7 ms·
The Linux Backdoor Attempt of 2003
- antocv 13y agoWe still dont have a report on the kernel.org hack of 2011. Many people say, calm down, its git they cant have inserted backdoors etc without messing up the git history/changelog/hashes/whatever. But what if, git was modified and backdoored previously to hide some objects/changes? How would such an attack work? Lets say you discover a problem in git, which allows you to omit changesets in its output. How would that work to backdoor the kernel?
- phaemon 13y agoOlder versions of git would tell you the hashes were wrong. Implementations of git in other languages would tell you the hashes were wrong. Manually checking would tell you the hashes were wrong. It's just not feasible. EDIT: Plus, git is stored in git, so you'd need to backdoor git first... ;)
- jerf 13y agoAlso, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up ("well, maybe all my compilers (not just gcc, all of them) are also backdoored to backdoor themselves, and each other if you cross-compile, then backdoor git too...").
- yuvadam 13y agoBootstrap operation from hell [1] [1] - https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23ca2e25604af290 https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23...
- ryanthejuggler 13y agoThanks for the link... I've never read the README before, and it's very entertaining. Now I'm going to have "goddamn idiotic truckload of sh*t" echoing through my head all day
- jzzskijj 13y agoI read, when the project was introduced, but forgotten it a long time ago. Goddamn Idiotic Truckload of Sh*t Hub, Inc. would make a memorable name for an incorporation.
- TheCraiggers 13y agoThe kernel hasn't always been tracked in git though. How would we know something wasn't added before the source was imported into git?
- Aloha 13y agoBecause before it was tracked by git, it was in bitkeeper, and it was likely in some other system before that.
- TheCraiggers 13y agoI understand that. But what I don't know are the capabilities of those other, older systems that once tracked the kernel source. Do we have the same assurances there?
- antocv 13y agoGreat question. BitKeeper wasnt as good as git when it comes to changesets and introducing bugs, still it was founded on more social side of changes needing approvals. Before that it was CVS and for that its almost easy to introduce backdoors.
- kbart 13y agoSuch changes would be visible when comparing locally stored tree of older sources with new, supposedly backdored official sources stored on github. Someone should surely notice undocumented changes while doing backports, kernel upgrades etc. Heck, even integrity check by 3rd party tools could help here.
- jabiko 13y agoBesides the whole source code compromise discussion I would really want to know whether there is any incident report planned. Until the redesign kernel.org stated: "We will be writing up a report on the incident in the future.". But since the compromise was more than 2 years ago it seems unlikely.
- twoodfin 13y agoEhh. I think this article overstates just how clever this backdoor is. With the entire kernel source to play with, and the underlying assumption that the CVS change would pass into BitKeeper without a thorough review, there had to be much more subtle ways to insert a local privilege escalation. Besides, it's not as if Linux local privilege escalations are incredibly rare, and it would be surprising if anyone with enough money, time and expertise couldn't uncover them at a rate sufficient to make this kind of skulduggery unnecessary.
- kbart 13y agoThe hack itself is primitive (I guess most of the obfuscation contest entrants used this trick at least once), but hacking into the official CVS repository looks more suspicious. More so that nobody have noticed/reported this break in.
- kamjam 13y agoI think I done this "hack" several times when I started coding and scratched my head for a while before realising I was missing an equality sign!
- kbart 13y agoHah, that's what make this "hack" so popular - it's very easy to miss, even for seasoned programmers, when just glancing at a code.
- derekp7 13y agoI remember this appearing on an exam in my C class back in '89 or so. It was basically "What does this code output...", and had "if (a = 3)" instead of "if (a == 3)". Thing is, I recognized the mistake, and though the instructor made a typo. So I answered based on what I thought the instruct had meant. Of course I got the question wrong. (I was fairly cocky back then, and normally I would have answered the question at face value just to "be that way", but I was trying to break that bad habit and it ended up back-firing on me anyway).
- mp99e99 13y agothis is pretty interesting, thanks for posting.
- robmcm1982 13y agoAre those options for wait2 in common use, causing auto-elevation for many programs? It seems too easily accessed to be an NSA backdoor.
- superuser2 13y agoWe seem to have forgotten that the NSA is not the only or even necessarily the most interesting entity looking to privilege-escalate and/or steal data. Corporations and individuals are malicious also.
- borplk 13y agoQuite disturbing to think about it. There are probably millions of lines of code in the kernel, how confidently can you say that there's no other instance of something like this slipping in? I mean it's just one damn '=' character.
- bentcorner 13y agoThe more I think about it, the more programming (and computers in general) frustrate me. In the non-digital world, the general rule is small mistakes lead to small consequences (for example, overcooking food will result in it burning and getting worse over time).
- lcedp 13y agoBut not watching your cooking process can also result to blowing up whole building due to gas explosion. More often it would be just bad meal, of course. But more often small mistake in a program will just result to a compile error or bad behavior.
- Patrick_Devine 13y agoIsn't this also what makes computers so wonderful? Small amounts of code let you do amazing things.
