Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Contractor admits planting logic bombs in his software

arstechnica.com

Post reply on HN
Print view View original

71–80 of 156 posts

Re: Contractor admits planting logic bombs in his software

#71

Post by elcomet »

jrockway wrote: post #24
ghostpepper wrote: post #17

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

We really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values. The prosecutors and ind…

I think the word piracy was not invented by tech people, but by right holders who wanted to make it look as bad as real piracy. It was an amazing strategy for them.

Re: Contractor admits planting logic bombs in his software

#72

Post by jlgaddis »

zelon88 wrote: post #6
javagram wrote: post #2

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

If you dump the XML and remove the line you don't even need to ask for the password.

About 30 years ago, when I was just a kid, my parents would make me go with them when they went shopping. I would always go wander around the electronics section of the store (I'm thinking of Walmart, specifically) to play with the computers.

At that time, Windows 3.1 was the latest and greatest and is what was running on all of the "display" PCs. Unfortunately, the password-protected screensaver was almost always activated -- meaning you couldn't actually do anything on the PCs.

Luckily, those passwords were easily bypassed! All you needed to do was simply power cycle / reboot the machine. Once it started booting up, you would just hit CTRL-C to interrupt and terminate the "autoexec.bat" file. Next, change into the "\WINDOWS\" directory, and open up some .INI file [0], find the line where the password was set, and delete everything after the "=" sign. Finally, save your changes, exit the editor, and hit CTRL-ALT-DEL to reboot.

The PC would start up and launch into Windows as usual, but without any password protection for the screensaver.

(A slightly older version of myself may have, allegedly, then set his own passwords on occasion.)

[0]: "sys.ini", "windows.ini", something like that.

Re: Contractor admits planting logic bombs in his software

#73

Post by jlgaddis »

ghostpepper wrote: post #53
PeterisP wrote: post #31

Earlier quoted context omitted.

Logic bomb is a term for a very specific subtype of malware, and it is quite informative and useful to use this term - it gives a proper impression about what this particular malware does and doesn't do. It immediately suggests that it has a delayed action that creates a disruption after some time (and not right away); that it is hidden (as opposed to e.g. ransomware), that it's intentionally deployed there (as oppos…

So the delay, or triggering condition, is the differentiator? Thanks, that actually makes a bit more sense. I skimmed the wikipedia page before posting and it wasn't immediately obvious.

I think the "delayed action" aspect is key to the use of the term "logic bomb" -- as in the phrase "a ticking time bomb waiting to go off" that we've probably all heard.

As PeterisP mentioned, the delayed action is integral to the concept of a logic bomb, as opposed to just invoking a piece of malware that immediately starts breaking things. Delaying the "attack" helps to hide its origin, making it harder to discover the cause of the problems.

Re: Contractor admits planting logic bombs in his software

#74

Post by jlgaddis »

EGreg wrote: post #60

I once wanted to put a logic bomb for a client that was a startup and for months (years?) prioritize paying others. I had accumulated $30K in debt for them as they told me the sky is falling numerous times and that they’d pay me as soon as the next money came in. They just had raised hundreds of thousands but paid their own salaries and large empty office instead. I knew I’d have the upper hand if the site suddenly s…

It's probably for the best that you didn't go through it and -- although it obviously sucks that you lost $30K in the process -- hopefully you learned a lesson from it that prevented it from happening again!

Re: Contractor admits planting logic bombs in his software

#75

Post by NullPrefix »

zelon88 wrote: post #68
ChrisSD wrote: post #9

Earlier quoted context omitted.

Warning: This being true, it can still be construed as "hacking" no matter how simple it is. Just because the barrier is easy to get over, it doesn't mean you're legally allowed to enter. This person asserted the spreadsheet was his "work product". Presumably Siemens's lawyers found this convincing enough to be wary of hacking around the password.

I have a different view. Considering the company employed "Person A" to create a spreadsheet, why would it be a violation to employ "Person B" to gain access to it in the absence of "Person A"? The company owns all of the technology and employs all of the personnel involved, no?

Wasn't he a consultant, not an employee?

Re: Contractor admits planting logic bombs in his software

#76

Post by xadhominemx »

csense wrote: post #29
rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

It's probably covered in line 3,781 of the EULA for the printer's firmware.

Historically it wasn’t written down anywhere, but printer companies lost some lawsuits so now it’s actually written on the outside of the box.

Re: Contractor admits planting logic bombs in his software

#77

Post by NullPrefix »

zozbot234 wrote: post #11
arthurcolle wrote: post #7

Earlier quoted context omitted.

Haha really? That is hilariously insecure.

I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.

The Torx screw of presentations.

Re: Contractor admits planting logic bombs in his software

#78

Post by NullPrefix »

ppseafield wrote: post #58
mgleason_3 wrote: post #37

Wow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime? We hired a licensed plumber on 2 occasions - to install a sink and later a shower. We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged. We also had him look at t…

Did the previous plumber install a timer on a pipe, ensuring it would leak every 6 weeks?

The "timer" was based on hair amount in water flow.

Re: Contractor admits planting logic bombs in his software

#79

Post by lostgame »

StuffedParrot wrote: post #55
csense wrote: post #29

Earlier quoted context omitted.

It's probably covered in line 3,781 of the EULA for the printer's firmware.

...which are definitely enforceable right? I’m trying to remember why we put up with them as a society.

Because we have no effective replacement yet. Common sense, unfortunately, doesn't work for everyone.
Post reply on HN