13 ms·
Contractor admits planting logic bombs in his software
- javagram 7y agoApparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.
- navaati 7y agoOn the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! Still a good laugh from the sidelines...
- john-radio 7y ago> On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! It's a little different if only from a professional dignity perspective, lol. Also, every senior programmer I've ever worked with who makes use of third-party binaries will find a moment to say, "I'll just decompile it if it ever gives us any real trouble!"
- philipov 7y agoCorporations have no professional dignity.
- logfromblammo 7y agoWe deliver source to the customer, and include compiled binaries and installers as a (paid) courtesy. Without the source, the customer loses the ability to switch software contractors, which is against their procurement rules. Even if you don't have the clout of being huge, not controlling the source for business-critical software is basically putting the supplier's gun up to your own head. Companies that take binary-only delivery have obviously never hired anyone who could tell them they shouldn't do that. Always get the source, or write it in-house.
- iso947 7y agoVast majority of companies rely on Microsoft and other proprietary software
- logfromblammo 7y agoI was not discussing computing infrastructure, such as the OS or office productivity suites, but rather custom business logic, that is specific to the company.
- mark-r 7y agoI once worked for a company that had a spreadsheet for plant production planning. The spreadsheet was put together by a consultant, but it was not protected - the company adjusted it constantly to maximize productivity at the plant. The consultant made more than the plant manager because he was the only person who understood the spreadsheet enough to make meaningful changes as required, e.g. when a machine on the line was replaced with another having a different capacity.
- sct202 7y agoThat's the ethical way to do it. If you give a business everything they ask for in requirements, the end result is probably going to be absurdly complicated for anyone to edit even with documentation, training, and open code.
- davengh 7y agoWe offer escrow of our source as an option for our customers who have concerns or policies about mission-critical software. The escrow includes instructions about tooling needed & versions (Visual Studio and others), any third-party (Telerik) or open-source things we use, database creation scripts, etc. A couple have run DR drills where they pulled the escrow, went through the instructions, and produced executables.
- choeger 7y agoYep. If it was me I would hold the supervisors responsible.
- AnIdiotOnTheNet 7y agoOf course you would, developers are always blameless!
- zelon88 7y agoIf you dump the XML and remove the <sheetProtection password=/> line you don't even need to ask for the password.
- arthurcolle 7y agoHaha really? That is hilariously insecure.
- zozbot234 7y agoI surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.
- kevindqc 7y agoMakes sense. The software needs to access that code for the spreadsheet to work, so if it was encrypted for example, then the spreadsheet would be unusable unless you know the password
- arthurcolle 7y agoI guess in any case, if you really care about security, you could just encrypt the file separately and only send someone the encrypted binary.
- NullPrefix 7y agoThe Torx screw of presentations.
- gruez 7y agoBut then again, how would you make it secure? Clearly, the program itself must have full access to the file (formulas and all), otherwise you wouldn't be able to do anything with the spreadsheet (effectively turning it to a pdf). Short of encrypting the entire spreadsheet and sealing the key in a TPM, it's impossible to implement edit protection.
- de_watcher 7y agoYou must be crazy to use proprietary closed source software. Oh, wait...
- tantalor 7y agoClosed source software prepared and used by only one client is a lot different than distributed and used by many clients.
- Rexxar 7y agoI'm sure there is a lot of password protected spreadsheets in finance industry.
- bilekas 7y agoI would be curious how they came to realise what was happening. Also, how were the contractors changes not reviewed? If the same engineers work keeps throwing unknown problems down the line, the LAST thing I am doing is contacting them again.
- zozbot234 7y agoCan you even "review" changes to spreadsheet code? I know that Office apps have some support for change management, but is it even up to this task?
- kevas 7y agoRubberduckVBA >> export all modules, classes, userforms >> send to git. That was my release workflow. Worked for the +30k line application I built in VBA.
- tyingq 7y agoThere is actually pretty nice diff / compare two spreadsheets functionality inside of Excel. Screenshot: https://support.content.office.net/en-us/media/9149c7e8-6f0c-438d-9a49-75016a5fb629.jpg https://support.content.office.net/en-us/media/9149c7e8-6f0c...
- arethuza 7y agoSeems to be dependent on what edition of Excel you have - I had a look for it and couldn't find it... (I'm using the up to date version from Office 365).
- phonon 7y agoYou need to use the Professional or ProPlus versions...or https://www.xltrail.com/ https://www.xltrail.com/
- tyingq 7y agoOpen the Quick Access drop down menu and select More Commands. In the Excel Options dialog box, select All Commands under Choose commands from. In the list of commands, scroll down to Compare and Merge Workbooks, select it and click the Add button to move it to the right-hand section.
