2

By bugdoors, I mean OS/app devs deliberately introducing vulnerabilities & sharing with front orgs like the NSO Group which then develops and markets the spyware?

  1. Would this process be easier than just executing a zero-click attack?
  2. This might work for proprietary software but I don’t know how difficult would it be to introduce vulnerabilities and let it go unnoticed for open source software.
  3. Does the incident of polkit privilege escalation vulnerability being unnoticed for 12 years show that it could also be possible to do with open source software?

2 Answers 2

2

How would you distinguish a backdoor from a "normal/accidental" bug? Unless the first one explicitly makes it clear it is one both are just bugs.

  1. Sure. Implementing known (and for others hard to find) bugs/backdoors is easier than to find unknown ones.

  2. Bugs are being found all the time. Does not matter if it is closed or open source. If you have access to the source code/infrastructure it may be easier. Lots of "former" three letter agency employees work for Google etc.: https://twitter.com/AlanRMacLeod/status/1551905373799563266

  3. Android CVEs: https://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224

I don't know how long all these bugs were unknown. But I guess for many of them it is long enough. Also this only shows what is known to the public. A three letter agency might know about more bugs.

3
  • Thanks for your answer. Is there any specific reason why we see a huge jump in the number of vulnerabilities in Android from 2015? Dec 24, 2022 at 10:42
  • 2
    Maybe because Google started a bug bounty program for Android in 2015. Overall the vulnerabilities are not necessarily increasing. People are just more motivated to look for them and report them to Google. security.googleblog.com/2015/06/…
    – secfren
    Dec 24, 2022 at 11:56
  • Thanks. Apple also saw a jump around that time. cvedetails.com/product/15556/Apple-Iphone-Os.html?vendor_id=49 It was less significant though. And it seems they also started a security bounty program in 2016 (and later expanded in late 2019). security.apple.com/blog/apple-security-bounty-upgraded Dec 24, 2022 at 12:13
2

First of all, written on purpose or not by the programmer, that's still a zero-click vulnerability. The actual question is whether it's cheaper to find an existing vulnerability (either buying it or paying a team to look for them) or to bribe someone able to sneak that vulnerability.

The earlier is surely expensive, but the later has high risks associated as well: the employee uncovering you, unable to do that (perhaps it was caught in code review, or it gets fixed sooner than intended), getting sued by the OS Company...

In the case of Pegasus I don't think this would have been a backdoor. It's hard to prove a negative, even though some vulnerabilities can be ascertained that they were added on purpose. Still, a vulnerability being used this way is going to be analyzed, so it'd be doubly risky for the one planting it. And I didn't see any analysis suggesting this to be the case.

Bugs do exist. And yes, sometimes they lurk for a long time. Polkit is not the first critical vulnerability that took years to discover. But you would need that to happen both for maliciously inserted vulnerabilities and benign ones.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .