I have a doozy for you - almost posted this in the project management stack.
I was asked to oversee a development of a project.
At some point the previous manager thought it was prudent to create a backdoor deep in the guts of an obscure Java module.
Due to the nature of the project, it basically gains root access on the server as well as the "slave" servers.
We found out about it because the software sends a "I'm all set up!" email upon installation.
The South American team, within minutes, figured out who this guy was and what changes he was making to the code.
I'm not sure how it was leaked, but here's the more distilled questions:
- What is the best way to prevent ourselves from being rooted? I'm told that it's possible albeit very difficult to figure out how it works by someone unfamiliar with the project
- Is there a way to retain this "feature"? If it was stolen, the way I see it, everyone on the team is a suspect, so if it leaks AGAIN I'd like to have some way to at the very least find out.
- What to do with a Mr ****, **** from *****?
A Java module of the software contains a way to figure out the password for the root user on the server, both master and (numerous) slaves. The way to get the root password is obfuscated among thousands of lines of code, but it only requires a single, pre-set token. I'm not too happy about that.