Live data from Hacker News

Contractor admits planting logic bombs in his software

arstechnica.com

21–30 of 156 posts

Re: Contractor admits planting logic bombs in his software

#21

All I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!

That or he's hired by people who don't peer review at all, as in he's the only developer.

Re: Contractor admits planting logic bombs in his software

#22
Shows the importance of code reviews.

I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

Re: Contractor admits planting logic bombs in his software

#23

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

Hmm, is this a common turn of phrase in reporting these days? I can't recall that expression being used outside of some rather old science fiction.

Re: Contractor admits planting logic bombs in his software

#24

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

We really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values.

The prosecutors and industries that coined these terms are very clever. For the petty crimes that they describe, they can turn the outrage up to eleven by comparing the most minor transgression to murder. In the case of DRM, the industry managed to convince people to buy new TVs, monitors, video cards, and cables... to protect their rights? Their right to be turned upside down and have the coins and bills shaken out of their pants, I guess.

Re: Contractor admits planting logic bombs in his software

#25

Earlier quoted context omitted.

Haha really? That is hilariously insecure.

I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.

Makes sense. The software needs to access that code for the spreadsheet to work, so if it was encrypted for example, then the spreadsheet would be unusable unless you know the password

Re: Contractor admits planting logic bombs in his software

#26
post #10
post #2

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! Still a good laugh from the sidelines...

> On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different !

It's a little different if only from a professional dignity perspective, lol. Also, every senior programmer I've ever worked with who makes use of third-party binaries will find a moment to say, "I'll just decompile it if it ever gives us any real trouble!"

Re: Contractor admits planting logic bombs in his software

#27

All I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!

That or he's hired by people who don't peer review at all, as in he's the only developer.

Still, I think the point remains having the time to even do this is astounding.. can't even keep up getting all my code to work properly in the first place as a mostly single developer!

Re: Contractor admits planting logic bombs in his software

#28
post #16

Earlier quoted context omitted.

There is actually pretty nice diff / compare two spreadsheets functionality inside of Excel. Screenshot: https://support.content.office.net/en-us/media/9149c7e8-6f0c...

Seems to be dependent on what edition of Excel you have - I had a look for it and couldn't find it... (I'm using the up to date version from Office 365).

You need to use the Professional or ProPlus versions...or https://www.xltrail.com/

Re: Contractor admits planting logic bombs in his software

#29

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

It's probably covered in line 3,781 of the EULA for the printer's firmware.

Re: Contractor admits planting logic bombs in his software

#30

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

What was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.
Post reply on HN