Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Please help me recall a certain programmer horror story

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: Ask HN: Please help me recall a certain programmer horror story

#31

Post by emilfihlman »

stefs wrote: post #12
ChristianBundy wrote: post #10

Earlier quoted context omitted.

You need a compiler to compile anything, including a compiler, so if your compiler was tampered with then anything you compile can be tampered with as well. The only solution is be to download a binary compiler from someone you trust.

yes, but ken thompsons evil compiler theory states, that a trusted compiler is technically impossible (in the paranoid world of theoretical security where all compiler binaries are possibly tainted already) except if you write your own bootstrap compiler chain in machine code. still, all other running software (OS/drivers/the intel management engine) might be able to modify the binary in memory on the fly. the rabbit…

It doesn't even stop at hardware exactly (mcu/cpu), it only stops when you assemble the mcu/cpu yourself.

Re: Ask HN: Please help me recall a certain programmer horror story

#32

Post by mark-r »

kazinator wrote: post #15
TheArcane wrote: post #8

Earlier quoted context omitted.

> Because the compiler was poisoned with other source code that we didn't have. And that source code, that now existed only in the executable compiler, put those changes back into the compiler source before it compiled it. I don't quite understand this part. How would this work?

They got clean source for the compiler from the AT&T person. However, they neglected to get a clean binary for the compiler. They compiled the clean source using the existing, malicious compiler installation. That compiler had a counter-measure against being recompiled from clean sources; it recognized that situation and perpetrated itself. (A clean compiler binary might not help; suppose the trick involves other bin…

Binary patching the kernel wouldn't be hard if you had root access to change the files. It's an old trick - jump from the legit code to new code you appended, then jump back when done.

Re: Ask HN: Please help me recall a certain programmer horror story

#34

Post by webmaven »

rexpop wrote: post #21
pmichaud wrote: post #5

Earlier quoted context omitted.

Jesus, that is intense. I wonder if the guy was personally out to get the Doc, or if he was just a smart kid with too much time and not enough superego?

Interesting that the first adjective you use was "smart" when, in any decent scope of consideration, he has actually wasted many hours of others' time, and caused only suffering. When I do that at my company, they do not call me "smart."

If you do it to your company's competitor, you may qualify for a massive bonus (modulo your employer's moral compass and appetite for risk).

Re: Ask HN: Please help me recall a certain programmer horror story

#35

Post by kazinator »

mark-r wrote: post #32
kazinator wrote: post #15

Earlier quoted context omitted.

They got clean source for the compiler from the AT&T person. However, they neglected to get a clean binary for the compiler. They compiled the clean source using the existing, malicious compiler installation. That compiler had a counter-measure against being recompiled from clean sources; it recognized that situation and perpetrated itself. (A clean compiler binary might not help; suppose the trick involves other bin…

Binary patching the kernel wouldn't be hard if you had root access to change the files. It's an old trick - jump from the legit code to new code you appended, then jump back when done.

(You're right of course; what PC and Mac viruses have ever depended on kernel/bootloader source code?)

Re: Ask HN: Please help me recall a certain programmer horror story

#37

Post by antsar »

emilfihlman wrote: post #31
stefs wrote: post #12

Earlier quoted context omitted.

yes, but ken thompsons evil compiler theory states, that a trusted compiler is technically impossible (in the paranoid world of theoretical security where all compiler binaries are possibly tainted already) except if you write your own bootstrap compiler chain in machine code. still, all other running software (OS/drivers/the intel management engine) might be able to modify the binary in memory on the fly. the rabbit…

It doesn't even stop at hardware exactly (mcu/cpu), it only stops when you assemble the mcu/cpu yourself.

What if one of your transistors has a tiny logic board inside?

Re: Ask HN: Please help me recall a certain programmer horror story

#38

Post by rexpop »

turc1656 wrote: post #26
rexpop wrote: post #22

Earlier quoted context omitted.

Is it "bad judgement"? Aren't there, perhaps, better words for this phenomenon? Is all hate speech mere "bad judgement"? Is KKK membership, cross-burning, lynching, etc. all circumscribed by the label "bad judgement"?

That's an extraordinarily disingenuous take on that comment. They were clearly referring to the decision to mess with the code in this way at all, not the actual content of what was being displayed on screen. The point was obviously that deciding to use this method to cause this amount of effort/trouble and mess with the computer system belonging to someone else is the act of bad judgment. The fact they chose to do i…

If that's true, then I was mistaken.

Edit: But, honestly, I am surprised that you can take such a sterile, detached view of these two coupled phenomena. It's hard for me to understand why you think I should see a) a compiler hack, and b) an emotional violation, but interpret your comments to carefully ignore what is, to me, the most saliently disturbing aspect of this story: the perpetrator's desire to violate.

Re: Ask HN: Please help me recall a certain programmer horror story

#39

Post by TheArcane »

antsar wrote: post #37
emilfihlman wrote: post #31

Earlier quoted context omitted.

It doesn't even stop at hardware exactly (mcu/cpu), it only stops when you assemble the mcu/cpu yourself.

What if one of your transistors has a tiny logic board inside?

Logic boards can't be smaller than a modern transistor. Logic boards contain transistors.

Re: Ask HN: Please help me recall a certain programmer horror story

#40

Post by btschaegg »

TheArcane wrote: post #8
pliny wrote: post #2

https://www.quora.com/What-is-a-coders-worst-nightmare/answe...

> Because the compiler was poisoned with other source code that we didn't have. And that source code, that now existed only in the executable compiler, put those changes back into the compiler source before it compiled it. I don't quite understand this part. How would this work?

That is one hell of a quine.
Post reply on HN