14

One of the reasons Microsoft stopped adding easter eggs to products is they could potentially have security flaws. Are there known worms, exploits, etc that take advantage of an easter egg in some product?

11

Yes, Easter eggs have caused security problems in the past.

Here are three examples, by descending severity:

The XBOX XBE Easter Egg Exploit

An Easter egg in the Xbox which displays hidden developer credits was used in an exploit to run unsigned custom executables (which Microsoft originally proibited). This is the Easter egg:

The Xbox contained developer credits in the dashboard. Inserting an audio CD and ripping it with the name "<<Eggsßox>>" would trigger it.

The exploit itself is documented here.

The PHP Fingerprinting Easter Egg

This PHP Easter egg is probably one of the best known security-relevant Easter eggs although it's "only" an information disclosure problem. Essentially, by appending a particular string to the URL on any PHP site that had the expose_php option set, you could reveal a hidden image instead of the original page. Since these images vary between PHP versions, that feature became a popular way to help an attacker fingerprinting the PHP version of a target server. You can find a write-up on that problem here.

The jdbgmgr.exe virus hoax

The jdbgmgr.exe virus hoax is not a real vulnerability but it was also based on an Easter egg. It's an e-mail hoax that told Windows users to delete a particular file. That file had, as a joke, a teddy bear icon which let it appear unusual in a Windows system directory. This icon made it easy for the hoax messages to convince users that the file was in fact a "dangerous virus".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.