4 ms·
> The argument to the strcmp call is <<< %s(un='%s') = %u, which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the
by _jomo 11y ago
> The argument to the strcmp call is <<< %s(un='%s') = %u, which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the many other debug format strings in the code.
That's very clever from the attackers point of view, extra kudos to hdmoore for finding it!
- scrollaway 11y agoWell I definitely expect to find that password in the very next Person of Interest episode. :) This has gotten me to wonder just how much software out there is backdoored in such a serious and absolute way... Scary.
- Vexs 11y agoHuh, is that show coming back around? I kinda liked how they would spin current tech events, and the idea of an AI that spread itself over power boxes was neat to say the least.
- scrollaway 11y agoThey have a final season 5 scheduled for some time in the next few months. I'm very excited myself. It's the only show, other than Mr. Robot, that has plausible tech scenes and often drops real bits of hacky trivia, remaining very enjoyable for a techie despite the premise itself being far-fetched. And their political commentary on mass surveillance is beautiful. And the way it transitions from criminal procedural to scifi ... beautiful.
- joeyrideout 11y agoYou may also be interested in Continuum. I love that show for its spot-on perspective of present-day technology mixed with a believable vision of the future. Anecdotally, I remember reading that Continuum had a hacker writing their technical scenes -- news that didn't surprise me one bit :)
- scrollaway 11y agoThanks! Continuum has been on my to-watch list before, I'll push it back up. I wish I had a relevant series to give you back, but good tech series are few and far between, so I'll just recommend Six Feet Under. ;)
- captaincrowbar 11y agoNot really clever. Format strings have a fairly restricted format; that one can't have all that many bits of entropy. Once the obfuscation method occurred to an attacker, it wouldn't take long to brute force it even if they didn't have a file to search for suggestions. (And now that the idea is out there, I bet any number of hackers, wearing assorted coloured hats, are trying this out on other systems Even As We Speak.)
- w-ll 11y agomost attkers bruteforce common string passwords. Even if i had a binary to run strings thru this would pass by me. Not that im super smart or clever, but this is a interesting camouflage.
- tajen 11y agoThe goal is to weaken security and open a breach. Even a boolean would have been satisfying as a password.
- IshKebab 11y agoWhy would obfuscation method randomly occur to the attacker? It wouldn't. You'd only realise by looking at the code and at that point you have the password anyway.
- qb45 11y ago> Not really clever. Format strings have a fairly restricted format; that one can't have all that many bits of entropy. I fully agree that now is a great time to brute-force every ssh server found on the Internet with randomly generated valid format strings. However, did you know it before this password was published? I think it was a novel idea.
- amalag 11y agoWhen they say "presumably chosen" who (not the person, but what level of development was taking place) inserted this code? What was the purpose in inserting this password? The use of "chosen" means it was not an oversight?
- qb45 11y agoAnd the first google.com hit for this query is... Wikipedia article on Sun Tzu, the Chinese philosopher who wrote The Art of War. Does the Web know something we don't?
- emillon 11y agoThe letters in this password spell "sun su".
- qb45 11y agoI suppose that's the reason. Still, I found the result completely unexpected and amusing. I googled this string just to see if it has ever appeared anywhere else but apparently Google these days tries very hard not to return zero results.
- klackerz 11y agoYou could double quotes the query to search for exact match in google.
- marshray 11y agogasp So what the attacker is saying is ...