The video is pretty interesting, it looks like the nobody account was not meant as a backdoor, but the secret api is just doing authentication, without authoriz

The video is pretty interesting, it looks like the nobody account was not meant as a backdoor, but the secret api is just doing authentication, without authorization. Couple that with having the api using the Linux auth and you have a problem. ...I wonder if it's doing pam or just reading the shadow file direcly, doesn't really matter When I first read there was a backdoor account I thought it would be one that was on purpose. At an old job about 15 years ago we used network equipment that had a vendor backdoor built in. Only reason we knew it existed was one of our engineers had recorded a remote session with the vendor's support team. The account gave you full admin access and didn't even show up as another logged in user. It was disturbing to say the least.