10 ms·

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

by vemv 10y ago

mhurron 10y ago
Backdoors can be installed after the fact. The vendor putting in a back door is only one way for it to be present. This would be malware inserting a back door for further exploitation.
- DrJokepu 10y ago
  I don't know much about security, but I had the impression that a "third-party" developed and installed backdoor is called a rootkit.
  - jdmichal 10y ago
    A rootkit is a different beast. A backdoor is simply a (covert) way to gain remote access to a system. A rootkit involves being able to elevate user permissions such that you have full control over the computer. Rootkits also typically use such permissions to hide themselves from normal user accounts. I guess in a way you could see them as related, in that they both are access tools. A backdoor gets you remote access to the system in the first place. A rootkit gets you elevated access after you are in the system.
    - commenter23 10y ago
      No, that's wrong. A rootkit is the thing you install once you have root - not a way to get root initially. It usually gives the attacker a means to access the machine in the future, even if the vulnerability she used is fixed in the future. Rootkits are designed to hide themselves. They are essentially attacker installed backdooors. A backdoor is basically a rootkit that is part of the original software as written by the original developer. The words have different connotations (rootkit is extremely negative, backdoors slightly less).
      - mordocai 10y ago
        No, that's wrong. Wikipedia has definitions that match my own knowledge, so i'll link and quote those. https://en.wikipedia.org/wiki/Rootkit https://en.wikipedia.org/wiki/Rootkit "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) while at the same time masking its existence or the existence of other software." https://en.wikipedia.org/wiki/Backdoor_(computing) https://en.wikipedia.org/wiki/Backdoor_(computing) "A backdoor is a method, often secret, of bypassing normal authentication in a product, computer system, cryptosystem or algorithm etc. Backdoors are often used for securing unauthorized remote access to a computer, or obtaining access to plaintext in cryptographic systems. A backdoor may take the form of a hidden part of a program,[1] a separate program (e.g. Back Orifice may subvert the system through a rootkit), or may be a hardware feature.[2] Although normally surreptitiously installed, in some cases backdoors are deliberate and widely known. These kinds of backdoors might have "legitimate" uses such as providing the manufacturer with a way to restore user passwords."
        woodman 10y ago
        No, that is really wrong. Rootkits aren't for privilege escalation, see the paragraph immediately following your quote: "... an attacker can install it once they've obtained root or Administrator access." Calling BO a backdoor is a major corruption of the word, as you loose the only word for describing intentionally weakened security - so that you may describe a thing which already has several more explicitly defining names: malware, trojan, dropper, etc.
        jdmichal 10y ago
        The installation of the rootkit is different from its purpose. A rootkit may require a root permission to install, perhaps piggybacking on another legitimate install such as in the famous Sony BMG rootkit. Or it may use an exploit to gain root access and install. However, once installed, the purpose is the same: To provide the attacker with root permissions. It will also typically use its access to root permissions to hide itself from detection.
  - detaro 10y ago
    Rootkit is more commonly used for something that actively messes with the system to avoid detection for itself and potentially other malware, often by intercepting system calls and removing evidence from the responses. Malware that just runs some code to provide a backdoor isn't necessarily a rootkit. E.g. if I install a VNC server on your system and turn off the tray icon, it is a backdoor. I could use a rootkit in combination to also hide it's files on disk, remove it from process listings, hide it's open sockets, ...
  - duaneb 10y ago
    No, it refers to different things. Back-door is a technique or practice and a rootkit is a type of malware. Rootkits often (but not always) install backdoors.
  - mhurron 10y ago
    http://www.sqasolar.org.uk/solar/material/IS01CGCD/page_19.htm http://www.sqasolar.org.uk/solar/material/IS01CGCD/page_19.h... A rootkit can implement backdoor functionality, but not all rootkits are backdoors, and not all backdoors are rootkits.
- Analemma_ 10y ago
  If you previously establish that the vulnerability was introduced by a third party, then "backdoor" might be an OK term afterward - after the context has been introuced. In an example without context (like, a headline), "backdoor" strongly implies that it was built by the vendor. I have to disagree with you and concur with the other commenters saying this was a very misleading choice of words by Kaspersky. They should have just said "malware".
  - eriknstr 10y ago
    I agree. My first reaction when I read the headline was, I thought Apple had put it there, which I found disturbing seeing as how Apple has publicly spoken out against backdoors. I think a better title would be something like "Sophisticated OS X Backdooring Malware Discovered". That would make it clear that the backdoor is not present in the binaries shipped by Apple.
    - mseri 10y ago
      Same here. Malicious backdoor or rootkit backdoor would have been more appropriate
  - wlesieutre 10y ago
    I make the same association. A door is part of a building, and is put there during construction (initial release) or in owner-planned renovations (software updates). I've never heard of someone breaking into a building by cutting a hole into a wall to install their own entry door that they have a key to, but that's the scenario this "OS X backdoor" is describing.
linkregister 10y ago
I agree, the terminology Kaspersky Labs is using is incorrect and misleading. The further poster is right that this should be labeled as "rootkit."
- throwaway76543 10y ago
  No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only a backdoor. Not a rootkit.
  - takeda 10y ago
    rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. The sony rootkit was named somewhat incorrectly, because it also tried to hide itself and no other existing malware names fit it.
    - stcredzero 10y ago
      rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. Are you sure? It also commonly referred to such kits being used by hostile parties. I've personally interrupted an attempt at installing the "Hungarian Rootkit" in the 90's. (I put unpatched Red Hat 6 online when Red Hat 7 was out.) (that's where the name comes from root = admin on unix) The fact that you think this is something that bears explaining is interesting in the context of HN. I hope this is based on something you've noticed about recent user trends here. There was a time when someone would be very surprised if a user here didn't already know this.
      - 10y ago
aidenn0 10y ago
BackOriface was called a "backdoor" back in the day, so I think the term is fine.
- eps 10y ago
  * BackOrifice
takeda 10y ago
Backdoor is probably the correct term, I guess we just got used to vendor placed backdoors. Although I also assumed at first that it was vendor placed, even though I was familiar with backdoors from the past (Back Orifice, Sub7 etc)
- Esau 10y ago
  Then maybe we need a more defined term? Something like 1st-party backdoor vs 3rd-party backdoor?
codesterling 10y ago
I don't like the use of backdoor for malicious cracks, as it confuses the argument between malware and bad security practices. Though technically, backdoor is the correct term.
- lawnchair_larry 10y ago
  Cracks are for defeating copy protection, so this comment is all kinds of problematic!
deleted 10y ago
[deleted]
matt-attack 10y ago
Perhaps some would enjoy some related humor while we're on the topic of backdoors: https://www.youtube.com/watch?v=cuYQ4qUEfEI https://www.youtube.com/watch?v=cuYQ4qUEfEI

