15 ms·
At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that c
by orisho 6y ago
At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|
- bhouston 6y agoYeah, I think that this is likely the case here from the screenshot.
- yjftsjthsd-h 6y agoIt seems like a thin line between a debugging feature and a backdoor; "merely a debugging server that could be enabled and allowed you to inspect internal state during runtime" seems like a backdoor to me, doubly so if it's network-accessible. If Intel has, say, an undocumented way to trigger a debug mode that lets you read memory and bypass restrictions (ex. read kernel memory from user mode, or read SGX memory), is that not a backdoor? Or is the name based on intent?
- jdminhbg 6y agoI think the difference is whether it's something that's always enabled. You could presumably make it available or not at compile time, so the software shipped to a customer wouldn't have it, but maybe if they were having issues, you could ship them a version with the debug server with their permission.
- yjftsjthsd-h 6y agoI can agree with that with the caveat that "enabled" has to be at either something that only the user can do. If it requires that the customer intentionally run a debug build, that's fine; if it can be toggled on without their knowledge, then it's a problem.
- orisho 6y agoIt was disabled by default, and could only be enabled using environment variables. Even when enabled, the whole thing ran in Docker and the socket was bound to loopback, so you could only connect to it from within the container. When the intention is a debugging server, making it exposed to the world is a mistake and a security vulnerability. At that point it is effectively a backdoor, but the difference between a high level vulnerability such as this and a backdoor is developer intent.
- tantalor 6y agoThat doesn't sound very safe.
- lukevp 6y agoWhat sounds unsafe about having a locally bound port inside a container that only binds with an env variable getting set?
- still_grokking 6y agoFor example that someone finds out about that backdoor and activate it to spy on users. Forwarding a port in Docker is not magic…
- orisho 6y agoSure, it's simple. But you would have to be able to modify the container settings anyway. For all practical uses, and certainly in my case, you could just make it run a different image at that point. Or copy another executable into the container and run it. You're already privileged. Requiring you to be privileged to access the debug server means it's secure.
- fit2rule 6y agoWas it a backdoor, or a hidden door, or .. a utility panel? The difference, in my opinion, is in the documentation and frequency of use. Is it overt? Does the customer really know its there, and what its for? Perfectly fine to have an access panel that gives you access to the buss .. if the pilot knows you're doing it. But if its some random entrance in the back of an alley, only 2 or 3 users in the universe know what it is and how to use it ..
- close04 6y agoImagine the reaction if the same thing was coming from China. Nobody would ask the question.
- fit2rule 6y agoNationality has nothing to do with it. I also don't trust Americans with such devices.
- close04 6y agoI'm talking about the general sentiment. You can see this on every* site, HN included. The litmus paper is that even pointing out something objectively true will get criticism (downvotes) rather than critical thinking. In the current atmosphere nobody asks the question when it comes to China/Russia/NK/Iran but will when it comes to the US despite the known history of hacking/spying on everyone else. *Recently a reputable tech site wrote an article introducing DJI (ostensibly a company needing no introduction) as "Chinese-made drone app in Google Play spooks security researchers". One day later the same author wrote an article "Hackers actively exploit high-severity networking vulnerabilities" when referring to Cisco and F5. The difference in approach is quite staggering especially considering that Cisco is known to have been involved, even unwittingly, in the NSA exploits leaked in the past. This highlights the sentiment mentioned above: people ask the question only when they feel comfortable that the answer reinforces their opinion.
- SEJeff 6y agoWe use the term “manhole” for those sorts of things
- bogidon 6y agoEw
- SEJeff 6y agoAs in a manhole cover in a street for maintenance.
- bogidon 6y agoYes, yes. Seems like an outdated term. Downvotes accepted.
- dogma1138 6y agoFine personhole it is.
- eli 6y ago"Maintenance Hole" actually, which is better because it's both more descriptive and not gendered.
- oneplane 6y agoBut what if manhole is just mankind hole? (It probably isn't, I didn't look it up). Man doesn't always mean male, or does it?
- deathanatos 6y ago> Man doesn't always mean male, or does it? Not necessarily, but see: https://en.wikipedia.org/wiki/Gender_neutrality_in_English#Debate https://en.wikipedia.org/wiki/Gender_neutrality_in_English#D... The link is about the debate as it is, but I would also encourage the use of good faith in interpreting any speaker: that is, assuming a person referring to "mankind" likely means all humans without exclusion based on gender or sex, and requiring some other material evidence before presuming bias. I also wonder what these discussions are like in languages where most nouns are gendered, e.g., in French.
- yelloworangefog 6y agoFrankly I don't think Intel's track record affords them the privilege of having good faith be assumed with something like this.
- newacct583 6y agoIntel doesn't have a track record of shipping back doors, or even "bad faith" software really.
- switchbak 6y agoIsn't their whole management engine essentially one big (poorly secured) backdoor?
- monitmitra 6y agoIt's essentially secured through obscurity. which I'm sure with this leak will lead to several CVEs over time...
