An acknowledgement of the win: https://twitter.com/DefuseSec/status/730903547747819520
The offer still stands though, if you'd like to try: https://twitter.com/DefuseSec/status/730904219419443200
Did I just win?
51–60 of 140 posts
Re: Did I just win?
#52Re: Did I just win?
#53I guess a webpage is a software project...
Enough to be worth the bounty payment. Apparently op decided to reopen the contest "for reals" though. I think fair.
Re: Did I just win?
#54Another way to win this bounty would be to share some code with the string BackdoorPoCTwitter with the same color as the page background. If he copy and paste the code it could work. ^^
The only way that would work is if he committed copy/pasted code without reviewing it first, which is highly unlikely. Or at least I would hope it is, given that he's actually challenged people to do this.
I don't really see how anyone can win this challenge (other than how already done). The guy will be super cautious of any pull requests.
Re: Did I just win?
#55This reminds me of an old folk tale of the trickster and the rich man.
A king passing through a town finds a man about to be punished for fraud. He intercedes and asks what the matter is. The trickster says in his defence, "I ask people for things, and they give then to me". The king is incredulous but poses a challenge: "You must ask and receive money from the richest man in town." The trickster agrees, but being short on assets, requests a loan. The king obliges, and the trickster arranges (eliding details) to induce the town's richest resident to provide him with a wealth of goods. He returns to the king two days later with evidence in tow. The king is impressed by this demonstration, at which the trickster notes that he'd actually met the conditions 48 hours earlier when the king, wealthier than the town's richest resident, had offered him a loan.
There's something to those old stories.
(I'm not positive of the source but believe it's included in Idries Shah's World Tales.)
Re: Did I just win?
#56Earlier quoted context omitted.
The only way that would work is if he committed copy/pasted code without reviewing it first, which is highly unlikely. Or at least I would hope it is, given that he's actually challenged people to do this.
Yes, that`s true. But if its a big chunk of code it could work. Also, if he validated the code before copy and paste, the string would be invisible.
If your final review step is anywhere before the level of staged diff, you're doing it wrong.
Re: Did I just win?
#57Earlier quoted context omitted.
The only way that would work is if he committed copy/pasted code without reviewing it first, which is highly unlikely. Or at least I would hope it is, given that he's actually challenged people to do this.
I don't really see how anyone can win this challenge (other than how already done). The guy will be super cautious of any pull requests.
Maybe there's a way to mislead someone about the content of a pull request (e.g., a race condition in GitHub or some other UI to git, a Unicode rendering bug, a UI that hides or obscures the content of some software comments, a bug in git's merge logic, putting the code into the source of an upstream library that he pulls into his code wholesale...).
I actually have another idea which I now think I should try to do, so I won't give the details here.
Re: Did I just win?
#58What exactly happened here? All I see is a highlighted line that seems to have already been there.
A guy issued a challenge saying he'd give $100 to anyone who could trick him into inserting a certain string into any of his software projects. Another guy responded "You should put this challenge on your website." The first guy said "Good idea" and proceeded to do so, thus including the string in one of his software projects: his website. GG
Jesus that's beautiful
Re: Did I just win?
#59Earlier quoted context omitted.
The only way that would work is if he committed copy/pasted code without reviewing it first, which is highly unlikely. Or at least I would hope it is, given that he's actually challenged people to do this.
I don't really see how anyone can win this challenge (other than how already done). The guy will be super cautious of any pull requests.
You could probably hide it pretty effectively during a normal pull request to fix an existing issue. As long as they aren't greping for the string anyhow. If he's going to use tools to to search a PR for the string, you'd have to obfuscate it. There are plenty of string and / or byte array manipulation techniques to sufficiently hide something like this as long as it's masked by an otherwise real PR.
Re: Did I just win?
#60Earlier quoted context omitted.
Huh? Some of the most clever (and destructive) hacks involve an element of social engineering. Given that security implementations are designed to compensate for human social behaviors and instincts and limitations, social engineering is just as much a part of hacking as cryptography.
I think you read his statement backwards :) He's advocating social engineering whenever possible.
Ah, I think my brain got led down a "garden path", a concept I just learned had an official name from yesterday's Parsey McParseface announcement https://en.wikipedia.org/wiki/Garden_path_sentence