365

I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval.

We are not using this option, and it is probably there by mistake. But the people who are responsible for this system don't see it as a big deal. Because “We are not going to use it”…

Am I wrong for going ballistic over it?

What would you do about it if it was your workplace?

This question was IT Security Question of the Week.
Read the Jun 16, 2012 blog entry for more details or submit your own Question of the Week.

24
  • 50
    Which carriers use your phone, so I can switch out my provider if necessary? May 17, 2012 at 18:53
  • 148
    one word wikileaks
    – user9818
    May 17, 2012 at 22:13
  • 85
    I call bullshit on "we're not going to use it". You don't put that kind of backdoor in unless you absolutely plan on using it, or giving it to someone else to use. Blow the whistle. May 17, 2012 at 23:23
  • 40
    "What would happen to our reputation if it became public that we had a backdoor on all those phones?" That question will force a patch ...
    – schroeder
    May 18, 2012 at 4:37
  • 33
    I need a nuclear bomb. I am not going to use it. I just need it.
    – Jus12
    May 20, 2012 at 14:53

22 Answers 22

319

Just because they won't use it, doesn't mean someone else won't find it and use it.

A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money to fix. And what will your company say when people ask why the software contained that backdoor in the first place? The company's reputation might be damaged forever.

The risk is certainly not worth having it in the code.

8
  • 76
    +1 All things should be documented and shared with the user. No backdoors, should be allowed. MSFT even went as far as banning harmless easter eggs from all software since it implies that code contains hidden features & functionality. Your company should follow the lead of Trustworthy computing or risk going down a rabbit hole they may not recover from (bad PR, lost sales, etc) May 17, 2012 at 18:51
  • 65
    +1 "But we're not going to use it" is the worst excuse for a backdoor. If you're not going to use it, then what's the point? Someone else will, almost guaranteed. At least if you plan to use it for some reason, it has a reason for being and you can weigh the risks involved. May 17, 2012 at 23:48
  • 2
    It's unrealistic to assume that everyone in a large company thinks in the same way, so one person saying "But we're not going to use it" doesn't mean much unless it is backed by explicit policy and repercussions against those who use it. Unlikely to happen if the powers that be are happy to even have it exist.
    – Burhan Ali
    May 18, 2012 at 5:21
  • 10
    @makerofthings7 Just to be clear on your MSFT statement. They didn't intentionally stop it because those chose to. They were court ordered by law to stop it. "to supply certain government agencies with software, Microsoft can't include undocumented features, including Easter eggs". May 19, 2012 at 0:28
  • 10
    Software is just like a contract. If you see a clause in a contract that could get you REALLY screwed over you don't sign the contract until they take it out. Them saying "but we're never going to use the clause" is just silly. It only takes one upset employee who knows about it to do mega-damage to your company. May 20, 2012 at 9:15
116

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's bad enough, I would go to the FBI about it. (Or whoever has jurisdiction over computer security if you're not in the US.)

If your company knows about the problem and doesn't care, then exposing it is the only ethical course of action. And if they attempt to take retaliatory action against you, you may have legal recourses available, depending on the circumstances and the laws where you live. (Talk to a lawyer about that if you think it might apply in your case.)

6
  • 37
    +1 Because I agree with the idea, but I think you will probably lose your job, and you will have to spend the rest of your life harvesting apples because no one else is going to hire you... This is not an easy decision to make.
    – yms
    May 17, 2012 at 22:08
  • 4
    @Mason Could you reference the legal provisions that are offered to protect whistle blowers in this type of scenario?
    – Rob
    May 17, 2012 at 22:09
  • 2
    @Rob: That's interesting. When I looked at it some more, it looks like whistleblower protection laws generally only apply to government employees. I'll edit my answer. May 17, 2012 at 22:34
  • 8
    There's a whole US government website dedicated to whistleblowers, including those who are reporting on breaches of "violations of ... consumer product .. and securities laws." There's likely to be something similar, in most rich countries..
    – naught101
    May 18, 2012 at 0:33
  • 3
    It is not obvious to me that (1) exposing it is the only ethical course of action; (2) the FBI has jurisdiction or interest; and (3) there is any legal recourses for whistleblowers. What is the difference between an undocumented feature and a poorly documented feature?
    – emory
    May 20, 2012 at 20:27
69

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2].