- ChrisSD 7y agoIn 2011 Tinley had refused to hand over the password to unlock the spreadsheet for editing when asked, claiming he was protecting his work product. > For years, the spreadsheet would glitch, Tinley would be hired to come in, would "fix" it, invoice Siemens, and head out again. But that all changed in May 2016 when Tinley was out of state, and Siemens called again about the spreadsheet. The company had an urgent order it had to put through, it told Tinley, and it wasn't working properly again. Pushed, Tinley relented and handed over the password. https://www.theregister.co.uk/2019/06/25/siemens_logic_bomb/ https://www.theregister.co.uk/2019/06/25/siemens_logic_bomb/
- deleted 7y ago[deleted]
- auggierose 7y agoMust have been a brain freeze moment to hand over that password.
- 3fe9a03ccd14ca5 7y agoSounds to me like they used Tinley being out of state as an opportunity to push for the password. I’m sure they were suspecting something at that point.
- rumanator 7y agoMy guess is that they started suspecting something when he refused to hand over the password the first time, or at most the first time a problem occurred and he was the only person capable of fixing it.
- Rainymood 7y agoMalicious compliance by the contractor. Hilarious incompetence by Siemens.
- pc86 7y agoHow is this malicious compliance? He wrote code to intentionally stop working at certain times in order to defraud Siemens by getting them to pay for what is essentially the same work over and over again.
- ghostpepper 7y agoOff topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days? It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.
- thrower123 7y agoHmm, is this a common turn of phrase in reporting these days? I can't recall that expression being used outside of some rather old science fiction.
- markstos 7y agoI rarely see "logic bombs" in the news, but I remember the day the customer called angry on April 1st, complaining that their spreadsheet quit working. It seemed unlikely to be an April Fool's Day joke, but I knew the code hadn't changed so I couldn't understand why it would quit working. Root cause? The fiscal year in the spreadsheet started in April, which made it the "zeroth" month, which triggered a logic failure due to this being a false value. It would have made a great hard-to-spot logic bomb... if I had planted it intentionally!
- jrockway 7y agoWe really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values. The prosecutors and industries that coined these terms are very clever. For the petty crimes that they describe, they can turn the outrage up to eleven by comparing the most minor transgression to murder. In the case of DRM, the industry managed to convince people to buy new TVs, monitors, video cards, and cables... to protect their rights? Their right to be turned upside down and have the coins and bills shaken out of their pants, I guess.
- drderidder 7y agoAll I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!
- dmix 7y agoYeah, really, this is the first programmer I've ever heard of who had lacked bugs to be fixed. There's always new stuff to work on. Maybe he was only used for some older niche stuff that was going out of style and he was trying to cling to the past.
- deleted 7y ago[deleted]
- giancarlostoro 7y agoThat or he's hired by people who don't peer review at all, as in he's the only developer.
- mrlala 7y agoStill, I think the point remains having the time to even do this is astounding.. can't even keep up getting all my code to work properly in the first place as a mostly single developer!
- giancarlostoro 7y agoMaybe that's where he purposely introduces the bug, he keeps the broken version and times the working version. But yeah I agree with you, it's interesting altogether. I didn't mean to sound dismissive / against your viewpoint, just adding on possibilities.
- duxup 7y agoOr just the usual periodic business logic changes.
- rustybolt 7y agoShows the importance of code reviews. I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).
- csense 7y agoIt's probably covered in line 3,781 of the EULA for the printer's firmware.
- StuffedParrot 7y ago...which are definitely enforceable right? I’m trying to remember why we put up with them as a society.
- lostgame 7y agoBecause we have no effective replacement yet. Common sense, unfortunately, doesn't work for everyone.
- xadhominemx 7y agoHistorically it wasn’t written down anywhere, but printer companies lost some lawsuits so now it’s actually written on the outside of the box.
- elldoubleyew 7y agoWhat was the case of the microcontroller detecting the counterfeit cable? I don't think I've ever heard of this.
- mgleason_3 7y agoWow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime? We hired a licensed plumber on 2 occasions - to install a sink and later a shower. We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged. We also had him look at the shower because we couldn’t figure out how to get the screen out to clear the hair. Turns out the grate was also installed upside-down and the screws holding the screen in are in-accessible. So, there is no way to get it out without demoing the shower. Should this plumber be sentenced to 6-months in jail?
- yrro 7y agoJust sued for the cost of putting the job right.
- conistonwater 7y agoI understand it depends on whether the FBI can show malice, planning and intent, and the size of the damage ($42k in the Siemens case). So in your plumber case it's probably impossible unless it's like a pattern of fraud rather than just one mistreated client. If a plumber actually tried to make a fraudulent business model out of such behaviour, then I could totally believe they might get jail time. Furthermore, if you sue the plumber yourself, that's a civil case and so jail time is not possible at all (the Siemens case was handled by the FBI). I personally do not think that 6 months' jail for stealing $42k from somebody is so severe, to be honest, it's a lot of money.
- ggggtez 7y agoRight. If you stole a car (often valued at less than $40k), you could have gotten 1-9 years in the USA (depending on the value of the car).
