Hot answers tagged

267

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


163

You can know whether some software does only what it announces in the same way that you can know whether the food they serve you at restaurants is poisoned or not. In plain words, you cannot, but Society has come up with various schemes to cope with the issue: You can listen to friends and critics to know if the food at a given restaurant has good ...


95

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


65

Various commentators suggest that this would be possible, on the specific hardware involved in this case. For example, Dan Guido from Trail of Bits mentions that with the correct firmware signatures, it would be possible to overwrite the firmware, even without the passcode. From there, it would be possible to attempt brute force attacks against the passcode ...


63

The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that ...


58

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


57

In addition to the points mentioned by Lucas Kauffman I would elaborate on point two: 2.This algorithm generates one extra unique decryption key when used. This key is then sent via a secure channel (i.e. HTTPS or equivalent) to an NGO with the sole duty of guarding these keys. As soon as the tool gets confirmation that it is delivered, the tool ...


51

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


46

After doing some research, I now believe this is possible, but that it isn't very easy. Without getting too technical, if you look closely, Apple repeatedly implies that they can do it: The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers. But now the U.S. government has asked ...


45

Wiretapping case in Greece 2004–05: officially mandated but disabled interface for tapping into talks was used by unknown entity to listen to talks by high-profile politicians. Juniper VPN Backdoor: use of NSA mandated insecure random generator together with the modifications added by an unknown party allowed decryption of VPN traffic by third parties by ...


42

First off, I want to say that just because a company is big doesn't mean their security will be any better. That said, I'll mention that having done security work in a large number of Fortune 500 companies, including lots of name-brands most people are familiar with, I'll say that currently 60-70% of them don't do as much as you'd think they should do. Some ...


41

No. The backdoor is not on this script. This piece of highly obfuscated code contains a program to allow the hacker to dynamically append any HTML or javascript by randomly calling a server located at 31.184.192.250 with one of the four hostnames "33db9538.com", "9507c4e8.com", "e5b57288.com", "54dfa1cb.com". The deobfuscated code looks something like this: ...


36

You trust them because they distribute the software that runs your computer. Their processes run as root: you have to trust them because the computer is in their hands, more so than it is in yours. While you are the administrator of the machine, you use their tools to do your administrator tasks. The point he's making is that you can only run an OS ...


36

In what kind of software/webapplication/OS can I found them ? Literally anything. How can I recognize one ? By reverse engineering the software and carefully analysing it for flaws in authentication and access control, as well as issues with memory access in native applications. It's the same process by which you'd find any other vulnerability. ...


35

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor? No. Simply no. A backdoor is never considered safe. What you are describing is commonly known as a key escrow. Note that there have been issues with key escrows: On a national level, this is controversial in many countries due to ...


32

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


32

The /etc/ssh/moduli contains pre-generated group parameters for Diffie-Hellman. A DH key exchange occurs in the early steps of the SSH connection and generates the secret shared key which will be used for encrypting the data. DH works in a given group; technically, a modulus p (a big prime integer) and a generator g: the generator is in the 1..p-1 range, and ...


29

PCI DSS sections 6, 7, and 8 all bear on this question. For example, part of 6.3.2 which requires code review: Code changes are reviewed by individuals other than the originating code author, and by individuals knowledgeable about code-review techniques and secure coding practices. 6.4 with change control: A separation of duties between ...


29

The whole story is weird. Since the iPhone in question does not have a tamper-resistant device, the FBI should be able to open the case, read the whole Flash chip, and then run the exhaustive search themselves without even running the phone's firmware. Updates from Apple should have no effect at all. (Edit: in fact it is a bit more complex; see below.) ...


27

Could they actually accomplish this for an existing encrypted phone? Yes. They could provide a compiled image of os with anti-bruteforce features disabled. The fact they're making an open letter IMHO means they've already exhausted all excuses to not do so, implying they are fully capable of doing it. They would have to be able to auto update a ...


26

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


23

You can't, at least not with 100% accuracy. Speaking as a programmer, it's very easy to code in whatever I want, and it's not necessarily just what's advertised. Not all unexpected activity, however, is malicious. I'm assuming you're worried more about malicious activity. Even that is not 100% possible to detect all the time, but there's hope. You can ...


22

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


22

As the exploit gives root access to the Juniper device, an attacker can: Decrypt all VPN traffic to the device, thus allowing viewing of all traffic through encrypted tunnels that terminate at the Juniper box Edit firewall rules on the box, allowing an attacker to remove rules protecting assets within the network Alter routing tables where these are used, ...


22

Disclaimer: I work for a very big company that does a good job in this area, but my answer is my own personal opinion and is not indicative of my employer's position or policies. First of all, how to protect code from being leaked: Network Security: This is the obvious one -- if Chinese hackers get credentials into your internal systems, they'll go ...


19

Root on the box. So, "yes" to all. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search Exploitation of this vulnerability can lead to complete compromise of the affected system. Update: Password disclosed Rapid7 have disclosed the password.


18

To a not-insignificant degree, this is (as you mentioned) a trust issue, not a technical one. We try to be careful to as far as we can, hire trustworthy people who won't abuse their positions. That said, there are a number of controls that can be implemented to either limit unauthorized access, and/or verify that the trust in individuals is well-placed ...


17

Only Apple knows, but I'm going to guess they won't do it. I suspect the FBI has a pretty good idea what is and what isn't possible, especially since Apple has otherwise been cooperating with them. Also the people who work for the FBI aren't idiots, and I bet this isn't the first crime they've investigated with an iPhone. Furthermore, Apple's argument ...


16

I am not finished and I don't know whether I ever will. However my current results: The code itself is quite advanced (from my point of view). The code itself is shellcode http://en.wikipedia.org/wiki/Shellcode that tries to load a payload from a remote server. The code has at least one level of indirection. At first it looks like those are the server ...


15

When a legitimate law enforcement organization has need of a key to decrypt, it sends a formal request to the NGO. The NGO first analyzes the request based on the importance of the request. the NGO allows decryption when the suspect is strongly incriminated by other evidence, and only in the case of terrorism, murder or abuse of a minor (which are ...



Only top voted, non community-wiki answers of a minimum length are eligible