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

by vemv 10y ago

Is 'backdoor' the correct term if the vulnerability does not originate from Apple?

Backdoors can be installed after the fact. The vendor putting in a back door is only one way for it to be present. This would be malware inserting a back door for further exploitation.

DrJokepu 10y ago
I don't know much about security, but I had the impression that a "third-party" developed and installed backdoor is called a rootkit.
- jdmichal 10y ago
  A rootkit is a different beast. A backdoor is simply a (covert) way to gain remote access to a system. A rootkit involves being able to elevate user permissions such that you have full control over the computer. Rootkits also typically use such permissions to hide themselves from normal user accounts. I guess in a way you could see them as related, in that they both are access tools. A backdoor gets you remote access to the system in the first place. A rootkit gets you elevated access after you are in the system.
  - commenter23 10y ago
    No, that's wrong. A rootkit is the thing you install once you have root - not a way to get root initially. It usually gives the attacker a means to access the machine in the future, even if the vulnerability she used is fixed in the future. Rootkits are designed to hide themselves. They are essentially attacker installed backdooors. A backdoor is basically a rootkit that is part of the original software as written by the original developer. The words have different connotations (rootkit is extremely negative, backdoors slightly less).
    - mordocai 10y ago
      No, that's wrong. Wikipedia has definitions that match my own knowledge, so i'll link and quote those. https://en.wikipedia.org/wiki/Rootkit https://en.wikipedia.org/wiki/Rootkit "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) while at the same time masking its existence or the existence of other software." https://en.wikipedia.org/wiki/Backdoor_(computing) https://en.wikipedia.org/wiki/Backdoor_(computing) "A backdoor is a method, often secret, of bypassing normal authentication in a product, computer system, cryptosystem or algorithm etc. Backdoors are often used for securing unauthorized remote access to a computer, or obtaining access to plaintext in cryptographic systems. A backdoor may take the form of a hidden part of a program,[1] a separate program (e.g. Back Orifice may subvert the system through a rootkit), or may be a hardware feature.[2] Although normally surreptitiously installed, in some cases backdoors are deliberate and widely known. These kinds of backdoors might have "legitimate" uses such as providing the manufacturer with a way to restore user passwords."
      - woodman 10y ago
        No, that is really wrong. Rootkits aren't for privilege escalation, see the paragraph immediately following your quote: "... an attacker can install it once they've obtained root or Administrator access." Calling BO a backdoor is a major corruption of the word, as you loose the only word for describing intentionally weakened security - so that you may describe a thing which already has several more explicitly defining names: malware, trojan, dropper, etc.
        jdmichal 10y ago
        The installation of the rootkit is different from its purpose. A rootkit may require a root permission to install, perhaps piggybacking on another legitimate install such as in the famous Sony BMG rootkit. Or it may use an exploit to gain root access and install. However, once installed, the purpose is the same: To provide the attacker with root permissions. It will also typically use its access to root permissions to hide itself from detection.
- detaro 10y ago
  Rootkit is more commonly used for something that actively messes with the system to avoid detection for itself and potentially other malware, often by intercepting system calls and removing evidence from the responses. Malware that just runs some code to provide a backdoor isn't necessarily a rootkit. E.g. if I install a VNC server on your system and turn off the tray icon, it is a backdoor. I could use a rootkit in combination to also hide it's files on disk, remove it from process listings, hide it's open sockets, ...
- duaneb 10y ago
  No, it refers to different things. Back-door is a technique or practice and a rootkit is a type of malware. Rootkits often (but not always) install backdoors.
- mhurron 10y ago
  http://www.sqasolar.org.uk/solar/material/IS01CGCD/page_19.htm http://www.sqasolar.org.uk/solar/material/IS01CGCD/page_19.h... A rootkit can implement backdoor functionality, but not all rootkits are backdoors, and not all backdoors are rootkits.
Analemma_ 10y ago
If you previously establish that the vulnerability was introduced by a third party, then "backdoor" might be an OK term afterward - after the context has been introuced. In an example without context (like, a headline), "backdoor" strongly implies that it was built by the vendor. I have to disagree with you and concur with the other commenters saying this was a very misleading choice of words by Kaspersky. They should have just said "malware".
- eriknstr 10y ago
  I agree. My first reaction when I read the headline was, I thought Apple had put it there, which I found disturbing seeing as how Apple has publicly spoken out against backdoors. I think a better title would be something like "Sophisticated OS X Backdooring Malware Discovered". That would make it clear that the backdoor is not present in the binaries shipped by Apple.
  - mseri 10y ago
    Same here. Malicious backdoor or rootkit backdoor would have been more appropriate
- wlesieutre 10y ago
  I make the same association. A door is part of a building, and is put there during construction (initial release) or in owner-planned renovations (software updates). I've never heard of someone breaking into a building by cutting a hole into a wall to install their own entry door that they have a key to, but that's the scenario this "OS X backdoor" is describing.