But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ProFTPD [5] or Hushmail [6], to name a few.

And don't forget the OSes: M$ is always ahead with its NSA_KEY [7][8], but also OpenBSD [9] and the Linux kernel [10] can't be considered 100% safe. We also have paid attempts to gain a backdoor access to Skype by NSA [11], that, however, has been assessed as "architecturally secure" [12].

Moving down to firmware, nowadays we are almost acclimatized in having people from our ISP that are able to watch inside our routers (yes, maybe even see our beloved WPA password), but these [13][14][15] can surely be considered as backdoors too!

Finally, a few considerations on hardware and BIOSes [16], and (this is both funny and somehow dramatic) EULAs [17][18], because also lawyers have their backdoors.

Ok, given this preamble, I'll try to answer to the question briefly. No, you're not wrong getting mad for this thing, but you should focus your anger on the correct motivation. You should be angry because you lost a piece of trust towards the company you work for, not for the fact of the backdoor itself (leave this anger to the customers).

And if I were you, I'll just be very cautious. First, I'll make really really sure that what I saw was a backdoor, I mean legally speaking. Second, I'll try in any way to convince the company to remove the backdoor.

You probably signed a NDA [19] with your company so your question here could be already a violation. However I don't know where the NDA ends and your state law begins (it could be even customer fraud), and probably, due to the technicality of the subject only a highly specialized lawyer could help you with this matter. So, if you want to proceed, before doing anything else, even talking to the authorities, you should hire a very skilled lawyer and be prepared to lose a lot of time and money, or even the job.

9
  • 6
    The PGP case does not seem like a backdoor to me. May 17, 2012 at 23:57
  • 4
    The Skype article seems out of place. It was written in 2009 and even the article makes it sound like Skype decline offers to create a backdoor.
    – Ramhound
    May 18, 2012 at 13:09
  • 45
    I think your huge number of links is extremely misleading. Reading it over at first, I had the impression you were pointing out all these instances of backdoors. Then, I went back to read the links, and I found a couple instances of genuine backdoors, most of which were not secrets, a hacked server hosting a malicious version of a piece of software for a short period of time, and then a mixture of things which were all not backdoors: failed attempts at backdoors, falsely identified non-backdoors, unsubstantiated rumours about backdoors, and theoretical discussions of potential backdoors. May 19, 2012 at 5:11
  • 10
    The linux kernel link from 2003 is hardly damning
    – jamespo
    May 19, 2012 at 9:56
  • 6
    +1: The question does seem to use over-linking to improve it's legitimacy. Which looks kinda bad. However, Two points really stand out: * You should be angry because you lost a piece of trust towards the company you work for, not for the fact of the backdoor itself (leave this anger to the customers): Couldn't have said nay better. * I don't know where the NDA ends and your state law begins [...]: It's always nice to remember that no signed contract can violate the country/state law in wich it is signed. IANAL, but already heard this from one.
    – pkoch
    May 19, 2012 at 21:47
55

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone outside the company discovers this before you fix it.

Fixing this issue isn't just ethical, it's essential for your company's survival. It's far, far better to fix it quietly now than a week after all your users and customers have left you because it was revealed by some online journalist.

4
  • 1
    I totally agree. They may not understand the moral/ethical arguments, but if you force them to follow the money trail, you'll get their attention. May 18, 2012 at 14:00
  • 1
    +1. And if they refuse, mind your own business. I am old enough to know that morality means nothing. They are your friends. They pay you. You are responsible to them, not society, unless your ass can get fried.
    – user4951
    May 19, 2012 at 13:50
  • 10
    @JimThio: he could be sued and possibly face criminal charges if the backdoor is used, even if (perhaps especially?) if it's not his company doing it. And morality exists, no matter your age -- it just doesn't guarantee you a happy ending.
    – jmoreno
    May 19, 2012 at 15:02
  • 1
    I would be very careful in how I'd present the "what happens to us when somebody finds and publishes this?" issue, not to make it sound like a direct threat. The decision makers behind all this are obviously already arrogant enough (if they can brush aside with such issues), and reaching a belief that any disagreement with them is a direct threat might be only a hint of a doubt away.
    – TildalWave
    Mar 6, 2013 at 2:32
34

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself.

