6 ms·
I found that the company I work for is putting backdoor into mobile phones
- voxx 14y agoplease speak up. you should go to anybody and everybody you can and make your concerns known. it's possible that the people above you don't even know, but in the event they do, you should probably inform local news or someone. I'm not saying that you should try and lose your job, but you should make your disagreement known.
- nicholasreed 14y agohttp://news.ycombinator.com/item?id=3989800 http://news.ycombinator.com/item?id=3989800
- DigitalSea 14y agoHaha, I was about to point out that I submitted this a day ago as opposed to this guy submitting it 6 hours ago...
- f45s8g2 14y agoCan't think of a catchy name for it, but maybe the StackExch team needs to start a "Programmer Confessions" forum.
- rmATinnovafy 14y agoA Codefessional? I have one of those...
- suborbital 14y agoyeah it's called #defocus
- fleitz 14y agothedailywtf.com nicely covers that genre.
- SkyMarshal 14y ago> Can't think of a catchy name for it http://www.whistleblowers.org/ http://www.whistleblowers.org/
- jaredsohn 14y agoAlthough not tech specific, at the most recent AngelHack hackathon, someone created a service where you can call in your confessions and people can listen to them. http://confessioncall.com/ http://confessioncall.com/
- chernevik 14y agoConscienceOverflow. Or ThisIsAFault.
- deleted 14y ago[deleted]
- NonEUCitizen 14y agocontact EFF ? quit your job ?
- moron 14y agoI would disclose to a security firm that I felt was trustworthy and let things go from there.
- gouranga 14y agoI'd suggest pastebin rather than a security firm. Security firms will shop you in 2 mins if they feel it's profitable.
- f45s8g2 14y agoCan we assume this company is not Huawei/ZTE?
- drcube 14y agoHe said it was remote desktop software.
- dustywusty 14y agoNo, he said it was "remote assistant" software in "mobile phones."
- edandersen 14y agoDelete the backdoor code, with a commit message saying you have removed a security vulnerability. Watch them try to defend leaving the backdoor in the system (favorite excuse I've heard is 'we need it for troubleshooting!') - they can rollback the commit if they really want the backdoor in. Send out resume.
- eli 14y agoThat seems kinda passive aggressive. Either complain through the proper channels... Or don't. But being sneaky doesn't help your cause.
- wpietri 14y agoThat's not being sneaky at all; it's in the commit logs and he can announce it. It's just shifting the burden of action back to the people who want the vulnerability. In theory, the same. Practically, very different.
- eli 14y agoIt's obviously not just a regular commit and everyone involved would know that. The commit log is not a proper place for a thinly veiled ethics complaint. If you think something is wrong, have the courage to say so directly, don't hide behind a commit message.
- Mz 14y agoSince they claim they won't use it and he says it was probably a mistake, this sounds to me like exactly the correct response: Let them save face and "agree" with the change if they are so inclined. A high handed accusation of an ethics issue does not look supportable at this time. And it is likely the worst thing he could do.
- wpietri 14y agoAs both employee and employer, it's my view that all employees should what they see as the right thing by default. Personally, I think the poster should make the change and then announce it. I'm not saying he should be cowardly. If anything, I think the cowardly choice is to futz around trying to get consensus an elusive around doing the responsible thing.
- goblin89 14y ago> I have found out recently that the remote assistant software that we put in smartphone we sell can be activated by us without user approval. Maybe I'm missing something, but it says nothing about what might possibly happen in case their remote assistant is remotely activated. Also it's unclear how large is their user base. Everyone kind of assumes serious implications, though. IMO if this whole thing is true, it indicates that the company probably doesn't have good QA and development process in place. Otherwise either such a bug would not exist (most likely it was left for debugging purposes), or it would really be a product of an evil intent (and hidden from uninitiated developers).
- drhowarddrfine 14y agoSo the only thing he can think to do is run to the internet and tell anyone?
- JoachimSchipper 14y agoDevil's advocate: assuming the company already quietly install updates, and the backdoor is not secured worse than the auto-update mechanism, this does not really give them additional capabilities. (Also, the phone likely already has more serious vulnerabilities.) Of course, this exchange does suggest bad things about the company's ethics and competence.
- lolcraft 14y agoThe backdoor being called "backdoor" by this engineer already implies that it is not nearly as secure as the auto-update mechanism: the content is not signed by the company, it can't be disabled by the user, et c. I see no reason not to trust OP's judgement.
- gouranga 14y agoDoesn't surprise me. In that circumstance, I'd quit via a letter to the shareholders. That's what I did when I worked for a large nefarious killing machine provider when I had a tony stark moment, grew some balls and worked out what they were doing was utterly wrong. I informed them that I was bound by British law as well which supercedes any corporate rules and contracts.
- ben1040 14y agoI wonder if it's this Verizon Remote Diagnostics tool that started getting loaded onto a few phone models a couple months ago. http://www.engadget.com/2012/03/20/verizon-updates-revolution-with-remote-diagnostics-htc-turns-to/ http://www.engadget.com/2012/03/20/verizon-updates-revolutio...
- facorreia 14y agoSeriously, is there any significant piece of hardware on stores nowadays that doesn't have multiple backdoors from application level down to the very microchips? Like [1]. [1] http://articles.businessinsider.com/2011-06-27/news/30048253_1_microchips-missiles-foreign-chip-makers http://articles.businessinsider.com/2011-06-27/news/30048253...
- trafficlight 14y agoWhat's your point? That it's status quo so don't worry about it?
- facorreia 14y agoMy point is that this is outraging. There are so many instances of this, it seems each week we hear from another backdoor like this[1]. [1] http://it.slashdot.org/story/12/04/26/1411229/backdoor-found-in-arcadyan-based-wi-fi-routers http://it.slashdot.org/story/12/04/26/1411229/backdoor-found...
- exim 14y agoAsk for partnership for not publicizing it :)
- naner 14y agoWe are not using this option, and it is probably there by mistake. Aww, sweet innocence.