Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Contractor admits planting logic bombs in his software

arstechnica.com

Post reply on HN
Print view View original

61–70 of 156 posts

Re: Contractor admits planting logic bombs in his software

#61

Post by logfromblammo »

navaati wrote: post #10
javagram wrote: post #2

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! Still a good laugh from the sidelines...

We deliver source to the customer, and include compiled binaries and installers as a (paid) courtesy.

Without the source, the customer loses the ability to switch software contractors, which is against their procurement rules. Even if you don't have the clout of being huge, not controlling the source for business-critical software is basically putting the supplier's gun up to your own head.

Companies that take binary-only delivery have obviously never hired anyone who could tell them they shouldn't do that.

Always get the source, or write it in-house.

Re: Contractor admits planting logic bombs in his software

#62

Post by [deleted] »

ChrisSD wrote: post #5

In 2011 Tinley had refused to hand over the password to unlock the spreadsheet for editing when asked, claiming he was protecting his work product. > For years, the spreadsheet would glitch, Tinley would be hired to come in, would "fix" it, invoice Siemens, and head out again. But that all changed in May 2016 when Tinley was out of state, and Siemens called again about the spreadsheet. The company had an urgent order…

[deleted]

Re: Contractor admits planting logic bombs in his software

#64

Post by pts_ »

drderidder wrote: post #19

All I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!

That's because he's a boomer who probably knows asm. There were no wannabes in this field back in the day.

Re: Contractor admits planting logic bombs in his software

#65

Post by auggierose »

ChrisSD wrote: post #5

In 2011 Tinley had refused to hand over the password to unlock the spreadsheet for editing when asked, claiming he was protecting his work product. > For years, the spreadsheet would glitch, Tinley would be hired to come in, would "fix" it, invoice Siemens, and head out again. But that all changed in May 2016 when Tinley was out of state, and Siemens called again about the spreadsheet. The company had an urgent order…

Must have been a brain freeze moment to hand over that password.

Re: Contractor admits planting logic bombs in his software

#66

Post by lostlogin »

elldoubleyew wrote: post #30
rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

What was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.

iPhones do this for the charging cable. They don’t brick as such, they just don’t charge. Sooner or later that gives you a brick.

Re: Contractor admits planting logic bombs in his software

#67

Post by orev »

elldoubleyew wrote: post #30
rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

What was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.

APC does this on UPSes. It’s an extremely bad practice that drives people crazy. They use a standard connector, like serial, RJ45, or USB, but with a non-standard pinout and give you a custom cable. God help you if you throw that cable in a box with other standard cables. And if you plug a standard cable into this non-standard port, the UPS panics and completely shuts down, including anything you have connected to it.

APC devices are generally pretty good, except for this infuriating and dangerous “feature”.

It’s almost 2020, and vendors still have this ridiculous idea that they can lock you into their proprietary ecosystem by doing stuff like this.

Re: Contractor admits planting logic bombs in his software

#68

Post by zelon88 »

ChrisSD wrote: post #9
zelon88 wrote: post #6

Earlier quoted context omitted.

If you dump the XML and remove the line you don't even need to ask for the password.

Warning: This being true, it can still be construed as "hacking" no matter how simple it is. Just because the barrier is easy to get over, it doesn't mean you're legally allowed to enter. This person asserted the spreadsheet was his "work product". Presumably Siemens's lawyers found this convincing enough to be wary of hacking around the password.

I have a different view. Considering the company employed "Person A" to create a spreadsheet, why would it be a violation to employ "Person B" to gain access to it in the absence of "Person A"? The company owns all of the technology and employs all of the personnel involved, no?

Re: Contractor admits planting logic bombs in his software

#69

Post by elcomet »

hurricanetc wrote: post #56
tc313 wrote: post #43

Earlier quoted context omitted.

> If he had accidentally written sloppy code The damage was intentional (i.e., not an accident).

Right. In this case he plead guilty and admitted to having done it. I am just curious as to which specific laws he broke and whether it is possible to inadvertently break these laws by being a horrible programmer. If he had intentionally created a spaghetti code mess that just happened to break from time to time would that be different? I assume intention is difficult to prove in court but I am not an attorney.

> If he had intentionally created a spaghetti code mess that just happened to break from time to time would that be different ?

Clearly, yes. Here Siemens decided to go to court because it was obviously malicious code. With a spaghetti mess they would just have hired someone else to clean it.

Re: Contractor admits planting logic bombs in his software

#70

Post by drc500free »

mgleason_3 wrote: post #37

Wow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime? We hired a licensed plumber on 2 occasions - to install a sink and later a shower. We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged. We also had him look at t…

Unlike code, law considers intent.
Post reply on HN