full-disclosure - KDE was hacked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1983598895.20040508152233@SECURITY.NNOV.RU>
From: 3APA3A at SECURITY.NNOV.RU (3APA3A)
Subject: KDE was  hacked

Dear Seth Alan Woolley,

--Saturday, May 8, 2004, 2:14:49 AM, you wrote to full-disclosure@...ts.netsys.com:

SAW> Anybody using a CVS build of KDE is taking an inherent risk for such
SAW> things as this.  Anybody using an official release would of course have
SAW> a plethora of people reviewing each commit.  It only took them 1.5 hours
SAW> according to the Russian article to spot the code comments.  I'd say the
SAW> KDE team passed with flying colors.

It's  always  possible  to  insert "backdoor" into code in a way it will
probably  never  be  caught during audit, if code is rather large and is
not  perfectly  styled.  It may be a call to wrong function in a case of
some  race  conditions or another "unexpected" situation - things almost
impossible  to  catch  for  a  person  who  didn't  wrote this code from
beginning.  It's  true for both open source and commercial software, but
commercial  developers  at  least have signed contracts. Any exploitable
bug  found  in software could actually be a backdoor. It's a question of
trust.

-- 
~/ZARAZA
??????? - ?? ?????!  (???)