Imagine this scenario:

  1. You inform management about the backdoor. Now they know you know.
  2. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin.
  3. Your management finds out about Evil Hacker ZmEu's pastebin.
  4. Your management blames you, and fires you for cause, over your protestations of innocence.

Most security vulnerabilities get discovered multiple times. You won't be the only one to find it, you'll just be the most obvious one to make a scapegoat of.

6
  • 12
    It can get even worse, he can be sued for the backdoor as one of the persons involved in the process (he knew about it but continued to be involved)
    – user9850
    May 18, 2012 at 7:34
  • 1
    @lechlukasz Yeah, he should at least quit ASAP. Later he might well be the FBI's star witness over whatever the heck this is. May 18, 2012 at 23:28
  • 1
    Dear D.W.: Have you ever been accused of something by management? It's not a legal process, you don't have representation, and usually no appeals exist. We're talking scapegoating here, not Justice. Also, Courts, not "legal professionals" determine innocence, guilt and the validity of basis of action. You're just trying to prop up the authority of legal professionals. May 21, 2012 at 13:42
  • 1
    If ZmEu just "puts something on pastebin", this is certainly not the most evil a hacker can be. Jun 9, 2012 at 19:30
  • 1
    What if your company doesn't want to share with you the real reason of that backdoor? Just for a moment it pops in my mind: "government". If the government is behind that, going to some governmental authority may not solve the problem (all depends in which country are you).
    – lepe
    Jul 1, 2015 at 2:09
27

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;)

If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the level of risk in the proper forum to the best of my ability. So, if you are employed at a level where you can accept risk, then it's up to you to decide whether or not this is OK. Based on the post, however, you are not at a level where you can accept risk on behalf of the company. So all you can probably do is communicate the risk in a way that the business area can understand, and then let the business area make an appropriate business decision using all of the information available to them.

The thing you do have control over is accepting the risk to yourself posed by working for a company which makes decisions which you think are bad. Your available means of mitigating that risk are documented at Monster.com and friends. :)

0
23

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been.

As far as I know no one of the companies involved in creating GSM got into any legal trouble about the affair. Government agencies like the NSA liked the fact that they had backdoors. At the moment there are people inside the government that want to mandate backdoors for every communication platform.

I think there a good chance that the backdoor exist because some other entity like the NSA wants it to be there. If people higher up in your company made a deal with the NSA they probably won't tell you when you come them to complain about the backdoor.

For all you know it could be the Mossad that's paying your company to keep the backdoor in the software.

A clear backdoor into a modern smartphone is probably worth 6 figures or more on the black market. An employee could sell it or could have been specifically payed to put it there.

On the other hand if the backdoor really just exists because the higher ups in your company are to ignorant than you might be able to explain to them it it's a serious issue.

15

You have a professional responsibility and an ethical responsibility to ensure this is addressed, IMO. And you've stepped into a minefield. Protect yourself. Watch your step. Go slow. Think defense-in-depth. I successfully solicited a whistleblower, who has been able to maintain anonymity. The solicitation included advice on maintaining anonymity; take a look.

Check you're not re-blowing the whistle on something already known - like the Carrier IQ stuff.

Sending written notification to corporate counsel could go a long way to getting the problem addressed - e.g. via an anonymous email account so you can have 2-way communication.

Also: Look at archives of the now-dead Wikileaks:Submissions page I referenced.

Whistleblower.org has good info for you, even though it's government-focused.

Addendum: Have you looked through the source code version control logs to see who put the backdoor in?

1
  • 6
    The addendum alone is a +1
    – mafu
    May 22, 2012 at 12:38
13

Treat it as a security vulnerability you have discovered and report it to to, for example, CVE. Anonymously if you wish.

13

Your reaction is sound, and on a gut instinct level means that you care about one or more of: your customers' privacy, your company's public image, your codebase's quality, your own skin.

In my workplace, I would be senior enough to know it a security bug (and not there by company intent, or mandate from the government) - and remove it. It sounds like this doesn't apply in your case, though.

If you can trace "we are not going to use it" to "we put it there for our own use, but don't need it" you can probably describe to someone high enough in the organization the dangers it poses to the company when it shows up on bugtraq / gets used for nefarious purposes by some third party, which is likely to happen if your smartphone is popular, common and valuable enough (as a target - which may translate to "used by important enough people") to attack.

