Now that's a software bug ... - Page 1
Forum section: electronics / general

author: mamalala
author_rank: Unknown
timestamp: May 28, 2014, 12:13:10 am
content: ... wrong code? Use this one: <code>http://seclists.org/fulldisclosure/2014/May/130What is the thought process of the people that come up with such implementations? Are they really better than trained monkeys?Greetings,ChrisEdit: oups.... Messed up the formatting, sorry....

author: SirNick
author_rank: Frequent Contributor
timestamp: May 28, 2014, 02:10:43 am
content: That's awesome. I really wonder what possessed a developer to craft an error message that provided the correct decryption key? That can't possibly be a good idea under any circumstances beyond debugging.A couple years back at a former gig, our IT department purchased a turn-key trouble ticketing system -- server with software already installed. I managed it for a while. One day, I found out the "backup" link worked even when Iwasn'tlogged in as Administrator. Just for fun, I tried the direct link (which is not unique to the installation BTW) from a Linux box with wget. Worked. All the device's config and data in a tarball, no questions asked. Needless to say, we were relieved to find thisbeforedeciding to forward the web interface through our DMZ.The funny thing is, we had been getting flak from upper management about how a sister company had been using the same product for a while, and how come our interface didn't do some certain thing, while the other guys' system did. (Nevermind that we were forbidden from writing any custom code, for fear of it being unmaintainable if any of us left the company -- and that custom code was required to do virtually anything beyond the out-of-the-box functionality. I guess that never came up during their demo.) I have to admit, it was a little bit vindicating to be the one to alert our management that 5GB worth of user data (which potentially included sensitive info) could be downloaded from their ticketing system, via the Internet, with no authentication.

author: HP-ILnerd
author_rank: Frequent Contributor
timestamp: May 28, 2014, 05:42:52 am
content: Ay, Caramba!

author: Bored@Work
author_rank: Super Contributor
timestamp: May 28, 2014, 06:11:58 am
content: Quote from: mamalala on May 28, 2014, 12:13:10 amEither there is simply no kind of "thought" happening at all, or it is done deliberately. Or, not the least of the possibilities, some manager requested that feature and really insisted to get it.

author: grumpydoc
author_rank: Super Contributor
timestamp: May 28, 2014, 07:06:59 am
content: Possibly code intended as a debugging aid accidentally left in the final system.

author: amyk
author_rank: Super Contributor
timestamp: May 28, 2014, 01:00:48 pm
content: It'sopen-source GPL'd software, anyone can easily inspect the source but I guess not many people bothered to (this doesn't seem like the kind of software that would be used by knowledgeable users), because if they did the bug would be staring them in the face; it's been there for over4 years!Not so many sites using them...and from what I see, at least 5 of them patched already, but also at least 5 still open.

author: Fred27
author_rank: Unknown
timestamp: May 28, 2014, 03:04:05 pm
content: I saw a FAR worse bug once in the job I had between school and university. (This was almost 30 years ago now). It was caught in testing but it was brilliant.I was working for a company that designed systems for ships to jam radar guided missiles. Ah - it's been long enough. It was Racal. The system was supposed to detect the radar pulse coming from the missile and send back a slightly louder pulse that matched it. Then this pulse was slowly shifted and the missile would lock on to a position that slowly moved away from you. It stuck in my mind that it was called Range Gate Pull Off.Anyway, someone must have got the sign wrong or something. The result of this monumental screw up was that any missiles detected anywhere in the area were deliberately drawn inwards towards you ensuring your fiery death.

author: Legion
author_rank: Frequent Contributor
timestamp: May 28, 2014, 05:02:59 pm
content: HandsomeWeb? "Making your website handsome"?They should be disqualified on name alone.

author: bingo600
author_rank: Super Contributor
timestamp: May 28, 2014, 08:42:38 pm
content: Quote from: Fred27 on May 28, 2014, 03:04:05 pmAre you sure Sheffield wasn't involved in the "test"/Bingo

author: warp_foo
author_rank: Unknown
timestamp: May 29, 2014, 03:35:01 am
content: I've always thought this was a rather memorable software bug:http://www2.vuw.ac.nz/staff/stephen_marshall/SE/Failures/SE_Ariane.html$500 million ... poof.

author: grumpydoc
author_rank: Super Contributor
timestamp: May 29, 2014, 06:24:52 am
content: Quote from: warp_fooOne somewhat amazing line from that article - "Despite the extent of the explosion, investigators were able to locate and extract information on the memory contents of the internal computer systems"Ferrite core?

author: SeanB
author_rank: Super Contributor
timestamp: May 29, 2014, 06:49:06 am
content: Identical flight ready spares with the same preset data on them most likely. Hot swap spares for use when the stack was assembled and ready, but if the onboard ones went faulty for any reason before launch. Easy then to see what the code was that went up. They would have been operated in a test rig up to the point where the stack was finished with the final checkout, then placed in storage until needed, or they would have been used on the next vehicle and a new backup would be placed in service.

author: aroby
author_rank: Regular Contributor
timestamp: May 30, 2014, 01:33:16 pm
content: Not really a bug, but on a project long ago we had a contractor on the team. He was super productive on the report programs he was writing (all batch COBOL). He left a few months before system test. During system test, we kept getting the same results out of the reports. Turns out he'd hard coded the report data into the programs ...Anthony

author: free_electron
author_rank: Super Contributor
timestamp: May 30, 2014, 01:51:12 pm
content: Wanna know a real bug ? Samba. On solaris. Running on a kick ass fileserver about 1999 timeframe.Take an old windows 95 pc. Connect to network. At the login screen press escape and create a new user called 'root' with password blabla.Comnect to fileshare on superexpensive sun fileserver.you are now root and can move/delete or do any mischief wanted....The bug was that the sun samba implementation did not perform a password check. It simply asked : who is authenticated there ?

author: free_electron
author_rank: Super Contributor
timestamp: May 30, 2014, 01:53:31 pm
content: Quote from: warp_foo on May 29, 2014, 03:35:01 amNow now, the self destruct system created by alcatel space worked perfectly fine ! We were always good at blowing up stuff.

author: grumpydoc
author_rank: Super Contributor
timestamp: May 30, 2014, 02:05:37 pm
content: QuoteNot unusual for the time.NFS had a similar glaring hole - and, I think, still does if you set up the right (or is that wrong) way - the "credentials" passed over the wire were just a userid-groupid pair, the client was assumed to have a "trusted" implementation and to have checked.Fine if you were running the Sun NFS client but there isn't much to stop you rolling your own, especially on a PCNetworks were much more benign places in the 1990's