VERIFIED VOTING NEW MEXICO

SAMPLER: What Does a Security Hole Look Like?

Examples of actual source code bugs and hacks.

Hacks and bugs can be subtle and elude detection for decades. Certainly, the bugs in the Mars landers were overlooked till they caused a problem. But few lay people ever actually see what they look like. Here are two real and recent examples: the second one demonstrates how "data" inputs can be used to reprogram a machine. The first one shows how an operator can create an unusual condition that promotes him to supervisor'status.

Attacks on source code "trees" (the master copy used in development by the manufacturer) are the most deadly point of system wide infiltration. For example, a branch of the Linux kernel tree was recently attacked successfully: a single line was changed from (approximately)

   if ( WUSER_FLAG || setuid == 0 ) return 1

to

   if ( WUSER_FLAG || setuid = 0 ) return 1

The deletion of that single "=" character changed this innocuous statement from one that checked if the user had administration privileges to one that granted the user administration privileges under certain conditions. It proved subtle: trained eyes missed this change in an initial code review. This change would have found its way permanently into nearly all copies of Linux had the attacker covered up of the computer break in.

When the secret Windows source code was leaked, the following bug was discovered in the web page bit map image handler in win2k/private/inet/mshtml/src/site/download/imgbmp.cxx:

// Before we read the bits, seek to the correct location in the file
   while (_bmfh.bfOffBits > (unsigned)cbRead)
   {
      BYTE abDummy;[1024]
      int cbSkip;

      cbSkip = _bmfh.bfOffBits - cbRead;

      if (cbSkip > 1024)
      cbSkip = 1024;

      if (!Read(abDummy, cbSkip))
      goto Cleanup;

      cbRead += cbSkip;
   }