If you can trace it to "it's there by government mandate" or similar, you might want to insist on internal documentation to that effect, so you can at least leave it be and know that you've done what you can to protect your company, and save other skilled coworkers of yours from the dilemma you find yourself in, as a matter of good code maintenance practices. (And ponder your options about working in an industry making tools that both serve and sacrifice their owners, if this feels deeply demotivational.)

10

You have a known security vulnerability, and your company is only one of an infinite number of parties which could exploit it. Any exploit of that hole, by any party, could reasonably result in a liability the scale of Sony's after the root kit fiasco. Their cost in both dollars and reputation soared into the hundreds of millions of dollars, in a directly analogous situation.

Make the case by drawing direct parallels to Sony, with your user base in ratio to Sony's as a gauge to calculate potential liability when this hole is exploited.

7

It's ok to worry about it, don't worry, your reaction is normal ^^

I would do one of two things:

  • I would update the user agreement explaining that this possibility exists, therefore asking for the user's consensus (if the people in charge really don't want to take the backdoor away)
  • I would remove the backdoor completely (better option in my opinion)

Also, if it is true that this backdoor is never used, why leave it there?

2
  • I strongly doubt the asker is in a position to do either of those without risking trouble. The UA is something a lawyer should create, and no mere software developer is allowed to touch it. The second option, removing the backdoor, can lead to trouble if this feature was actually intentional. I'm far from saying it is morally acceptable to leave it, but simply removing features without consent from above is an easy way to get into trouble.
    – mafu
    May 22, 2012 at 12:37
  • @mafutrct sure, I was implying that the user had to ask to his superiors before doing any of those things: approval from the upper levels is mandatory. Thanks for pointing this out though. May 22, 2012 at 14:47
7

I would seriously counsel against immediate whistleblowing. Not least because there's a good chance this happens because someone from the CIA/FBI had a little chat with the head of the company who ordered it to happen through trusted management channels, and that's why it happens even though everyone should recognise that it's a shitty excuse.

You are rightfully recognising this as a shitty excuse. The problem is that other people also should have. Somewhere someone with power must have decided that this would happen. The construct that it's "OK because we won't use it" is then perpetuated.

That means that if you whistleblow (and get sacked) and launch a lawsuit, not only a) might you find it very difficult to get another job, b) your lawsuit might not go anywhere because it could turn out (hey, I'm not a lawyer, but it's plausible) that it wouldn't be recognised as "misconduct" by the firm. If I was the federal government I would go to greath lengths to protect people doing my dirty deeds.

On the other hand, if you have a trust fund and want to catapult yourself to 15-minute fame, you can go public about it. Just have an alternative path staked out in "Alternative Computing" or the Free Software Movement. There's no private jet down that route.

What I advise is getting a decent amount of details on it, finding new employment, then anonymously contacting a security profile and saying you want to go public/whistleblow it through them. The first person you contact will probably comply. The company might try to go after you but they SHOULD have no definite proof from any logs or search warrants and it's not "official" in the sense that new employers would be forced to recognise it.

1
  • There is no evidence that the CIA/FBI had anything to do with this feature being added.
    – Ramhound
    May 30, 2012 at 13:04
6

OP: You know what happened in the case of ZTE? Go on pastebin, make a full and comprehensive security advisory. Needless to say, cover your tracks. That's that, if you were unsure to the point that you asked the question here, you can benefit us all by making the advisory.

4

As mentioned elsewhere what would scare me would be usage of the interception functionality even without any bad intention of its original developers/installers. The so-called "Athens Affair" comes immediately to mind and underlines this concern. For a technically informative and in the same time exciting read you can check:

The Athens Affair: How some extremely smart hackers pulled off the most audacious cell-network break-in ever

3

This was reported earlier this week in China's ZTE Ships Smartphone with Backdoor to MetroPCS, but finally some are seeing it. It seemed to have gone un-noticed by many...

1
  • 2
    Interesting, but I don't know why you claim it is the same backdoor as the one mentioned in the question. The ZTE one you link to is just a setuid-root program, not something that can be remotely activated (not without something more on the phone).
    – D.W.
    May 21, 2012 at 0:38
3

It's probably there to allow government agencies to access your cell phone and listen in on whatever you're doing at the time. It's required by law.

