Unhackable Computer

[harpo]

I have had a idea in my head the last few days. That idea
was how secure can I make a computer. I began to have many idea's
first i looked at many major operating system's i looked at windows as most know its insecure in general macs a little less but still relatively insecure and then linux and even openbsd however they all seemed to be extremely insecure when someone had access them and it seemed to be as easy as entering a few commands at boot to become a root user. then I started looking at hardware and the bios and that it would load just about anything and run it having next to full access to memory (so not secure..) After looking at these I thought about how i could make a computer in theory very hard to hack/steel information from it. so what about making a computer with no frame of reference to any modern day system? to have a cpu I could make out of transistors and a operating system running on binary with custom opcodes and a operating system with a new syntax and custom encryptions and hell why i'm at it why not make up a language for file storage (instead of English) thought's? and how hard do you guys think something like this would be to breach?
(please no comments about this being impossible i have many things I have done for proof of concept)

[Soeren]

Hi,

[...] thought's? and how hard do you guys think something like this would be to breach?
(please no comments about this being impossible i have many things I have done for proof of concept)

Sure it's possible, just live for at least 500 years (probably 4 times as much) and spend every hour awake on doing this. It will be hopeless inferior though as other computers move onwards with greater pace.

You may be very optimistic about your own abilities (oh the joy of being young  ) but for a bit of a reality check, get the number of man hours it took to develop any of the mentioned OS's.
Besides, there's no need for you to solder together 500,000 transistors or more, just use what's already there.

Anything can be hacked, real hacking is about analyzing sequences and make order out of the seemingly random.

The only truly un-hackable computer is one locked into a vault with no online access.

If you're scared someone will steal your pictures of Pamela, just disconnect from the web

[harpo]

XD o nothing so amazing as that just a little 4 bit computer for a physical proof of concept and a basic os which if i find more time may expand on.
my main idea for the project is make it as different from other computers as possible mainly in the syntax and internal communications systems such as file storage and cpu command structure (op codes)

[Redcap]

It sounds like quite the undertaking

Ultimately it'd depend on what you classify as "hacking".
From what you've written, I'll assume you mean unauthorized access.
There is however hardware hacking, software hacking, hacking/cracking into computer systems, manipulating people/the user etc etc.

To make any computer unhackable, simply turn it off, unplug it and never use it lol
This of course isn't much use at all, though 
(Edit: As Soeren's also mentioned )

Typically, with current systems, it can be seen as a balance between (paranoia/)security and usability, so to be able to separate the two would be very impressive. IE; full security and full usability.

[Cristi_Neagu]

You should have had a look at Android. For example, take any Android powered phone. Indeed, it is relatively easy and safe to root it, but how do you do that if you don't have an USB port and/or debug access to the device?

Secondly, it's very hard to make hardware uncrackable. Software provides the defenses. Android is one of the safest OS out there because of two reasons:

1. The ARM processors, by design, use two levels of access: a root level, and an user level. Obviously, running a thread as user doesn't give you full access to everything.
2. The Android platform itself uses that design feature, and all the apps that you run on it are run as user threads. That's why there are no viruses for Android. Each and every app runs in something similar to a sandbox.

It's hard to do what you want, because no matter how smart you are in designing your defenses, someone smarter than you will come along.

P.S.: i'm not exactly an expert in the Android platform, nor regarding ARM processors. I just started reading up on them. So while my explanations above are somewhat true, I doubt they are 100% accurate.

[Soeren]

Hi,

Android is one of the safest OS out there because of two reasons:

1. The ARM processors, by design, use two levels of access: a root level, and an user level. Obviously, running a thread as user doesn't give you full access to everything.
2. The Android platform itself uses that design feature, and all the apps that you run on it are run as user threads. That's why there are no viruses for Android. Each and every app runs in something similar to a sandbox.

[...]

P.S.: i'm not exactly an expert in the Android platform, nor regarding ARM processors. I just started reading up on them. So while my explanations above are somewhat true, I doubt they are 100% accurate.

A very wise P.S. 

What you wrote holds true for Windows as well and we all know that Windows is an unconquerable fortress

Just wait a while and you'll see Android hacked, cracked, defaced and virus'd. The more marginal a product is, the safer it generally is, but Androids are still on the rise.

