnews.com.au site, which you would have discovered for yourself if you had clicked the second link in the article.
Your anti-kdawson rant also misses the real point, which is that this "wonderful story," as you describe it, is nothing more than part of Microsoft's Windows 7 launch campaign. The real story lies in this paragraph:
Wow! That is incredible, and a real coincidence that this is occurring just as Microsoft prepares to roll out Windows 7.
What you should be taking Slashdot to task for is allowing this advertisement - replete with Microsoft marketing phrases like "Total Cost of Ownership (TCO) " and quotes from DET executives gushing that "There was no way we could do any of this on XP" - to run, instead of an insightful analysis of what this little Microsoft publicity stunt was really all about. Of course your TCO will be way down when Microsoft gives you enterprise versions of their software for free.
As someone mentioned above, this is a victory for "trusted computing," and other technologies for enabling corporations to control your hardware. Someone should write an article about that.
Parent
Physical access (Score:4, Insightful)
physical access >> root access
What I was referring to was the potentially useful but soon to be pummeled security the laptop could have offered to students who didn't lose or wipe their laptops. Too bad too.
Parent
Re:I dont understand ... (Score:5, Insightful)
I dont understand why this would be considered unhackable. Exploits have already been released for windowed 7.
It is quite simple: Microsoft said that it was unhackable, so as far as the idiot politicians were concerned it must be true.
What grates with me is that the Australian Federal Government is spending money training kids to use MS s/ware - something that will stay with them for the rest of their lives. The MS marketing department must be overjoyed.
What education should be about is understanding, if you just train someone in one version of s/ware many just adopt a point and click approach with little understanding of what they are doing. You need different sorts of s/ware to make them think. Schools should use a mixture of: MS, Mac & Linux PCs.
Parent
Re:I dont understand ... (Score:5, Insightful)
What education should be about is understanding, if you just train someone in one version of s/ware many just adopt a point and click approach with little understanding of what they are doing. You need different sorts of s/ware to make them think. Schools should use a mixture of: MS, Mac & Linux PCs.
You seem to have severely misunderstood the purpose of these machines.
Parent
Re: (Score:3, Insightful)
What education should be about is understanding, if you just train someone in one version of s/ware many just adopt a point and click approach with little understanding of what they are doing. You need different sorts of s/ware to make them think. Schools should use a mixture of: MS, Mac & Linux PCs.
I think it's a little more subtle than that. 90% of the kids using these things will go on to be standard users in life, treating computers as one tool among many. Have you seen how regular users treat computers? Most of them are uncomfortable using a new app without formal training -- even today's twentysomethings. Even on a Mac (yes, I'm a Mac guy).
What concerns me more are the other 10%, who will become power users, sysadmins, and developers. If all they know is MS and their pitifully low standards for s
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
To run a live CD of Linux... wouldn't the BIOS have to be set to boot from CD-ROM? The locked BIOS?
So, now you're cracking the case open, and disconnecting the (possibly soldered) battery and hoping the BIOS resets to factory defaults that haven't been set to include the lockouts.
Or, pull out the hard drive, plug it into another machine and do what you will - which might not do a lot of good if they've got the processor set to run signed code only.
I'd try pulling the hard drive and cloning it then playing
Re: (Score:3, Insightful)
Even in the community of nations, someone has to have the least competent government on earth.
I guess the USA lost that title in the last election...
Re: (Score:3, Insightful)
When the communities say I told you so, I wanna see Bill Gates cry.
The problem is that won't happen.
This was issued with great fanfare, press releases all around. What happens next week when it gets broken?
Nothing. Nobody will hear about it. The government isn't gonna issue a press release saying "oops, we were wrong", and the hackers that pull it off either won't have the resources to buy a feed in PR Newswire, or if they do, nobody will publish it, out of fear of offending their advertisers (ie. MS.)
It will be published on Ars and BoingBoing, and the people who make t