4 ms·
While that's true, the correct way of creating deniable backdoors is to simply write insecure code. The best way to detect something like that is essentially wh
by darawk 7y ago
While that's true, the correct way of creating deniable backdoors is to simply write insecure code. The best way to detect something like that is essentially what this article tries to do: a comparative analysis of vulnerability frequency. It doesn't do a great analysis, but it is the correct approach to thinking about the problem.
- gjsman-1000 7y agoYou do have a point. If I was an assigned Chinese official supervising Huawei (like every Chinese business with 50+ employees), would I say, "go write one backdoor?" Nope, I would say, "be sloppy and maybe a few will go undetected."
- deleted 7y ago[deleted]
- eli 7y agoThat’s conspiracy theory logic. The fact that it doesn’t look like a backdoor is evidence that it’s a backdoor? It is impossible to disprove something like that.
- gjsman-1000 7y agoPerhaps. But at the same time, if I was a Chinese gov't official tasked with getting a backdoor past America's radar, what would be my strategies? Writing sloppy code with the hope that a few bugs will be undetected seems like a decent strategy to me.
- inferiorhuman 7y agoWhat of this: Dahua at first ignored ReFirm’s inquiries, then claimed the vulnerability was a simple error that had been fixed in the latest update. But when ReFirm looked through the updated firmware, they still found the same backdoor — just relocated in a different place in the code. (Huawei had done the same thing).
- darawk 7y agoI'm not saying that it is evidence that it is a backdoor. I'm saying that it is indistinguishable, because that's how you would do things if it were a backdoor as well. The correct way to try to discriminate is to look at how frequent they are, and maybe how they're patched.
- smsm42 7y agoNo, the logic is not "it doesn't look like a backdoor" but "backdoors and vulnerabilities look very much alike". And given the story of vulnerability being shuffled from place to place instead of removed, the probability of it being deliberate raises. Surely, it can be just gross incompetence, but you don't want grossly incompetent vendor any more than you want a spying one.
- gjsman-1000 7y agoThis entire thing reminds me a little bit of the Linux Backdooring Attempt of 2003. A tiny dropped symbol that didn't look like a backdoor and just sloppy at first, but actually...
- rocqua 7y agoWhy would deniable backdoors be visible in vulnerability frequency? In principle, you only need a single back-door. Perhaps you need to chain some vulnerabilities and build in some redundancy. According the article, this had 100 vulns, which was signficantly worse than comparable vendors. If we assume that to mean comparable vendors have 50 vulnerabilities, we would have to believe they included 50 vulnerabilities intentionally.
- darawk 7y agoIf I were inserting vulns as backdoors, i'd want several in case some of them got discovered.
- maximente 7y agoeven better if the insecure code takes advantage of absolutely plausible coding mistakes/language quirks. see e.g. underhanded C contest for very subtle and deniable ways to provide nefarious functionality. http://underhanded-c.org/_page_id_22.html http://underhanded-c.org/_page_id_22.html