The best defense (bar powering off permanently) is invisibility/anonymity - if people don't know there's anything to hack, they won't attempt is (obviously).

Apart from that, it's like the locksmith/burglar race; the locksmith invents a safer lock, the burglar spends some time learning to pick it and the locksmith is back at the bench etc. etc. an eternal Merry-Go-Round.

However, your lock just needs to be slightly safer than your neighbors locks, to keep your belongings safe - an antisocial statement, I know, but that's how it is these days, houses will be burgled and sytems will be hacked - best thing you can do, is to make sure that it happens to some other fine people

[voyager2]

Personally, if you want to make something "unhackable" , open source the lot!
I have never seen a piece of legitimate open source software/hardware "hacked" for malicious purposes 
If its open sourced then the guy who would hack a closed source system will be developing for you. 


However, If what Soeren says here is true...

Anything can be hacked, real hacking is about analyzing sequences and make order out of the seemingly random.

then something that is completely random cannot be hacked.

Program an FPGA to program itself with a randomly generated program:

Code: [Select]

Start of loop
Every loop generate new code that can also generate code.
Program the new code to the FPGA.
Change the programming pins.
GOTO start of loop

You cannot hack something that is random!



Nor can you hack something that doesn't provide output.

It would be like shooting a specific raindrop with a bow and arrow while wearing a blindfold, and driving a car down a bumpy road.
If someone has done this then I will eat my keyboard.

Rem that its is hard to hack even an "impenetrable fortress" like Winslowz.
And most hackers take it as a personal insult if they cannot hack something, and they will try and try again!!! 


XD my longest post ever!

  Voyager2

[Soeren]

Hi,

Personally, if you want to make something "unhackable" , open source the lot!
I have never seen a piece of legitimate open source software/hardware "hacked" for malicious purposes 

You mean like Linux?
Boy have I got news for you

[...] You cannot hack something that is random!
[...] Nor can you hack something that doesn't provide output.

Agreed!
However, the usability will be absolutely zero

And as a side remark, true random cannot be made, only pseudo random and given the time, it will turn up as perfectly non-random sequences, so I guess you need to reconsider dinner

Rem that its is hard to hack even an "impenetrable fortress" like Winslowz.

Hard?
Don't make me ROFL, hackability is an inbuilt feature

[voyager2]

Anyhow, no mater what OS you use:

The Best Anti-Theft, Anti-Hacker and Anti-Virus software is
between your ears and under your scalp!

And it's 100% FREE

[Redcap]

You mean like Linux?
Boy have I got news for you

Once again, beat me to something, Soeren matey

Also, Windoze may as well be called "OpenDoorz"

The Best Anti-Theft, Anti-Hacker and Anti-Virus software is
between your ears and under your scalp!

Actually it can be hacked...
"Brainwashing", hallucinations, optical illusions, social engineering etc.
And if it's Anti-Virus, why am I sick /chuckles

I dare say it's only a matter of time, (when we finally start getting brain implants, uplinks etc etc) 'til the brain becomes an actual hardcore target for hackers...

[Ryder]

Actually, it's not all that hard... simple operating systems are written by individuals or small teams in school.  Some kid named Bill Gates wrote one.  You may have heard of him.

The idea presented here is a good one.  Departing from known OS's and not documenting anything about how the system works goes a long way to prevent hacking.  Limiting the system's exposure to the outside world would too.

In the end, nothing is 100% secure...  but consider, American forces in WWII used American Indians to transmit voice communications in the clear in Indian languages... which had a structure and syntax that the Japanese could not begin to understand, and if I recall correctly, were 100% secure throughout their use.

Unhackable?  No.  Very very difficult to hack... yes.

[newInRobotics]

Secrecy is never a good way to secure something, because as time passes by there will be someone monitoring the system in question and trying to figure out how it works, once it is done, system can be hacked.

Creating computer and/or OS without publicly available documentation about it, defeats the purpose of it being created - for people to use, as no one will be able to develop it further, develop for it and use it for individual needs (and that's what people need).

