I'm pretty sure there are tons on unreleased and unpublished backdoor exploits for linux and windows likewise. The problem is you can't fix them yourself if the signature keeps unknown to anyone.
The Linux backdoor attempt of 2003 (2013)
21–30 of 105 posts
Re: The Linux backdoor attempt of 2003 (2013)
#22While I'm here, does anyone know of a good trustworthy RAT for Windows machines that I can control from my Linux box? I have some relatives for whom I provide technical support. I'd love to just put an EXE on their desktop that would launch a VNC session and connect back to me (since they have the typical NAT + firewall of home users), but I don't want to install a virus on their machines.
Anydesk?
Re: The Linux backdoor attempt of 2003 (2013)
#23Another bit of cleverness not mentioned in the article is that assignment expressions always evaluate to the rvalue. So the expression `current->uid = 0` has the effect of making sure that entire conditional never actually runs (or at least, the return never runs), which means the overall behavior of wait4 doesn't change in an observable way. Very clever if you're trying to pass all of the existing tests
Ohh, that is clever - unless someone writes a test for these two new lines, and finds that they never return -EINVAL.
Maybe the unit tests should test that the variables you intend to "not touch" do not in fact change. So record UID before and after the function. When I'm writing critical code like this, one gets a tingly feeling when typing in that variable name.
Re: The Linux backdoor attempt of 2003 (2013)
#24While I'm here, does anyone know of a good trustworthy RAT for Windows machines that I can control from my Linux box? I have some relatives for whom I provide technical support. I'd love to just put an EXE on their desktop that would launch a VNC session and connect back to me (since they have the typical NAT + firewall of home users), but I don't want to install a virus on their machines.
AFAIK, solutions like TeamViewer or AnyDesk may be securely connected from the outside and manage the NAT+firewall of home user... no need to have a RAT (in the "virus/backdoor" meaning)
Re: The Linux backdoor attempt of 2003 (2013)
#25I think the risk from this type of attack is probably near zero. You can't hack into Github and add a commit to Linux.
Probably most of the deliberate backdoors that are present in Linux have been inserted by well funded state sponsored developers performing useful work. Easy to sneak a vulnerability in that way. (There was a controversial incident a few years ago when some researchers proved as much.)
Re: The Linux backdoor attempt of 2003 (2013)
#26I have the full story on that incident. It is actually really funny. If the guy who did it wants to come forward, that is his decision. [edit: I won't name names.] He did provided me the full story. He told me with the understanding that the story would go public, so I will dig it up and post it. I also interviewed the sysadmins who were running the box at the time. 1. it was not an NSA operation, it was done by a ha…
Wait was the guy you know the hacker or someone who discovered the hack by accident? If the latter, how do you know anything about the hacker's identity or motive?
the hacker. I interviewed the sysadmins about it.
Re: The Linux backdoor attempt of 2003 (2013)
#27Earlier quoted context omitted.
Developer tries to tell a story... Sounds like OP interviewed the person who uploaded the code, whose system was previously inflitrated (it can still be the NSA). So why say "If the guy who did it wants to come forward, that is his decision. But he did provide me the full story", it doesn't sound like OP interviewed the "guy who did it"...
I read that the other way. "If the guy who did it wants to come forward, that is his decision. But he [still talking about the guy who did it] did provide me the full story." That is, the perpetrator gave him the full story, but he won't name names, because it's the perpetrator's choice whether or not to reveal his identity.
[deleted]
Re: The Linux backdoor attempt of 2003 (2013)
#28I have the full story on that incident. It is actually really funny. If the guy who did it wants to come forward, that is his decision. [edit: I won't name names.] He did provided me the full story. He told me with the understanding that the story would go public, so I will dig it up and post it. I also interviewed the sysadmins who were running the box at the time. 1. it was not an NSA operation, it was done by a ha…
To be clear: you're telling us the full story of the discovery, not the full story of the exploit? You and your source don't know who the attacker was, right?
What is there to say about the hack? Like everything back then it was probably accomplished by exploiting trust relationships. I can ask him, but it is not at interesting 20 years later.
Re: The Linux backdoor attempt of 2003 (2013)
#29Another bit of cleverness not mentioned in the article is that assignment expressions always evaluate to the rvalue. So the expression `current->uid = 0` has the effect of making sure that entire conditional never actually runs (or at least, the return never runs), which means the overall behavior of wait4 doesn't change in an observable way. Very clever if you're trying to pass all of the existing tests
But that should be something the compiler could catch. The expression is always false and the condition would never be executed. You usually get a warning for that. And if the compiler doesn't, linters do.
This is a common mistake, and I believe most linters have rules for that. And I don't think there is any situation where there is a good reason for code like this to exist. Either the expression is wrong, or it doesn't belong in a "if". You may get stuff like that in legitimate code with macro expansion, but again, it is not the case here, and from my experience, you get a warning anyways.
Re: The Linux backdoor attempt of 2003 (2013)
#30Wasn't this done by Ac1dB1tch3z? See http://phrack.org/issues/64/15.html for the CVS exploit from the same time.
[deleted]