Posted on 10/10/2013 12:25:17 PM PDT by ShadowAce
/johnny
But it does show how open source is more secure than closed source.
A very clever backdoor indeed. Good plausible deniability too, since this is such a common typo for C programmers, and one that isn’t even caught by syntax checkers, since it is still perfectly valid syntax. If they ever did track down who inserted it, they couldn’t prove that someone didn’t just “goof up” and forget the second equal sign.
“But it does show how open source is more secure than closed source.”
Yes, in one way it is. In another way, it isn’t.
If a flaw does get past the many eyes of the open source community, into the code, then it sits there waiting for anyone to notice it and exploit it. With closed source, such a flaw would need to be found more by trial and error.
Yep. I looked right at it and didn’t see it. BTT
The PRC, Russia, NSA, a private group of would be hackers etc.
Lots of suspects here.
/johnny
/johnny
True, you just have to hope the first one to notice it is someone with scruples :)
Yes, it's actually a C idiom. E.g., to process the contents of a file:
while (bytes_read = read(buffer)) {
// Work with buffer
}
// ... Dropped out of read loop because zero bytes were read
Commonly used compilers can be set to warn when the above is used, requiring it to be changed to:
while ((bytes_read = read(buffer)) != 0) {
// Work with buffer
}
// ... Dropped out of read loop because zero bytes were read
to avoid the warning. Of course, the assignment still takes place whether the target is bytes_read or current->uid.
/johnny
someone should have tested it with the __WCLONE option at least once to see if it returned -EINVAL
was it caught by unit testing? if not, it should have been
could have been sloppy code. that wouldn’t surprise me. better hacks involve pts to functions buried in hex tables of object code
No need to unit test two lines when you know what those two lines are and can read the code.
The fact that it was slipped in without approval would draw attention to it.
A smart hacker would realize that.
It’s pretty “ambitous” for a hacker to think they can get a backdoor into code that’s reviewed publicly.
If something is going to slip through, it would have to be very subtle, most certainly involving the interaction between different parts of the system, and these would be probably be maintained by different people.
There was not any sophistication to this attempt.
IMHO, it was either very halfhearted, sort of just poking around, or attempted by someone who’s rather half-witted.
Much more effective hacking would be to not try to put an explicit backdoor into Linux itself but to hack one machine at a time the old fashioned way, using the tools available and inherent weaknesses they imply.
Of course, once an individual computer is compromised, malware can be used for all sorts of things.
Linux, for example, as things like tcpdump that root can use to grab any or all network traffic using only a script, not even compiled programs.
Yeah, that can be a handy way to save typing another line of code, when it’s used intentionally. Unintentionally, it can cause you to pull your hair out trying to debug :)
“could have been sloppy code. that wouldn’t surprise me. better hacks involve pts to functions buried in hex tables of object code”
Yeah, but I think that’s exactly what makes this a good hack, in a way. It COULD just be sloppy code. And sloppy code can slip past a lot of eyes, sometimes.
Possibly one of the most interesting articles I’ve ever read on FR! I wonder what Linus would say about this.
someone should have tested it with the __WCLONE option at least once to see if it returned -EINVAL
if ((options == (__WCLONE|__WALL))
Whether this itself makes sense (i.e. to only take the conditional if both
flags are set) or it this would tend to be something with some more
devious intent - I don’t have enough knowledge to say.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.