Have a look at current security technique - hashing, it is based on very simple maths and is publicly available, however it is impossible to decode (so far). So, if Your password and username in SoR database is in a form of hash, Admin can post it on Facebook, Twitter and to Anonymous group itself, still no one will be able to log-in using Your credentials.

Nowadays computer systems are quite secure as long as people administrating them do not do mistakes and aren't lazy, but that just human factor and not an issue with the system.

[Ryder]

Secrecy is a bad idea so, you would publish details about the system, and believe that would do make it less hackable?

Makes no sense.

A piece of hardware, fully unique without any information available is *obviously* a good idea.

[Ryder]

"Creating computer and/or OS without publicly available documentation about it, defeats the purpose of it being created"

You don't know that.  Read the base note.

If I wanted a computer controlled... I dunno... home... and did not want it hacked... why the hell would I want to tell the public about my custom operating system?

Again, makes no sense.

Do you think that ICBMS have operating systems?  Do you think there is public information about the operating systems for ICBMs?

If I were making ICBMs, I'd have an operating system that is fully unique to that class of weapon, and publish absolutely nothing.

[newInRobotics]

If system is for Yourself only - yes, You can keep it a secret, the drawback is - system will die together with You. If everyone was thinking like You do, there would be no technology for us to use today.

You shouldn't put ICBMs to this discussion, as they are totally different matter. These are mass destruction weapons. Believe me or not, these systems are well documented, however, these documents are available only to small number of people. Sooner or later - techniques behind ICBMs will become public knowledge. If You try to deny that - then have a read: Iran may have captured U.S. stealth drone by hacking its GPS.

Secret algorithm does not guarantee long term security, where algorithm based on clever maths - does. Same goes with computer/OS security.

Secrecy is a bad idea so, you would publish details about the system, and believe that would do make it less hackable?

No, I would base my OS on clever maths, then publish those algorithms, so others can develop them further, find week spots and fix them (or hack into the system showing week spot for others - including developers of the system). Does that make sense?

Linux is open-source (that probably does not make sense to You) and is one of the safest OS in the world. Why? Definitely not because it is kept in secret, source code is publically available.

[chelmi]

Secrecy is a bad idea so, you would publish details about the system, and believe that would do make it less hackable?

Makes no sense.

A piece of hardware, fully unique without any information available is *obviously* a good idea.

It is actually the only thing that really makes sense. Lets take an example: every secured connection over the internet is done using SSL (or TSL as it is now known). It's been used by everybody since the mid-90's and is still secure (after a few glitches in the initial versions). Why? because everything is known. The security comes from the algorithms themselves, not their secrecy.

On the other side, a security system based on obscurity is doomed to be broken as soon as it will get enough "attention". People will eventually get the information they want about your system, whether you publish it or not. And they can be very resourceful: I attended a presentation of a guy who successfully retrieved a secret key from chip just by looking at the power consumed by the chip (http://en.wikipedia.org/wiki/Power_analysis). Of course this is probably not practical to be used in "real life" cases, but you get the idea

Good reading on the subject: http://en.wikipedia.org/wiki/Security_by_obscurity

[Soeren]

Hi,

Do you think that ICBMS have operating systems?

That depends a lot on your definition of an OS and besides, weapons have vastly different structures compared to those of PC's and the like - luckily, I'd have a really bad day, if one of the US ICBM's got a BSOD on its way to the arch enemy, especially when/if it passes Copenhagen

[Redcap]

Just to add to the whole open vs closed source side discussion,

If it's for the public and is closed source etc, you're going at have at LEAST one person, somewhere, "needing" to know how it works. Pouring every spare second they have into unraveling its secrets.

If it's open source, everyone know all its inner workings. You'll then have some who obviously try to exploit it, and will do so at a much faster rate than in the closed source scenario, however, you'll now also have people working to make it better, to fix the problems etc.

[Ryder]

If system is for Yourself only - yes, You can keep it a secret, the drawback is - system will die together with You. If everyone was thinking like You do, there would be no technology for us to use today.

You have to pay attention to what the questioner asked: " how i could make a computer in theory very hard to hack/steel information from it. so what about making a computer with no frame of reference to any modern day system? "

There is nothing whatsoever about this question that says "marketable" or "promoting technology for all" or any of the other assumptions you are making.  It is a question SOLELY about how to make a computer that is very secure.

