Contractor admits planting logic bombs in his software • Hacker News Board

Re: Contractor admits planting logic bombs in his software

#11

Post by zozbot234 » Thu, Dec 19, 2019, 2:17 PM UTC

arthurcolle wrote: post #7

zelon88 wrote: post #6

Earlier quoted context omitted.

If you dump the XML and remove the line you don't even need to ask for the password.

Haha really? That is hilariously insecure.

I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.

Re: Contractor admits planting logic bombs in his software

#12

Post by kevas » Thu, Dec 19, 2019, 2:17 PM UTC

zozbot234 wrote: post #8

bilekas wrote: post #4

I would be curious how they came to realise what was happening. Also, how were the contractors changes not reviewed? If the same engineers work keeps throwing unknown problems down the line, the LAST thing I am doing is contacting them again.

Can you even "review" changes to spreadsheet code? I know that Office apps have some support for change management, but is it even up to this task?

RubberduckVBA >> export all modules, classes, userforms >> send to git.

That was my release workflow. Worked for the +30k line application I built in VBA.

Re: Contractor admits planting logic bombs in his software

#13

Post by ealfert » Thu, Dec 19, 2019, 2:20 PM UTC

zelon88 wrote: post #6

javagram wrote: post #2

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

If you dump the XML and remove the line you don't even need to ask for the password.

Nice tip!

I found the following screenshots/guide that shows "sheetProtection" includes "algorithmName" and "hashValue" but not "password" variable... https://www.excelsupersite.com/how-to-remove-an-excel-spread...

Re: Contractor admits planting logic bombs in his software

#14

Post by AnIdiotOnTheNet » Thu, Dec 19, 2019, 2:26 PM UTC

choeger wrote: post #3

javagram wrote: post #2

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

Yep. If it was me I would hold the supervisors responsible.

Of course you would, developers are always blameless!

Re: Contractor admits planting logic bombs in his software

#15

Post by Rainymood » Thu, Dec 19, 2019, 2:27 PM UTC

Malicious compliance by the contractor. Hilarious incompetence by Siemens.

Re: Contractor admits planting logic bombs in his software

#16

Post by tyingq » Thu, Dec 19, 2019, 2:27 PM UTC

zozbot234 wrote: post #8

bilekas wrote: post #4

I would be curious how they came to realise what was happening. Also, how were the contractors changes not reviewed? If the same engineers work keeps throwing unknown problems down the line, the LAST thing I am doing is contacting them again.

Can you even "review" changes to spreadsheet code? I know that Office apps have some support for change management, but is it even up to this task?

There is actually pretty nice diff / compare two spreadsheets functionality inside of Excel.

Screenshot: https://support.content.office.net/en-us/media/9149c7e8-6f0c...

Re: Contractor admits planting logic bombs in his software

#17

Post by ghostpepper » Thu, Dec 19, 2019, 2:30 PM UTC

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days?

It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

Re: Contractor admits planting logic bombs in his software

#18

Post by arethuza » Thu, Dec 19, 2019, 2:42 PM UTC

tyingq wrote: post #16

zozbot234 wrote: post #8

Earlier quoted context omitted.

Can you even "review" changes to spreadsheet code? I know that Office apps have some support for change management, but is it even up to this task?

There is actually pretty nice diff / compare two spreadsheets functionality inside of Excel. Screenshot: https://support.content.office.net/en-us/media/9149c7e8-6f0c...

Seems to be dependent on what edition of Excel you have - I had a look for it and couldn't find it... (I'm using the up to date version from Office 365).

Re: Contractor admits planting logic bombs in his software

#19

Post by drderidder » Thu, Dec 19, 2019, 2:42 PM UTC

All I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!

Re: Contractor admits planting logic bombs in his software

#20

Post by dmix » Thu, Dec 19, 2019, 2:44 PM UTC

drderidder wrote: post #19

All I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!

Yeah, really, this is the first programmer I've ever heard of who had lacked bugs to be fixed. There's always new stuff to work on.

Maybe he was only used for some older niche stuff that was going out of style and he was trying to cling to the past.