Contractor admits planting logic bombs in his software • Hacker News Board

Re: Contractor admits planting logic bombs in his software

#91

Post by justincredible » Thu, Dec 19, 2019, 7:59 PM UTC

jrockway wrote: post #24

ghostpepper wrote: post #17

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

We really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values. The prosecutors and ind…

To be precise, the "bomb" was being obfuscated by the password, not the password per se.

Re: Contractor admits planting logic bombs in his software

#92

Post by schoen » Thu, Dec 19, 2019, 8:00 PM UTC

jlgaddis wrote: post #72

zelon88 wrote: post #6

Earlier quoted context omitted.

If you dump the XML and remove the line you don't even need to ask for the password.

About 30 years ago, when I was just a kid, my parents would make me go with them when they went shopping. I would always go wander around the electronics section of the store (I'm thinking of Walmart, specifically) to play with the computers. At that time, Windows 3.1 was the latest and greatest and is what was running on all of the "display" PCs. Unfortunately, the password-protected screensaver was almost always ac…

My recollection is that you can also stop AUTOEXEC.BAT from running by holding the shift key.

Re: Contractor admits planting logic bombs in his software

#93

Post by mark-r » Thu, Dec 19, 2019, 8:01 PM UTC

logfromblammo wrote: post #61

navaati wrote: post #10

Earlier quoted context omitted.

On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! Still a good laugh from the sidelines...

We deliver source to the customer, and include compiled binaries and installers as a (paid) courtesy. Without the source, the customer loses the ability to switch software contractors, which is against their procurement rules. Even if you don't have the clout of being huge, not controlling the source for business-critical software is basically putting the supplier's gun up to your own head. Companies that take binary…

I once worked for a company that had a spreadsheet for plant production planning. The spreadsheet was put together by a consultant, but it was not protected - the company adjusted it constantly to maximize productivity at the plant. The consultant made more than the plant manager because he was the only person who understood the spreadsheet enough to make meaningful changes as required, e.g. when a machine on the line was replaced with another having a different capacity.

Re: Contractor admits planting logic bombs in his software

#94

Post by bryanrasmussen » Thu, Dec 19, 2019, 8:10 PM UTC

henvic wrote: post #50

hurricanetc wrote: post #40

I read the DOJ link and it just states “intentional damage to a protected computer.” If he had accidentally written sloppy code that happened to break periodically would that have been illegal? I don’t fully understand what law he broke and how such a law would not also apply to the seemingly infinite cases of built in obsolescence.

Of course if he just wrote bad spaghetti code with no boundaries, no tests, and that breaks everything from time to time, he'd have locked in the company, make other developer's experience a nightmare, and so on and get away with it. I think this might explain a few things I have seen or heard about in my life.

well only if it was password protected bad spaghetti code, otherwise they would have had a better developer look at the spaghetti and unravel it. But he wouldn't have gotten any jail time.

Re: Contractor admits planting logic bombs in his software

#95

Post by taberiand » Thu, Dec 19, 2019, 8:11 PM UTC

sporkologist wrote: post #87

jlarocco wrote: post #82

Earlier quoted context omitted.

If he's purposely making mistakes to get work in the future then I don't think 6-months in jail is that bad. It's just plain fraud isn't it? Not to mention an expensive inconvenience for all of his customers who have to deal with his shoddy work. On the other hand, it's entirely possible the plumber made an honest mistake.

Yes the plumber obviously went to upside-down plumbing school where he learned the profit-maximizing techniques of installing everything upside-down.

Nah he's probably just Australian

Re: Contractor admits planting logic bombs in his software

#96

Post by AmericanChopper » Thu, Dec 19, 2019, 8:19 PM UTC

roenxi wrote: post #90

rustybolt wrote: post #22

Shows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

> the logic bombs Tinley surreptitiously planted into his projects caused them to malfunction after a certain preset amount of time Probably the timed aspect of it is the issue. Selling something that purposefully breaks in that way is malicious. Unless he comes up with a truly fantastic excuse but it doesn't sound like he did.

I think the intent to damage the systems is the issue, along with the fact that he confessed.

Re: Contractor admits planting logic bombs in his software

#97

Post by gruez » Thu, Dec 19, 2019, 8:19 PM UTC

arthurcolle wrote: post #7

zelon88 wrote: post #6

Earlier quoted context omitted.

If you dump the XML and remove the line you don't even need to ask for the password.

Haha really? That is hilariously insecure.

But then again, how would you make it secure? Clearly, the program itself must have full access to the file (formulas and all), otherwise you wouldn't be able to do anything with the spreadsheet (effectively turning it to a pdf). Short of encrypting the entire spreadsheet and sealing the key in a TPM, it's impossible to implement edit protection.

Re: Contractor admits planting logic bombs in his software

#98

Post by dTal » Thu, Dec 19, 2019, 8:19 PM UTC

isoskeles wrote: post #54

BuildTheRobots wrote: post #46

> The parties in the case stipulated a total loss amount of $42,262.50 That's an oddly specific loss amount, especially the 50c

What’s odd about it being specific? Take the number of billable hours he spent “fixing” his logic bombs x hourly rate for those events.

The loss also extends to any lost business resulting from the broken code, lost work, time on behalf of the people whose job it was to call him in, etc. These are very difficult to quantify exactly, and so the number of significant figures in the claimed amount looks odd. But the law doesn't allow you to say "oh, about 50 grand", so I imagine significant figure rounding in financial estimates isn't strongly emphasized anyway.

Re: Contractor admits planting logic bombs in his software

#99

Post by taxidump » Thu, Dec 19, 2019, 8:23 PM UTC

jlarocco wrote: post #82

mgleason_3 wrote: post #37

Wow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime? We hired a licensed plumber on 2 occasions - to install a sink and later a shower. We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged. We also had him look at t…

If he's purposely making mistakes to get work in the future then I don't think 6-months in jail is that bad. It's just plain fraud isn't it? Not to mention an expensive inconvenience for all of his customers who have to deal with his shoddy work. On the other hand, it's entirely possible the plumber made an honest mistake.

This sounds similar to planned obsolescence, so the moral is if you design it that way, as a manufacturer, you are ok. Definitely a grey area here.

Edit: After some thought, I feel a precedent. My car has parts that don't become obsolete, they flat break requiring never ending service. Surely I can sue for fraud as the auto company has the ability to use another means. (Devils advocate)

Re: Contractor admits planting logic bombs in his software

#100

Post by MertsA » Thu, Dec 19, 2019, 8:24 PM UTC

>Tinley added code to the complex spreadsheets that "had no functional value, other than to randomly crash the program,"

I could say the same about some of the... less talented developers I've worked with in the past. Hanlon's razor might not apply in this case, but that's a scary thought given how the US justice system seems so inept at handling cyber crime.