- ppseafield 7y agoDid the previous plumber install a timer on a pipe, ensuring it would leak every 6 weeks?
- hurricanetc 7y agoI read the DOJ link and it just states “intentional damage to a protected computer.” If he had accidentally written sloppy code that happened to break periodically would that have been illegal? I don’t fully understand what law he broke and how such a law would not also apply to the seemingly infinite cases of built in obsolescence.
- tc313 7y ago> If he had accidentally written sloppy code The damage was intentional (i.e., not an accident).
- hurricanetc 7y agoRight. In this case he plead guilty and admitted to having done it. I am just curious as to which specific laws he broke and whether it is possible to inadvertently break these laws by being a horrible programmer. If he had intentionally created a spaghetti code mess that just happened to break from time to time would that be different? I assume intention is difficult to prove in court but I am not an attorney.
- elcomet 7y ago> If he had intentionally created a spaghetti code mess that just happened to break from time to time would that be different ? Clearly, yes. Here Siemens decided to go to court because it was obviously malicious code. With a spaghetti mess they would just have hired someone else to clean it.
- pc86 7y ago> I am just curious as to which specific laws he broke 18 USC 1030, or: > > intentional damage to a protected computer
- henvic 7y agoOf course if he just wrote bad spaghetti code with no boundaries, no tests, and that breaks everything from time to time, he'd have locked in the company, make other developer's experience a nightmare, and so on and get away with it. I think this might explain a few things I have seen or heard about in my life.
- leowoo91 7y agoHow about the maintenance services who act lazy reporting client issues to the main vendor? That's one of the undetected patterns I believe.
- hamilyon2 7y agoIt is somewhat like drm, but nobody goes to jail when books stop opening and old games break
- justincredible 7y agoRules for thee, but not for me.
- BuildTheRobots 7y ago> The parties in the case stipulated a total loss amount of $42,262.50 That's an oddly specific loss amount, especially the 50c
- isoskeles 7y agoWhat’s odd about it being specific? Take the number of billable hours he spent “fixing” his logic bombs x hourly rate for those events.
- dTal 7y agoThe loss also extends to any lost business resulting from the broken code, lost work, time on behalf of the people whose job it was to call him in, etc. These are very difficult to quantify exactly, and so the number of significant figures in the claimed amount looks odd. But the law doesn't allow you to say "oh, about 50 grand", so I imagine significant figure rounding in financial estimates isn't strongly emphasized anyway.
- pc86 7y agoYou have to be specific, as others have mentioned. And it's not that odd: * Contractor's time multiplied by their hourly rate * Whoever was overseeing the contractor for some percentage of their time multiplied by their fully loaded hourly rate * Processing and payment of contractor's invoices * Discounts or coupons given out as a result of late orders due to this problem * Anything in any contract relating to late orders that was caused by this problem, even in part You start multiplying fully loaded employee costs (including 401(k) matches, healthcare, etc) by fractions of a percentage for how often they deal with this person and it's not at all hard to end up with fractions of a penny at the end of it all.
- EGreg 7y agoI once wanted to put a logic bomb for a client that was a startup and for months (years?) prioritize paying others. I had accumulated $30K in debt for them as they told me the sky is falling numerous times and that they’d pay me as soon as the next money came in. They just had raised hundreds of thousands but paid their own salaries and large empty office instead. I knew I’d have the upper hand if the site suddenly stopped working. But I was afraid of some kind of “hacking laws” being “exceeding access” or whatever (probably stupid given what was realistic) and never did it. My only acceptable option was to do a DMCA takedown at AWS because they had never signed a copyright assignment. Anyway long story short I never got paid. Been too nice / scared. And the startup went out of business. Many of its investors were pissed. The usual.
- jlgaddis 7y agoIt's probably for the best that you didn't go through it and -- although it obviously sucks that you lost $30K in the process -- hopefully you learned a lesson from it that prevented it from happening again!
- LifeLiverTransp 7y agoNow rentseeking for self caused problems, that is reserved for the management class. What a upstart..
- ggggtez 7y ago>$42k Doesn't seem like he was a very good scam artist... That's not a lot of money to risk jail over.
- tc313 7y agoHe probably didn't know that he was risking jail.
- jonplackett 7y agoI wonder how they figured it out?
- MertsA 7y ago>Tinley added code to the complex spreadsheets that "had no functional value, other than to randomly crash the program," I could say the same about some of the... less talented developers I've worked with in the past. Hanlon's razor might not apply in this case, but that's a scary thought given how the US justice system seems so inept at handling cyber crime.
- pmiller2 7y agoWhy does the title not contain "to ensure he gets new work"? The original title was 2 characters too long for HN, but could have been edited to contain that information. For example: "Contractor admits planting logic bombs in software to ensure he’d get new work"
- LegitGandalf 7y agoDilbert covered this back in 95 https://dilbert.com/strip/1995-11-13 https://dilbert.com/strip/1995-11-13