Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Linux backdoor attempt of 2003 (2013)

freedom-to-tinker.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: The Linux backdoor attempt of 2003 (2013)

#81

Post by epcoa »

spenczar5 wrote: post #40
grugq wrote: post #28

Earlier quoted context omitted.

What is there to say about the hack? Like everything back then it was probably accomplished by exploiting trust relationships. I can ask him, but it is not at interesting 20 years later.

It is very interesting to prove whether or not it was a state actor! Surely you can see that that mystery is interesting to many people.

A state actor would have done a much better job. This was detected nearly immediately and anyone that knew how the system was setup (which was public knowledge) would have known this would be caught. The state level hackers are not that dumb.

If there was a serious backdoor attempt, then this was the distractor.

And seriously back in those days especially Linux didn’t need much help with getting root exploits in the tree.

Re: The Linux backdoor attempt of 2003 (2013)

#82

Post by wrboyce »

hn_go_brrrrr wrote: post #55
cwillu wrote: post #36

Earlier quoted context omitted.

“Backdoor” means something deliberately and specifically added to enable the vulnerability. I.e., something can't really be both a backdoor and an exploit.

Really? I think of a backdoor as a deliberate vulnerability, and the exploit as the attack (or attack code) that makes use of any kind of vulnerability. Let's say the NSA adds a backdoor. If someone else finds it, isn't that an exploit?

Very similarly to yourself, but I would say backdoor and vulnerability are mutually exclusive (kinda? I guess a backdoor is a deliberate vulnerability but I think you know what I mean) yet both can be exploited (the exploit being the client side code, if you will).

Re: The Linux backdoor attempt of 2003 (2013)

#83

Post by a-dub »

School-Cotton wrote: post #75
a-dub wrote: post #51

it still seems kinda weird to me that all it takes to elevate privileges for a user process to "can arbitrarily write system level memory or disk" is just the clearing of all the bits of a single integer in kernel space which can be done by pretty much any execution path in the kernel. it just seems like there could be a more tamper resistant mechanism around privilege elevations.

Yeah, everything in the kernel is trusted and lives in one address space, just like any normal program. This is part of what would be solved by a microkernel architecture.

that's part of it. and is the basis of the classic tannenbaum v. torvalds debate, but only part of what i mean.

it would be interesting if there were some kind of write protection on the process-privilege data where some effort is made to verify the provenance of updates before they're allowed to go through or maybe even the whole privilege table is centralized and signed.

Re: The Linux backdoor attempt of 2003 (2013)

#84

Post by rcxdude »

GuB-42 wrote: post #29
ijustlovemath wrote: post #10

Another bit of cleverness not mentioned in the article is that assignment expressions always evaluate to the rvalue. So the expression `current->uid = 0` has the effect of making sure that entire conditional never actually runs (or at least, the return never runs), which means the overall behavior of wait4 doesn't change in an observable way. Very clever if you're trying to pass all of the existing tests

But that should be something the compiler could catch. The expression is always false and the condition would never be executed. You usually get a warning for that. And if the compiler doesn't, linters do. This is a common mistake, and I believe most linters have rules for that. And I don't think there is any situation where there is a good reason for code like this to exist. Either the expression is wrong, or it doe…

Even now, and I'm pretty sure back then, the relevant warning in GCC is suppressed if the assignment occurs in parentheses, like it did in the diff (clang I believe has the same behaviour). So you would likely need a static analysis tool to flag up the behaviour, and those are quite noisy at the best of times.

Re: The Linux backdoor attempt of 2003 (2013)

#85

Post by p-e-w »

epcoa wrote: post #79
grugq wrote: post #3

I have the full story on that incident. It is actually really funny. If the guy who did it wants to come forward, that is his decision. [edit: I won't name names.] He did provided me the full story. He told me with the understanding that the story would go public, so I will dig it up and post it. I also interviewed the sysadmins who were running the box at the time. 1. it was not an NSA operation, it was done by a ha…

Geez, this crowd. The clearest evidence that it was not an NSA attack is that it was not very good. It modified a CVS mirror. At no time was the source of truth (the bitkeeper repo) in any danger. Anybody that knew how this stuff worked at the time would have known it would be caught immediately. Not very state level expertise, pretty sad if it was the NSA.

> The clearest evidence that it was not an NSA attack is that it was not very good.

I suspect you are being sarcastic, but in case you aren't, you may want to reexamine your assumptions.

The colossal incompetence that is synonymous with government work doesn't magically stop at three-letter agencies. The FBI/CIA communication fuckups before 9/11 are just one famous example.

The idea that the NSA is staffed with "uber hackers" is a Hollywood fantasy. A government job working as a hacker is still a government job. Why would someone with that skillset, who can get a job at FAANG for 10x the salary, submit to the bureaucracy and monitoring BS that comes with working for an intelligence agency? I'm sure there are a select few who find this appealing, but the vast majority are just going the take the money and the free life.

