Tag Info

Hot answers tagged

224

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


155

You can know whether some software does only what it announces in the same way that you can know whether the food they serve you at restaurants is poisoned or not. In plain words, you cannot, but Society has come up with various schemes to cope with the issue: You can listen to friends and critics to know if the food at a given restaurant has good ...


85

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


63

The wording of that sentence may seem a bit worrying because in a way it implies that they have root access as a backdoor that is already installed and in use. The truth is that it was just bad wording from Mark and what he tried to explain is that, yes, they have potential root access to your machine because every package update runs as root and at that ...


44

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


44

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


33

You trust them because they distribute the software that runs your computer. Their processes run as root: you have to trust them because the computer is in their hands, more so than it is in yours. While you are the administrator of the machine, you use their tools to do your administrator tasks. The point he's making is that you can only run an OS ...


27

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


22

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


22

You can't, at least not with 100% accuracy. Speaking as a programmer, it's very easy to code in whatever I want, and it's not necessarily just what's advertised. Not all unexpected activity, however, is malicious. I'm assuming you're worried more about malicious activity. Even that is not 100% possible to detect all the time, but there's hope. You can ...


20

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


13

The /etc/ssh/moduli contains pre-generated group parameters for Diffie-Hellman. A DH key exchange occurs in the early steps of the SSH connection and generates the secret shared key which will be used for encrypting the data. DH works in a given group; technically, a modulus p (a big prime integer) and a generator g: the generator is in the 1..p-1 range, and ...


13

I am not finished and I don't know whether I ever will. However my current results: The code itself is quite advanced (from my point of view). The code itself is shellcode http://en.wikipedia.org/wiki/Shellcode that tries to load a payload from a remote server. The code has at least one level of indirection. At first it looks like those are the server ...


11

You have a professional responsibility and an ethical responsibility to ensure this is addressed, IMO. And you've stepped into a minefield. Protect yourself. Watch your step. Go slow. Think defense-in-depth. I successfully solicited a whistleblower, who has been able to maintain anonymity. The solicitation included advice on maintaining anonymity; ...


11

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed. Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...


10

Your reaction is sound, and on a gut instinct level means that you care about one or more of: your customers' privacy, your company's public image, your codebase's quality, your own skin. In my workplace, I would be senior enough to know it a security bug (and not there by company intent, or mandate from the government) - and remove it. It sounds like this ...


10

Treat it as a security vulnerability you have discovered and report it to to, for example, CVE. Anonymously if you wish.


10

Basically, every disto has it's own repository servers, which are the default option for the installed system to fetch packages from. This means that when you install a new package or download updates these are downloaded from those repositories. You (we) trust the repo maintainers that the packages they upload are not malicious. Most of the official ...


9

It depends on what your requirements are. A sufficiently complex and well-designed system could be used to identify the most simple backdoors or trapdoors in most programming languages. However, if a language is Turing complete, any single expression or function can be expressed in an infinite number of ways, which makes such analysis equal to the halting ...


9

Especially as software becomes larger and more complicated, it becomes impossible* for even experts to answer that. To that extent, privacy and security from an application are best handled by using sandbox or Mandatory Access Control methods. The idea is behind these methods is that the software is run in a system that controls what it can do and you permit ...


8

You have a known security vulnerability, and your company is only one of an infinite number of parties which could exploit it. Any exploit of that hole, by any party, could reasonably result in a liability the scale of Sony's after the root kit fiasco. Their cost in both dollars and reputation soared into the hundreds of millions of dollars, in a directly ...


7

In his widely known ACM Turing Award Lecture "Reflections on Trusting Trust" (now almost exactly 30 years ago!) Ken Thompson said "You can't trust code that you did not totally create yourself." In practice commercial software are no exception to other commercial products in that those from producers having good names on the market usually have a higher ...


7

If some people have put some hidden backdoors in your system, and if they were competent at it, then you won't be able to find them. "Competence", here, means "having an Internet access and typing 'rootkit mac os x' in Google". See e.g. this. It is theoretically impossible to completely hide a backdoor, but only in the same sense that it is theoretically ...


7

Edit: it so happens that the first version of the question was talking about Ken Thompson's classic essay, so my answer was about it, too. It would be a shame to delete it, so I leave it at the end. Now, for the "updated" question: we now speak of something completely different, which is about the easiness of "hiding a backdoor in plain sight", namely in ...


7

Ubuntu's installer and package manager run as root. They have to: that's the only way it can install an operating system. It also installs programs that run as root. Other Linux distributions (and other operating systems, for that matter) are no different, even though the exact particulars may change a little: Ubuntu just happens to be in scope for this ...


6

It's ok to worry about it, don't worry, your reaction is normal ^^ I would do one of two things: I would update the user agreement explaining that this possibility exists, therefore asking for the user's consensus (if the people in charge really don't want to take the backdoor away) I would remove the backdoor completely (better option in my opinion) ...


6

There is no reason to assume that because another program can decrypt an AES encrypted file that it's backdoored. AES is a standardized form of encryption, so if your proprietary protocol implements this standard, then it's quite normal that you can decrypt this data with openSSL as well (which also follows this standard).


6

Whenever you run sudo apt-get upgrade you're downloading a .deb package from the Ubuntu repositories and letting the installer run under root (you know, sudo) to install it. If Ubuntu wanted to manipulate one of the packages and include a backdoor, they can, and you probably will never know it. You, implicitly, trust Ubuntu not to include a backdoor in ...


5

A chip is basically works like this: It gets some input (commands and data), does some calculations and generates some output. It may have internal memory. FPGA (Field-programmable gate array) are blank standard chips that are "programmed" by the customers on the gate level (very close to the hardware). Smartcards Let's take Smartcards as an example: The ...



Only top voted, non community-wiki answers of a minimum length are eligible