See:

4
  • Fascinating answer. However, I don't think the "It's required by law." is an accurate statement of current law. I suggest editing your answer to remove that sentence.
    – D.W.
    May 21, 2012 at 0:36
  • 3
    Which law? Do we know from which country we're talking? China? May 21, 2012 at 9:52
  • 2
    This answer seems like total fluff. The user does not quote what the law is.
    – Ramhound
    May 30, 2012 at 13:02
  • We are talking about the USA with this Remotely activated mobile phone microphones stuff. I would post the law but I have no idea where it is. If anyone is more legislatively skilled, please feel free to help out.
    – GregoryT
    Jul 10, 2012 at 23:12
0

Well what you really should be after is their motives for putting in a backdoor. As the highest voter has said, just because you wont use it does not mean it won't be found. If it were me I'd find out what the motive is behind said backdoor, anonymously alert a major tech publication about said backdoor. Then again this depends on whether you feel a responsibility towards the general public or whether you feel it's up to the company to clean up their own act and let someone else hold them to account for their misdeeds.

0

Of course the back door didn't appear there without serious forethought. National security agencies are involved, and they paid to have it done, hopefully without anyone noticing. Cellular engineers designed in the capability to turn on a cellular microphone without the owner knowing it (keeping indicator lights off). I expect GPS locations can be broadcast even when an owner has the GPS feature turned off, and pictures can be taken and broadcast without the owner knowing it as well.

1
  • There is no evidence that any "national security agencies" had anything to do with the feature being added.
    – Ramhound
    May 30, 2012 at 13:06
0

It really depends on the nature of the back door. Is it worse than Carrier IQ?

I know the cell phone carrier can intercept all my voice and data transmissions and turn them over to the government. In fact, the NSA can intercept it all, too. I also expect the carrier and phone manufacture can, if given physical access to the phone, completely read all the data on it without my approval. So if the back door is limited to these kinds of things and you personally cannot use the back door to get into someone else's phone due to some other security constraint, then I would not get too bent out of shape about it. Raise your concerns to your supervisor in an email and save a copy of it on paper at home.

Now if it is the kind of back door a hacker can use to steal passwords saved on the smart phone without being detected, that's time to go full whistleblower if you cannot get them to lock that down. Access to a customer's phone should require specific security authorization within the company combined with full logging so that people who abuse their security privileges can be identified and have those privileges revoked (at the very least).

If it is somewhere in between, well, maybe leak it to a security researcher....

3
  • 1
    In no circumstances should a discovered backdoor go unreported. Government backdoors still violate my right to privacy IMO. Also, if the backdoor is intended for State use with the proper checks in place, making it publicly known shouldn't hinder its use. Always report these kinds of things... May 31, 2012 at 12:51
  • 1
    @Chris, not all back doors are created equal, and there is a serious risk of "crying wolf." It's also important to weigh the personal consequences of violating the confidentiality of your employer against the level of violated expectations the "back door" represents. A carrier being able to push a software update to your mobile phone is almost a given even though it could be considered a back door. Jun 3, 2012 at 18:32
  • good point on the confidentiality part. Jun 13, 2012 at 13:21
-1

IF you have signed a "non-disclosure agreement" on the type of work and products you are dealing with your company then you shouldn't even be asking this question or posting it here. If not, you can post your company name and the software installed in phones to alert everyone.

2
  • Disclosure of vulnerability will get you into court if it will be found out regardless of whether NDA was signed or not. May 22, 2012 at 7:30
  • Not in USA and this is not a vulnerability. It is the purposeful action of knowing that a backdoor exists and not disclosing to the customers.
    – Subs
    May 22, 2012 at 7:41
-1

Hmm, by posting it here after alerting them I'd say that you should think about actually going public because you kind of already have.

Backdoors are pretty commonplace in emerging technologies as it usually takes legislation a while to catch up. Also, the development communities are not fully converged. For instance the Internet was notoriously unsafe until ISPs had to build in direct access to government bodies via legislation, licensing and exchanges. Only then security became important as the 'right' people had secured all the access they needed.

If it were my workplace I'd STFU... But it might be a bit late for that.

1
  • 2
    Going public with security vulnerability will get you into court if it will be found out May 18, 2012 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .