Hacker News Reader

Comment by _jomo | Hacker News Reader

> The argument to the strcmp call is <<< %s(un='%s') = %u, which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the many other debug format strings in the code.

That's very clever from the attackers point of view, extra kudos to hdmoore for finding it!

View on HN

Well I definitely expect to find that password in the very next Person of Interest episode. :)

This has gotten me to wonder just how much software out there is backdoored in such a serious and absolute way... Scary.

Huh, is that show coming back around? I kinda liked how they would spin current tech events, and the idea of an AI that spread itself over power boxes was neat to say the least.

They have a final season 5 scheduled for some time in the next few months.

I'm very excited myself. It's the only show, other than Mr. Robot, that has plausible tech scenes and often drops real bits of hacky trivia, remaining very enjoyable for a techie despite the premise itself being far-fetched. And their political commentary on mass surveillance is beautiful.

And the way it transitions from criminal procedural to scifi ... beautiful.

You may also be interested in Continuum. I love that show for its spot-on perspective of present-day technology mixed with a believable vision of the future. Anecdotally, I remember reading that Continuum had a hacker writing their technical scenes -- news that didn't surprise me one bit :)

Thanks! Continuum has been on my to-watch list before, I'll push it back up.

I wish I had a relevant series to give you back, but good tech series are few and far between, so I'll just recommend Six Feet Under. ;)

And the first google.com hit for this query is... Wikipedia article on Sun Tzu, the Chinese philosopher who wrote The Art of War.

Does the Web know something we don't?

The letters in this password spell "sun su".

I suppose that's the reason. Still, I found the result completely unexpected and amusing. I googled this string just to see if it has ever appeared anywhere else but apparently Google these days tries very hard not to return zero results.

You could double quotes the query to search for exact match in google.

gasp

So what the attacker is saying is ...

When they say "presumably chosen" who (not the person, but what level of development was taking place) inserted this code? What was the purpose in inserting this password? The use of "chosen" means it was not an oversight?

Not really clever. Format strings have a fairly restricted format; that one can't have all that many bits of entropy. Once the obfuscation method occurred to an attacker, it wouldn't take long to brute force it even if they didn't have a file to search for suggestions. (And now that the idea is out there, I bet any number of hackers, wearing assorted coloured hats, are trying this out on other systems Even As We Speak.)

most attkers bruteforce common string passwords. Even if i had a binary to run strings thru this would pass by me. Not that im super smart or clever, but this is a interesting camouflage.

The goal is to weaken security and open a breach. Even a boolean would have been satisfying as a password.

Why would obfuscation method randomly occur to the attacker? It wouldn't. You'd only realise by looking at the code and at that point you have the password anyway.

> Not really clever. Format strings have a fairly restricted format; that one can't have all that many bits of entropy.

I fully agree that now is a great time to brute-force every ssh server found on the Internet with randomly generated valid format strings.

However, did you know it before this password was published? I think it was a novel idea.

Reply on news.ycombinator.com