Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Contractor admits planting logic bombs in his software

arstechnica.com

Post reply on HN
Print view View original

51–60 of 156 posts

Re: Contractor admits planting logic bombs in his software

#51

Post by sjruckle »

elldoubleyew wrote: post #30
rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

What was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.

Probably referring to FTDI-Gate, which is where FTDI shipped a driver that bricked counterfeit usb-serial converters.

Re: Contractor admits planting logic bombs in his software

#52

Post by DoingIsLearning »

elldoubleyew wrote: post #30
rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

What was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.

I am not sure about a case with cables. But there was a semi famous case of FTDI USB drivers purposefully bricking fake USB counterfeit chips.

It was not that uncommon if you bought a cheap USB to serial or USB to TTL dongle online.

Re: Contractor admits planting logic bombs in his software

#53

Post by ghostpepper »

PeterisP wrote: post #31
ghostpepper wrote: post #17

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

Logic bomb is a term for a very specific subtype of malware, and it is quite informative and useful to use this term - it gives a proper impression about what this particular malware does and doesn't do. It immediately suggests that it has a delayed action that creates a disruption after some time (and not right away); that it is hidden (as opposed to e.g. ransomware), that it's intentionally deployed there (as oppos…

So the delay, or triggering condition, is the differentiator? Thanks, that actually makes a bit more sense. I skimmed the wikipedia page before posting and it wasn't immediately obvious.

Re: Contractor admits planting logic bombs in his software

#54

Post by isoskeles »

BuildTheRobots wrote: post #46

> The parties in the case stipulated a total loss amount of $42,262.50 That's an oddly specific loss amount, especially the 50c

What’s odd about it being specific? Take the number of billable hours he spent “fixing” his logic bombs x hourly rate for those events.

Re: Contractor admits planting logic bombs in his software

#55

Post by StuffedParrot »

csense wrote: post #29
rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

It's probably covered in line 3,781 of the EULA for the printer's firmware.

...which are definitely enforceable right? I’m trying to remember why we put up with them as a society.

Re: Contractor admits planting logic bombs in his software

#56

Post by hurricanetc »

tc313 wrote: post #43
hurricanetc wrote: post #40

I read the DOJ link and it just states “intentional damage to a protected computer.” If he had accidentally written sloppy code that happened to break periodically would that have been illegal? I don’t fully understand what law he broke and how such a law would not also apply to the seemingly infinite cases of built in obsolescence.

> If he had accidentally written sloppy code The damage was intentional (i.e., not an accident).

Right. In this case he plead guilty and admitted to having done it. I am just curious as to which specific laws he broke and whether it is possible to inadvertently break these laws by being a horrible programmer.

If he had intentionally created a spaghetti code mess that just happened to break from time to time would that be different? I assume intention is difficult to prove in court but I am not an attorney.

Re: Contractor admits planting logic bombs in his software

#57

Post by markstos »

ghostpepper wrote: post #17

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

Weapons don't have be sophisticated to be used as weapons. Even physical bombs don't have be sophisticated to be bombs.

"It wasn't an armed robbery, it was just unsophisticated criminal behavior that happened to involve a gun."

Re: Contractor admits planting logic bombs in his software

#58

Post by ppseafield »

mgleason_3 wrote: post #37

Wow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime? We hired a licensed plumber on 2 occasions - to install a sink and later a shower. We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged. We also had him look at t…

Did the previous plumber install a timer on a pipe, ensuring it would leak every 6 weeks?

Re: Contractor admits planting logic bombs in his software

#59

Post by markstos »

thrower123 wrote: post #23
ghostpepper wrote: post #17

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

Hmm, is this a common turn of phrase in reporting these days? I can't recall that expression being used outside of some rather old science fiction.

I rarely see "logic bombs" in the news, but I remember the day the customer called angry on April 1st, complaining that their spreadsheet quit working.

It seemed unlikely to be an April Fool's Day joke, but I knew the code hadn't changed so I couldn't understand why it would quit working. Root cause? The fiscal year in the spreadsheet started in April, which made it the "zeroth" month, which triggered a logic failure due to this being a false value.

It would have made a great hard-to-spot logic bomb... if I had planted it intentionally!

Re: Contractor admits planting logic bombs in his software

#60

Post by EGreg »

I once wanted to put a logic bomb for a client that was a startup and for months (years?) prioritize paying others. I had accumulated $30K in debt for them as they told me the sky is falling numerous times and that they’d pay me as soon as the next money came in. They just had raised hundreds of thousands but paid their own salaries and large empty office instead.

I knew I’d have the upper hand if the site suddenly stopped working. But I was afraid of some kind of “hacking laws” being “exceeding access” or whatever (probably stupid given what was realistic) and never did it. My only acceptable option was to do a DMCA takedown at AWS because they had never signed a copyright assignment.

Anyway long story short I never got paid. Been too nice / scared. And the startup went out of business. Many of its investors were pissed. The usual.

Post reply on HN