You shouldn't put ICBMs to this discussion, as they are totally different matter. These are mass destruction weapons.

How do you know that the questioner is not asking this question precisely so that he can design a secure computer for a weapons system?  Of course I should bring ICBMs in to the discussion, if only to remind all that computers are not necessarily just for mass consumption and the promotion of technology.  Sometimes security at all costs is what is called for.

Believe me or not, these systems are well documented, however, these documents are available only to small number of people. Sooner or later - techniques behind ICBMs will become public knowledge. If You try to deny that - then have a read: Iran may have captured U.S. stealth drone by hacking its GPS.

which is as I said.... not that documentation is done, but rather that it is PUBLISHED.  Words mean things.  The EVENTUAL understanding of an aged weapon's OS misses the point entirely.  Either a hidden/unique OS is more secure than windows, or it is not.  Period.  All you need to do to keep your weapons secure is to keep making NEW weapons with NEW operating systems that conform secrecy.

Keep in mind that the questioner did not spend a single word describing a need for "long term" security... only the highest possible security.

Time is the enemy to ANY secure system, so that's a no-brainer.

[newInRobotics]

I see Your point. If one want to create an OS/Hardware platform for one shot operation - it would most likely work, as no one would know about it's existence. But don't You think that's a bit short sighted thing to do? After one contact with the outside world someone would want to know what that system is.

If system is for Yourself only - yes, You can keep it a secret, the drawback is - system will die together with You. If everyone was thinking like You do, there would be no technology for us to use today.

You have to pay attention to what the questioner asked: " how i could make a computer in theory very hard to hack/steel information from it. so what about making a computer with no frame of reference to any modern day system? "

There is nothing whatsoever about this question that says "marketable" or "promoting technology for all" or any of the other assumptions you are making.  It is a question SOLELY about how to make a computer that is very secure.

You also have to pay attention to what others say  I did not have in mind marketing and promotion, what I had in mind was longevity of systems created so far which are based on systems created before and so on, and so on. My point was that if everyone would have built unhackable systems based on obscurity, today we would not have technology we use.

All you need to do to keep your weapons secure is to keep making NEW weapons with NEW operating systems that conform secrecy.

That's one way to do it, and a very expensive way I would say, as it requires thousands of man hours and resources. Don't You think that a much better plan is to build something rigid on it's own right and then improve upon it rather than create something from the scratch again and again, and again?

[Ryder]

That's one way to do it, and a very expensive way I would say, as it requires thousands of man hours and resources. Don't You think that a much better plan is to build something rigid on it's own right and then improve upon it rather than create something from the scratch again and again, and again?

I don't know... don't you think that this would mean that we should never have invented PGP, and instead built upon... say, the enigma machine?   Build on old compression technology instead of making new ones?  Built on MSDOS and not invented linux?

I think what is happening is that your KNOWLEDGE builds... you don't have to keep an OS... and again, the discussion is NOT about how to prevent wasting thousands of man hours.  It is about creating security.

[newInRobotics]

I don't know... don't you think that this would mean that we should never have invented PGP, and instead built upon... say, the enigma machine?   Build on old compression technology instead of making new ones?  Built on MSDOS and not invented linux?

That's exactly my point. PGP is built on previously created public "clever math" algorithms and not something that was kept in a vault, as opposed to Enigma Machine which was secure as long as people did not know about it, when they did find out about it:

In December 1932, the Polish Cipher Bureau first broke Germany's military Enigma ciphers. Five weeks before the outbreak of World War II, on 25 July 1939, in Warsaw, they presented their Enigma-decryption techniques and equipment to French and British military intelligence.[3][4] Thanks to this,[5] during the war, Allied codebreakers were able to decrypt a vast number of messages that had been enciphered using the Enigma. The intelligence gleaned from this source, codenamed "Ultra" by the British, was a substantial aid to the Allied war effort.

It is about creating security.

... hopefully NOT by obscurity 

[bobthefirst1]

For os:
U probably don't want a major os cuz those r the vulnerable ones
Also, google "tpm"

I probably wasn't very helpful sorry