Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #6035

Re: finding backdoors and security holes

Show all headers | View raw

On 09/12/15 15:22, Osmium wrote:
> "Richard Heathfield" wrote:
>
>> On 03/12/15 01:59, G G wrote:
>>> How are these guys (generic) find these backdoors and security holes?
>>
>> Do they have the source? If so, imagine trying to find a shoe shop on
>> Oxford Street (not a particular shop - any shoe shop will do), looking
>> for a hill in Wales, tracking down a cow in Gloucestershire, or
>> identifying a crank in sci.crypt. These are tasks of comparable length
>> and difficulty.
>
> I will make a wild guess that they sell shoes on Oxford Street and Wales
> is hilly, therefore finding backdoors is a trivial exercise..

Finding security holes is a trivial exercise. Finding backdoors can be 
rather harder. Cf "Reflections on trusting trust" (kt).

> I would describe a program that does something other than what was
> expected by the user, as having a backdoor.

I would call that a bug.

> Using that base, one link on
> Google says there are 482,000 VW diesels in the US that have backdoors
> in their software.

Or perhaps Google was being Google, and actually there are 482,000 
hatchback VW diesels in the USA, and the word "software" also appears on 
the page. (Although on this occasion it is of course more likely that 
you are right. I think it's reasonable to call the VW hack a "back door".)

> Here's one link describing how that particular backdoor after several
> years, was finally found.  Sounds like a good base plot line for a movie
> on the Airdbus 380 or whatver they call that big thing.
>
> http://www.bbc.com/news/business-34519184

The only reason it took several years to find it was that it took 
several years for someone to look. All they had to do was measure the 
on-the-road emissions. (It is, however, quite true that back doors into, 
say, cryptographic algorithms can be rather more difficult to find.)

But security holes? You can't chuck a brick without hitting half a dozen.

-- 
Richard Heathfield
Email: rjh at cpax dot org dot uk
"Usenet is a strange place" - dmr 29 July 1999
Sig line 4 vacant - apply within

Back to comp.programming | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

finding backdoors and security holes G G <gdotone@gmail.com> - 2015-12-02 17:59 -0800
  Re: finding backdoors and security holes Robert Wessel <robertwessel2@yahoo.com> - 2015-12-03 01:58 -0600
  Re: finding backdoors and security holes Richard Heathfield <rjh@cpax.org.uk> - 2015-12-03 11:04 +0000
    Re: finding backdoors and security holes "Osmium" <r124c4u102@comcast.net> - 2015-12-09 09:22 -0600
      Re: finding backdoors and security holes Richard Heathfield <rjh@cpax.org.uk> - 2015-12-09 15:58 +0000
      Re: finding backdoors and security holes "J. Clarke" <j.clarke.873638@gmail.com> - 2015-12-13 22:59 -0500
  Re: finding backdoors and security holes Öö Tiib <ootiib@hot.ee> - 2015-12-03 05:42 -0800
    Re: finding backdoors and security holes "Osmium" <r124c4u102@comcast.net> - 2015-12-03 08:12 -0600
      Re: finding backdoors and security holes G G <gdotone@gmail.com> - 2015-12-03 06:55 -0800
        Re: finding backdoors and security holes "Osmium" <r124c4u102@comcast.net> - 2015-12-03 09:48 -0600
          Re: finding backdoors and security holes Öö Tiib <ootiib@hot.ee> - 2015-12-03 10:01 -0800
  Re: finding backdoors and security holes Victor Porton <porton@narod.ru> - 2015-12-03 20:49 +0200
    Re: finding backdoors and security holes G G <gdotone@gmail.com> - 2015-12-04 15:56 -0800

csiph-web