Re: Wiretapping Linux?

From: Helge Hafting
Date: Thu May 18 2006 - 08:45:46 EST

linux-os (Dick Johnson) wrote:

On Thu, 18 May 2006, Helge Hafting wrote:

Chase Venters wrote:

Yeah, so to wrap this malware conversation up -- the most effective
way to implant malicious code in Linux is to crack into developer
machines and sneak the changes in.

And hope that someone doesn't notice.

The maintainer will. Over and over, we see maintainers tell developers
to fix their patch - often the problem is something as small as
"bad withespace" or "stupid name for a variable".

Now try to get a backdoor in, and see the maintainer get a fit over
the changes that are clearly unrelated to the problem mentioned
in the changelog.

And if you succeed with the spyware anyway, then someone will notice
the strange packets going out. That you cannot prevent, and it will then
be tracked down. Or you get a backdoor in? It will be found as soon as
it sees some use, or likely earlier with all the more or less automated
vulnerability chacking going on.

Helge Haftinjg

Remember this back door?

[attack snipped]

# exit
Connection closed by foreign host. LINUX> exit

Script done on Thu 18 May 2006 07:39:27 AM EDT

Early sendmail went years with the wizard back-door and the
code wasn't obscured in any way.

Not a linux kernel backdoor.
There sure are lots of software systems running on linux, some of them
may be easy to mess up like that. If you worry about that, go for
sw with a good security record. qmail for your mail, perhaps?

Also, a nice thing with these application backdoors is that not
everybody have them. There are many mail packages to choose
from, and there are many systems with none at all even. The same applies
to almost every other app. You probably find "bash" on just about every
linux though.

Helge Hafting
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at