Re: The Linux backdoor attempt of 2003 (2013)

#86

Post by stevehawk »

p-e-w wrote: post #85
epcoa wrote: post #79

Earlier quoted context omitted.

Geez, this crowd. The clearest evidence that it was not an NSA attack is that it was not very good. It modified a CVS mirror. At no time was the source of truth (the bitkeeper repo) in any danger. Anybody that knew how this stuff worked at the time would have known it would be caught immediately. Not very state level expertise, pretty sad if it was the NSA.

> The clearest evidence that it was not an NSA attack is that it was not very good. I suspect you are being sarcastic, but in case you aren't, you may want to reexamine your assumptions. The colossal incompetence that is synonymous with government work doesn't magically stop at three-letter agencies. The FBI/CIA communication fuckups before 9/11 are just one famous example. The idea that the NSA is staffed with "uber…

maybe 10x the salary (probably not) but also a correlated increase in hours instead of a contractually mandated maximum of 40 hours, combined with the legal inability to do work from home, discuss work at home, and a lot of related perks.

Re: The Linux backdoor attempt of 2003 (2013)

#87

Post by cwillu »

hn_go_brrrrr wrote: post #55
cwillu wrote: post #36

Earlier quoted context omitted.

“Backdoor” means something deliberately and specifically added to enable the vulnerability. I.e., something can't really be both a backdoor and an exploit.

Really? I think of a backdoor as a deliberate vulnerability, and the exploit as the attack (or attack code) that makes use of any kind of vulnerability. Let's say the NSA adds a backdoor. If someone else finds it, isn't that an exploit?

Irregular verb joke incoming:

I log in. You backdoor. They exploit.

Re: The Linux backdoor attempt of 2003 (2013)

#88

Post by p-e-w »

stevehawk wrote: post #86
p-e-w wrote: post #85

Earlier quoted context omitted.

> The clearest evidence that it was not an NSA attack is that it was not very good. I suspect you are being sarcastic, but in case you aren't, you may want to reexamine your assumptions. The colossal incompetence that is synonymous with government work doesn't magically stop at three-letter agencies. The FBI/CIA communication fuckups before 9/11 are just one famous example. The idea that the NSA is staffed with "uber…

maybe 10x the salary (probably not) but also a correlated increase in hours instead of a contractually mandated maximum of 40 hours, combined with the legal inability to do work from home, discuss work at home, and a lot of related perks.

Also "perks" like having your life put under the microscope at regular intervals, going to prison if you talk about what you do, etc.

And I strongly doubt that agencies that are known to routinely violate the law, the constitution, and human rights care about "contractually mandated" 40-hour workweeks.

Re: The Linux backdoor attempt of 2003 (2013)

#89

Post by worthless-trash »

School-Cotton wrote: post #75
a-dub wrote: post #51

it still seems kinda weird to me that all it takes to elevate privileges for a user process to "can arbitrarily write system level memory or disk" is just the clearing of all the bits of a single integer in kernel space which can be done by pretty much any execution path in the kernel. it just seems like there could be a more tamper resistant mechanism around privilege elevations.

Yeah, everything in the kernel is trusted and lives in one address space, just like any normal program. This is part of what would be solved by a microkernel architecture.

Can you explain how..

Its my understanding that if "OS process" runs with its own address space with privileges (as it needs to talk to hardware), once an attacker has code execution functionality, what stops them from mapping the memory they need then writing to the address to set uid ?

Re: The Linux backdoor attempt of 2003 (2013)

#90

Post by joncrane »

p-e-w wrote: post #85
epcoa wrote: post #79

Earlier quoted context omitted.

Geez, this crowd. The clearest evidence that it was not an NSA attack is that it was not very good. It modified a CVS mirror. At no time was the source of truth (the bitkeeper repo) in any danger. Anybody that knew how this stuff worked at the time would have known it would be caught immediately. Not very state level expertise, pretty sad if it was the NSA.

> The clearest evidence that it was not an NSA attack is that it was not very good. I suspect you are being sarcastic, but in case you aren't, you may want to reexamine your assumptions. The colossal incompetence that is synonymous with government work doesn't magically stop at three-letter agencies. The FBI/CIA communication fuckups before 9/11 are just one famous example. The idea that the NSA is staffed with "uber…

Not to mention it being extremely difficult to travel internationally, and not being able to have close personal friendships with many people who live in other countries. Not being able to partake in THC consumption EVER, much less any other recreational substance besides alcohol. The list goes on.

I understand that it pays very well and there's decent work/life balance in terms of hours. But you have to essentially work in a windowless cell with no internet. And for lots of people with the curious hacker mentality, it would be a chore to "keep your nose clean" as they say.

I live in the DC area and the stereotype of the bland, khaki, polo, and white sneakers wearing boring person is true.

Post reply on HN