- Traster 6y agoIntel employes 100,000 people, and most of them aren't even aware of most of Intel's transgressions, let alone approve of them.
- heavenlyblue 6y agoIt’s akin to defending Nazis because there were some Nazis who were forced to be Nazis because they couldn’t find a better job.
- akerro 6y ago>merely a debugging server that could be enabled and allowed you to inspect internal state during runtime When we talk about CPU it's bad enough. Think that your program has an input and output streams where most of the app data goes through and I can attach debugger and listen on the data. I would not be very happy about it and would still consider it backdoor.
- dathinab 6y agoBut do we now if that part ever ended up in any CPU sold by Intel instead of e.g. engineering samples ?
- awalton 6y agoAt my previous employer our code was littered with references to a backdoor. It was a channel for tools running in guest operating systems to talk to the host hypervisor through a magic I/O port. It's even openly called "backdoor" in open source code directly related to it: https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/lib/backdoor/backdoor.c https://github.com/vmware/open-vm-tools/blob/master/open-vm-...
- blasdel 6y agoMore reasonable VMMs use the word "hypercall" for these paravirtualized interfaces
- akira2501 6y agoA manufacturer wanted to upgrade one of their equipment lines to be more modern. The developers of the original product, both hardware and software, were no longer with the company. Since they just wanted to add some new features on top and present a better rack-based interface to the user, they decided to build a bigger box, put one of the old devices inside the box, then put a modern PC in there, and just link the two devices together with ethernet through an internal hub also connected to the backpanel port and call it a day. The problem is, if you do an update, you need both the "front end" and the "back end" to coordinate their reboot. The vendor decided to fix this by adding a simple URL to the "backend" named: /backdoor/<product>Reboot?UUID=<fixed uuid> Their sales team was not happy when I showed them an automated tool in a few lines of ruby that scans the network for backend devices and then just constantly reboots them. They still sell this product today. We did not buy one.
- ImaCake 6y agoThis can't be real... are you serious? It sounds like one of those silly buisness parabels!
- lotyrin 6y agoEven if this poster made it up, I'm certain it is also true at least once over, having remediated a near-identical problem from one of my employers' products at one point, and talked developers out of implementing it at least once at a different employer.
- lloeki 6y agoIt sounds like Dell’s iDRAC somehow. (Not that it is, but iDRAC had me scared more often than not)
- icefo 6y agoThe time iDrac annoyed me the most is when I bricked a server trying to update it. I made the terrible mistake of jumping too far between versions and the update broke iDrac and thus the server. There was no warning on Dell's website nor any when I applied the update. I only found out what happened after some googling where I found the upgrade path I should have taken. This is just terrible quality control and software engineering.
- OnACoffeeBreak 6y agoI worked at a place where IT had an admin user on every machine named "Backdoor". I opened a ticket when I noticed it, which was promptly closed explaining that it was normal. The same place had a boot script on every computer that wrote to a network-mounted file. Everyone had read permissions to it (and probably write, but I didn't test) and the file contained user names, machine names, and date-times of every login after boot for everyone on the domain going back 5 years. I opened a ticket for that, which was never addressed.
- dx034 6y agoYou could've probably reported this. Logging login times of everyone for all employees to see likely violates employees' privacy.
- skissane 6y agoOnce I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at startup. It would have made the manual edit check somewhat less reliable, but probably not by much in practice. But the security auditor was happy we’d stopped using MD5
- heavenlyblue 6y agoYou don’t actually need to listen to auditors. People like you (who can’t be bothered to argue because it’s apparently too hard) is the reason that smartass is still selling their services.
- restingrobot 6y agoSo much this. My company just got done shelling out a ton of money for some asshat to tell me that we can't use http on a dev server. <head smashes through desk>
- greedo 6y agoIt's worse when the asshat convinces your manager that every internal site, whether dev or not needs https. Certs everywhere. Our team spends a decent % of our time generating and managing certs...
- xenophonf 6y agoThat’s me. I’m that asshat. It’s called defense in depth. I recommend automating certificate issuance and renewal. It’s totally worth it.
- triangleman 6y ago
- marricks 6y agoI'm really not at all interested in people explaining to me how finding mentions of back doors in technology used in millions of computers is probably OK because it may mean something else. Given US security apparatus clearly values and desire these back doors and have the necessary power to coerce companies to making them, generalizing the use of "back door" as a term for debugging or w/e seems almost expected. Even if they are for debugging "oops it's on in production!" is a great cover because none of these companies will EVER admit back doors were required by the government.
- coronadisaster 6y agoThats nice of you but Intel's hardware has actual known backdoors.
- mzs 6y agoindeed it literally was the author's suggestion to search for the word 'backdoor': >This code, to us, appears to involve the handling of memory error detection and correction rather than a "backdoor" in the security sense. The IOH SR 17 probably refers to scratchpad register 17 in the I/O hub, part of Intel's chipsets, that is used by firmware code. https://news.ycombinator.com/item?id=24084977 https://news.ycombinator.com/item?id=24084977