linkregister 10y ago

I agree, the terminology Kaspersky Labs is using is incorrect and misleading. The further poster is right that this should be labeled as "rootkit."

throwaway76543 10y ago
No, Kaspersky Labs is using correct terminology. Some rootkits install a backdoor. Not all rootkits install a backdoor -- some merely conceal themselves and operate locally. The famous Sony Rootkit is one such example of a rootkit which did not add a backdoor. The defining characteristic of a rootkit is that it conceals its presence from the rest of the system. Backdoor.OSX.Mokes.a doesn't really do this -- it's only a backdoor. Not a rootkit.
- takeda 10y ago
  rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. The sony rootkit was named somewhat incorrectly, because it also tried to hide itself and no other existing malware names fit it.
  - stcredzero 10y ago
    rootkit comes from unix, it was a tool helping to restore admin privileges even after the admin found that the host was hacked (that's where the name comes from root = admin on unix). Its goal was to be invisible. Are you sure? It also commonly referred to such kits being used by hostile parties. I've personally interrupted an attempt at installing the "Hungarian Rootkit" in the 90's. (I put unpatched Red Hat 6 online when Red Hat 7 was out.) (that's where the name comes from root = admin on unix) The fact that you think this is something that bears explaining is interesting in the context of HN. I hope this is based on something you've noticed about recent user trends here. There was a time when someone would be very surprised if a user here didn't already know this.
    - 10y ago

aidenn0 10y ago

BackOriface was called a "backdoor" back in the day, so I think the term is fine.

eps 10y ago
* BackOrifice

takeda 10y ago

Backdoor is probably the correct term, I guess we just got used to vendor placed backdoors. Although I also assumed at first that it was vendor placed, even though I was familiar with backdoors from the past (Back Orifice, Sub7 etc)

Esau 10y ago
Then maybe we need a more defined term? Something like 1st-party backdoor vs 3rd-party backdoor?

codesterling 10y ago

I don't like the use of backdoor for malicious cracks, as it confuses the argument between malware and bad security practices. Though technically, backdoor is the correct term.

lawnchair_larry 10y ago
Cracks are for defeating copy protection, so this comment is all kinds of problematic!

deleted 10y ago

[deleted]

matt-attack 10y ago

Perhaps some would enjoy some related humor while we're on the topic of backdoors: https://www.youtube.com/watch?v=cuYQ4qUEfEI https://www.youtube.com/watch?v=cuYQ4qUEfEI