41–50 of 105 posts
I think the risk from this type of attack is probably near zero. You can't hack into Github and add a commit to Linux. Probably most of the deliberate backdoors that are present in Linux have been inserted by well funded state sponsored developers performing useful work. Easy to sneak a vulnerability in that way. (There was a controversial incident a few years ago when some researchers proved as much.)
Earlier quoted context omitted.
To be clear: you're telling us the full story of the discovery, not the full story of the exploit? You and your source don't know who the attacker was, right?
What is there to say about the hack? Like everything back then it was probably accomplished by exploiting trust relationships. I can ask him, but it is not at interesting 20 years later.
That's wrong on many levels. Bold and stupid "hacks" committed by teenagers using SE tend to get a lot of traction, because it is both bold and stupid. This hasn't changed. But "back then" there was much more than that...
Wasn't this done by Ac1dB1tch3z? See http://phrack.org/issues/64/15.html for the CVS exploit from the same time.
We used to use this as a cautionary tale in the CS department security course at the Technion. First, to highlight trust relationships in the "supply chain" (as the notion is now known in contemporary usage). Second, to pose the question of whether open source is inherently more trustworthy.
I guess you could argue that more [evil] people would try to backdoor the linux kernel than there are [malicious] people inside private companies, but the level of trust inside a private company is probably much higher? Seems complex
While I'm here, does anyone know of a good trustworthy RAT for Windows machines that I can control from my Linux box? I have some relatives for whom I provide technical support. I'd love to just put an EXE on their desktop that would launch a VNC session and connect back to me (since they have the typical NAT + firewall of home users), but I don't want to install a virus on their machines.
I think the risk from this type of attack is probably near zero. You can't hack into Github and add a commit to Linux. Probably most of the deliberate backdoors that are present in Linux have been inserted by well funded state sponsored developers performing useful work. Easy to sneak a vulnerability in that way. (There was a controversial incident a few years ago when some researchers proved as much.)
Link to the incident you're referring to?
https://old.reddit.com/r/HobbyDrama/comments/nku6bt/kernel_d...
Earlier quoted context omitted.
To be clear: you're telling us the full story of the discovery, not the full story of the exploit? You and your source don't know who the attacker was, right?
What is there to say about the hack? Like everything back then it was probably accomplished by exploiting trust relationships. I can ask him, but it is not at interesting 20 years later.
What is there to say about the [discovery]? Like everything back then it was probably accomplished by [a simple source code diff]...it is not at interesting 20 years later.
You get the idea. The story you know might be interesting to you because you happen to know the person involved. And it is sort of interesting? But not really as interesting as the _full_ story would be. In particular because your grammar in your original comment kind of implies you knew the actual attacker.
This all seems fairly obvious to me? Is there anything we're missing about the discovery? It's pretty mundane that one of hundreds of devs working on that source code happened to have a vanilla copy, especially in 2003 with a less reliable and slower internet.
> it said "= 0" rather than "== 0" Why do so many programming languages have different equals/assigns operators? There are languages that combine them and apparently don't have any problems. Is it something to do with being strongly vs. weakly typed?
In the former you could combine them. In the latter you can't (you need to be able to tell if "if (a = b) ..." contains a comparison or assignment).
(EDIT: I agree with the sibling reply from klodolph there - there are many cases where reusing the same operator would get really confusing, and so I'd prefer the operators to be distinct even if the language do not allow them in the same context)
> it said "= 0" rather than "== 0" Why do so many programming languages have different equals/assigns operators? There are languages that combine them and apparently don't have any problems. Is it something to do with being strongly vs. weakly typed?
To prevent accidental or malicious use of the assignment operator in place of the equals operator in a language, you either have to have a real boolean type, and no implicit conversion of other types to boolean, or make assignments not be an expression, or disallow assignment expressions in boolean contexts.
Making both operators the same symbol is not a good solution IMO, because it makes it harder to distinguish which is which in arbitrary contexts. E.g. in `a = b = c`, presumably the first is an assignment and the second a comparison? Or maybe not? It would just be confusing. Not sure which languages you are referring to that do this.
I have the full story on that incident. It is actually really funny. If the guy who did it wants to come forward, that is his decision. [edit: I won't name names.] He did provided me the full story. He told me with the understanding that the story would go public, so I will dig it up and post it. I also interviewed the sysadmins who were running the box at the time. 1. it was not an NSA operation, it was done by a ha…
Wait was the guy you know the hacker or someone who discovered the hack by accident? If the latter, how do you know anything about the hacker's identity or motive?