The Linux Backdoor Attempt of 2003 (2013)

Post by db48x » Mon, Aug 10, 2020, 3:17 PM UTC

kazinator wrote: post #99

ed25519FUUU wrote: post #93

Earlier quoted context omitted.

:= Still seems easy to overlook at a cursory glance.

What db48x neglected to mention is that some of those languages also featured assignment as strictly a statement; it could not be a subexpression. As in: fun(x := 42); (* syntax error in Pascal *) x := 42; (* OK *) x = 42; (* hopefully a statement with no effect warning *) If assignment is a statement, it's possible to use the same token. Classic BASIC: 10 X = 5 20 IF X = 5 GOTO 10 This doesn't cause the C problem of…

Post by mhh__ » Mon, Aug 10, 2020, 3:40 PM UTC

mercer wrote: post #85

GuB-42 wrote: post #60

Earlier quoted context omitted.

It is not so easy, it is a contest, and they show you the winners. And if you look at the "Scoring and Extra Points" section of http://underhanded-c.org/_page_id_5.html you will notice that it checks most of the boxes. It is short, errors based on human perception (here = vs ==) are good enough, it is innocent looking under syntax highlighting, is is not platform dependent, and it even passes the "irony" check. It is…

now I'm wondering if syntax highlighting shouldn't somehow make an assignment inside an if statement (and the variants) a bright red, or something like that.

Post by GuB-42 » Mon, Aug 10, 2020, 4:10 PM UTC

mhh__ wrote: post #103

mercer wrote: post #85

Earlier quoted context omitted.

now I'm wondering if syntax highlighting shouldn't somehow make an assignment inside an if statement (and the variants) a bright red, or something like that.

It should really be forbidden by the compiler these days, or at least a very loud warning.

  if ((fd = open(...)) != -1) {
      /* do something with fd */
  } else {
      perror("open");
  }

Post by wycy » Mon, Aug 10, 2020, 4:14 PM UTC

Cthulhu_ wrote: post #66

aborsy wrote: post #12

There should be safe guards against such errors. Even with approval, the reviewer may not notice it. Which brings up the question: how many more root-based backdoors are there now in the source code?

Unfortunately in C and its derivatives, the safeguards would have to be external tools (static analysis, linters); it's a perfectly valid statement in code. I wouldn't mind if languages simply mark assignments in conditions as errors. It's clever code, but clever code should be avoided in critical systems. And in general, I guess.

    if let userID = 0 {}

    if userID == 0 {}

Post by vlovich123 » Mon, Aug 10, 2020, 4:57 PM UTC

bugeats wrote: post #104

ITT: everyone pretending they've never burned hours troubleshooting only to find a stupid `=` instead of a `==`.