5 ms·

Ehh. I think this article overstates just how clever this backdoor is. With the entire kernel source to play with, and the underlying assumption that the CVS ch

Ehh. I think this article overstates just how clever this backdoor is. With the entire kernel source to play with, and the underlying assumption that the CVS change would pass into BitKeeper without a thorough review, there had to be much more subtle ways to insert a local privilege escalation. Besides, it's not as if Linux local privilege escalations are incredibly rare, and it would be surprising if anyone with enough money, time and expertise couldn't uncover them at a rate sufficient to make this kind of skulduggery unnecessary.

kbart 13y ago
The hack itself is primitive (I guess most of the obfuscation contest entrants used this trick at least once), but hacking into the official CVS repository looks more suspicious. More so that nobody have noticed/reported this break in.
- kamjam 13y ago
  I think I done this "hack" several times when I started coding and scratched my head for a while before realising I was missing an equality sign!
  - kbart 13y ago
    Hah, that's what make this "hack" so popular - it's very easy to miss, even for seasoned programmers, when just glancing at a code.
    - derekp7 13y ago
      I remember this appearing on an exam in my C class back in '89 or so. It was basically "What does this code output...", and had "if (a = 3)" instead of "if (a == 3)". Thing is, I recognized the mistake, and though the instructor made a typo. So I answered based on what I thought the instruct had meant. Of course I got the question wrong. (I was fairly cocky back then, and normally I would have answered the question at face value just to "be that way", but I was trying to break that bad habit and it ended up back-firing on me anyway).
seliopou 13y ago
What's clever about that code is that the conditional will always fail. The assignment expression setting the uid to 0 will itself evaluate to 0, which will cause the conjunction to evaluate to "false." On first glance, the code makes you believe that the body of the conditional is necessary, when it's in fact dead code. That's nice camouflage.
- cynwoody 13y ago
  Also clever is the fact that the first clause acts as a password, so that the backdoor opens only if called with the supposedly invalid option combination.
- cjensen 13y ago
  I like the extra parens in the if condition. It's genius. On the face of it, it appears that the parens are to ensure correct operator precedence because a bitwise OR is used (a common idiom because bitwise operators have the wrong precedence versus comparison in C). But that's not what the parens are really for! They are there because gcc complains about assignments inside of conditionals unless you put parens around it.
luckydude 13y ago
Hi, guy who discovered the back door here. The flow was always BitKeeper => CVS, not CVS => BitKeeper. The only way this change would have made it into BK is if one of the users of CVS tree modified the same area of code and included that change in a patch sent to Linus or one of the other BK users. The chances of that happening and not being caught in review were, in my opinion, zero. Ziltch. Just not possible, any reasonable programmer would have seen this. To this day I believe this was a script kiddy who broke in and wanted to see if he could stick a trojan in there and get root on machines that installed this code. Seems dicey at best because while some people used the CVS stuff at the time, all the releases were done from BK at that time so that code would have never hit mainstream distros.
- lawnchair_larry 13y ago
  Although you might feel motivated to deride the attacker, I think it's safe to say that this person was skilled beyond "script kiddy".
  - luckydude 13y ago
    I'm old so maybe the meaning of "script kiddy" has evolved, but back in the day my understanding is that term applied to people who did this sort of thing. Maybe I misunderstand the term, hacking into machines is certainly not my area of expertise.
    - vog 13y ago
      To my understanding, the meaning of "script kiddie" hasn't changed much over time. It still means: Someone who breaks into computers by merely executing the scripts and hacking tools written by others, without any coding on their own, and without any deep knowledge about that attack. See also: https://en.wikipedia.org/wiki/Script_kiddie https://en.wikipedia.org/wiki/Script_kiddie
      - luckydude 13y ago
        OK, so I was wrong. Not sure what to call the person who did the backdoor then (nor why it is a big deal). But whatever, I used the wrong term, sorry.

kbart 13y ago

The hack itself is primitive (I guess most of the obfuscation contest entrants used this trick at least once), but hacking into the official CVS repository looks more suspicious. More so that nobody have noticed/reported this break in.

kamjam 13y ago
I think I done this "hack" several times when I started coding and scratched my head for a while before realising I was missing an equality sign!
- kbart 13y ago
  Hah, that's what make this "hack" so popular - it's very easy to miss, even for seasoned programmers, when just glancing at a code.
  - derekp7 13y ago
    I remember this appearing on an exam in my C class back in '89 or so. It was basically "What does this code output...", and had "if (a = 3)" instead of "if (a == 3)". Thing is, I recognized the mistake, and though the instructor made a typo. So I answered based on what I thought the instruct had meant. Of course I got the question wrong. (I was fairly cocky back then, and normally I would have answered the question at face value just to "be that way", but I was trying to break that bad habit and it ended up back-firing on me anyway).

seliopou 13y ago

What's clever about that code is that the conditional will always fail. The assignment expression setting the uid to 0 will itself evaluate to 0, which will cause the conjunction to evaluate to "false." On first glance, the code makes you believe that the body of the conditional is necessary, when it's in fact dead code. That's nice camouflage.

cynwoody 13y ago
Also clever is the fact that the first clause acts as a password, so that the backdoor opens only if called with the supposedly invalid option combination.
cjensen 13y ago
I like the extra parens in the if condition. It's genius. On the face of it, it appears that the parens are to ensure correct operator precedence because a bitwise OR is used (a common idiom because bitwise operators have the wrong precedence versus comparison in C). But that's not what the parens are really for! They are there because gcc complains about assignments inside of conditionals unless you put parens around it.

luckydude 13y ago

Hi, guy who discovered the back door here. The flow was always BitKeeper => CVS, not CVS => BitKeeper. The only way this change would have made it into BK is if one of the users of CVS tree modified the same area of code and included that change in a patch sent to Linus or one of the other BK users. The chances of that happening and not being caught in review were, in my opinion, zero. Ziltch. Just not possible, any reasonable programmer would have seen this. To this day I believe this was a script kiddy who broke in and wanted to see if he could stick a trojan in there and get root on machines that installed this code. Seems dicey at best because while some people used the CVS stuff at the time, all the releases were done from BK at that time so that code would have never hit mainstream distros.

lawnchair_larry 13y ago
Although you might feel motivated to deride the attacker, I think it's safe to say that this person was skilled beyond "script kiddy".
- luckydude 13y ago
  I'm old so maybe the meaning of "script kiddy" has evolved, but back in the day my understanding is that term applied to people who did this sort of thing. Maybe I misunderstand the term, hacking into machines is certainly not my area of expertise.
  - vog 13y ago
    To my understanding, the meaning of "script kiddie" hasn't changed much over time. It still means: Someone who breaks into computers by merely executing the scripts and hacking tools written by others, without any coding on their own, and without any deep knowledge about that attack. See also: https://en.wikipedia.org/wiki/Script_kiddie https://en.wikipedia.org/wiki/Script_kiddie
    - luckydude 13y ago
      OK, so I was wrong. Not sure what to call the person who did the backdoor then (nor why it is a big deal). But whatever, I used the wrong term, sorry.