If the plan is perfectly executed, Nicholas Negroponte's One Laptop Per Child project will deploy 100 million laptops in the first year. In one fell swoop, the nonprofit organization will create the largest computing monoculture in history.

Wary of the security risks associated with a computing monoculture—millions of machines with hardware and software of identical design—OLPC foundation officials are seeking help from the world's best hackers to review the full specifications of the $100 laptop's security model.

"This is an enormous challenge for us," said Ivan Krstic, director of the security and information platform efforts for the OLPC project in Cambridge, Mass. "Security for these machines is hands down the hardest thing I've ever worked on."

Krstic has spent a large portion of 2006 slipping into security conferences around the world, schmoozing with hackers, trying to recruit computer security experts to look at the design and threat model and provide useful feedback.

"We want hackers to get in touch, look at the documentation, play with the machine, and try to break into it. We run the risk of getting parts of this wrong and that's not something we can afford," Krstic said in an interview with eWEEK.

A former director of research at the Medical Informatics Laboratory at Zagreb Children's Hospital, in Croatia, Krstic said he is well aware of the dangers of the monoculture. "If this succeeds, we'll have created the largest monoculture in the computer industry. To answer whether that's scary or not is a nontrivial question. The security implications are deeply frightening," he said.

The overall design goals have already been released to OLPC's security panel for review, and Krstic plans to publicly release the specs to generate feedback from the open-source community.

Krstic's team has already pinned down the security policy and threat model for the BIOS, the built-in software that runs when the machine is turned on. The machine, he said, will feature a completely secure BIOS solution that allows fully automatic upgrades without user intervention and fully protects against phishing and automated worm attacks.

"Many of these kids will have never seen a computer before; they won't have a clue about computer security. That means that a lot of mechanisms in computers today just won't work for them," Krstic said, stressing that everything on the laptop will be open by design and will not rely on passwords for authentication.

"One of the main goals is to provide unobtrusive security," he added. "We're doing security in a way that doesn't depend on the user reading or responding to a prompt on the screen."

The key design goal, Krstic explained, is to avoid irreversible damage to the machines. The laptops will force applications to run in a "walled garden" that isolates files from certain sensitive locations like the kernel. Even if the computer is damaged, the security model calls for a trivial reinstall of the operating system to put the machine back into full functionality.

Despite the security fears, Krstic is optimistic OLPC has a few aces up its sleeve. "We don't have backward compatibility on our list of concerns. That's a huge advantage," he said. Without having to worry about existing applications, Krstic said OLPC can actually define the security policy for every piece of software built for the machine.

"We can tell people, 'If you're developing software, this is the policy,'" he said. "We don't have to worry about thousands of apps that will retroactively break. It gives us an enormous level of control."

Still, there are crucial security decisions that are still up in the air. For example, the group is still brainstorming about whether to include automatic updates by default. Krstic is leaning toward implementing automatic updates, but, ideally, if the security model holds up, he expects OLPC to have a level of isolation between the operating system, applications and user data that will reduce the need to issue lots and lots of updates.

"If we discover vulnerabilities, the security model must hold up enough that even a machine that is unpatched won't be easily exploitable. This gives us a bit of diversity to avoid the monoculture trap," he said.

Originally published on Eweek
By Ryan Naraine, October 12, 2006