- keithpeter 13y agoA piece of telco software had been written in C language, a standard language of the telco field. Within the C software was a long "do... while" construct. The "do... while" construct contained a "switch" statement. The "switch" statement contained an "if" clause. The "if" clause contained a "break." The "break" was supposed to "break" the "if clause." Instead, the "break" broke the "switch" statement. Ctrl-F the above phrase in http://www.mit.edu/hacker/part1.html http://www.mit.edu/hacker/part1.html Security concerns always seem to involve low level code in device drivers or firmware. Indeed, one character in the wrong place and we have problems
- groby_b 13y ago
- lcedp 13y agoDoesn't compiler complain about assignment in condition?
- duskwuff 13y agoOnly when unparenthesized (e.g, if (x = 0) { ... }, but not if ((x = 0)) { ... }). And the author of this mysterious bit of code has helpfully thrown some parentheses around the assignment...
- 8_hours_ago 13y agoI don't see any warnings when compiling "if (1 && (i = 2)) {...}", but there is an warning when compiling "if (i = 2) {...}". This is using gcc 4.7.2 with -Wall.
- acdha 13y agoBoth gcc and clang appear to lack any way to generate a warning in the first case. Something like splint (http://www.splint.org http://www.splint.org) does, which is a good argument for including that into a C developer's workflow.
- deleted 13y ago[deleted]
- twoodfin 13y agoclang and gcc don't warn on this because real large codebases have an (unfortunate?) number of assignments inside boolean expressions. Most of them are intentional and at least some significant fraction are correct. Taking advantage of assignment-as-an-expression is idiomatic in a fair amount of code I've seen, at least. Stuff like: /* check_something returns non-zero on error */ if (need_to_check && (status = check_something())) { handle_error(status); } The clang and gcc folk tend to avoid adding default (or even -Weverything) warnings that will trigger on entirely valid, at least marginally common code, even if the style choice is problematic.
- asveikau 13y agoThe author is talking down and assumes too many people just learned C yesterday. An assignment of a variable called uid to 0 inside of an error check is waaaay too transparent. It's impressive that it made it into the cvs server with no history but the actual weakness relies heavily on nobody ever looking at the code. It would be spotted right away by anyone remotely competent who glanced over it.
- keithpeter 13y agoSurprised at downvotes. Putting foo = 0 in a test for an if statement is something that even I can spot, and I am not a professional programmer and have had no formal training in programming other than an Algo 60 course at University way back in the last century. The author of the code if malicious must have realised that it would not pass any kind of code review. PS: I tend to discount 'tone' when reading blog pages as getting the 'tone' right is the kind of thing professional authors do.
- georgemcbay 13y agoAs a professional programmer, I spotted the error on my first read through, but it wasn't a fair test because the code wouldn't have been there if there wasn't a problem. Had I just been scanning the code quickly without being in a state where I was alerted to look for an issue I have no idea if I would have seen it. In any case, this is something a competent lint tool or static code analyzer would warn about, which makes a good case for people using such tools as part of their normal process.
- jefftk 13y agoIt would be spotted right away by anyone remotely competent who glanced over it. I'm not so sure. I'm a professional programmer mostly working in C++, and I didn't see the problem on first read-through. It took looking carefully before I saw it, and if I hadn't already known that these two lines contained a vulnerability I might not have noticed. I could see this being missed in a code review.
- 13y ago
- Pxtl 13y agoI wonder how many millions of dollars of damage has been done by the bone-headed equality/assignment syntax in C?
- nilved 13y agoThe problem is overstated, but using := (or ->, or whatever) for assignment and = for comparison hasn't ever seemed like a bad idea.
- lawnchair_larry 13y agoThere was no shortage of non-proft, non-nation-state actors engaging in backdooring open source and commercial codebases during this time. No reason to believe this was related to the NSA.
- luckydude 13y agoI agree, I've worked with the NSA (early 1990's when they still had some ethics) and this hack doesn't feel like what they would do. I'm not an NSA expert though, I declined to get clearance, so salt my opinion a bit.
- Stratoscope 13y agoif ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; > ...A casual reading by an expert would interpret this as innocuous error-checking code... Wait... Wait... A casual reading by any expert should result in the question "why is this code setting current->uid to 0?" After all, in case said expert has forgotten the difference between = and ==, this little bit of code all by itself has two correct reminders about what those operators actually do.
- derleth 13y agoEven better: Emacs has cwarn-mode, which by default highlights = (assignment-equal) in tests in BRIGHT RED. I'm sure Vim has something similar; maybe the customized version of uEmacs/PK 4.0.15 Linus uses does not. http://www.emacswiki.org/emacs/CWarnMode http://www.emacswiki.org/emacs/CWarnMode http://en.wikipedia.org/wiki/MicroEMACS http://en.wikipedia.org/wiki/MicroEMACS http://web.archive.org/web/20061124122032/http://www.stifflog.com/2006/10/16/stiff-asks-great-programmers-answer/ http://web.archive.org/web/20061124122032/http://www.stifflo...
- annnnd 13y agoMost IDEs do that today - but I wonder how many did that in 2003?
- andyhmltn 13y agoAlthough I noticed it judging by the amount of times I've fell for those 'check the error in this sentence' games I would assume that if you're reading a lot of code and you see the 'if' you would subconsciously interpret it as two equals signs.