full-disclosure - Re: Backdoor in OpenBSD Explained proof of Theo's lieying

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <D72E778995F7E8E987261DD4@utd71538.local>
Date: Thu, 16 Dec 2010 16:23:05 -0600
From: Paul Schmehl <pschmehl_lists@...rr.com>
To: musnt live <musntlive@...il.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: Backdoor in OpenBSD Explained proof of Theo's
 lieying

--On December 16, 2010 4:25:27 PM -0500 musnt live <musntlive@...il.com> 
wrote:

> Is we has packet we is do this:
>
> 1) Program is write to take copy of messages before encryption and is
> write to tmp file

Is no one is noticed this program or its temp file because everyone dumb 
except us govt.  Is program have cloaking feature that hide from everyone 
except Klingons.

> 2) Program is write to split tmp file and insert into fragments on
> wire at 2bytes

Is program is in memory but no one is noticed because everyone dumb except 
us govt.  Is ls can't find, is sockstat no good, is filestat dumb too. 
Everything hide from everyone.

> 3) Program is write to send to random source and is someone watch, who
> care. Is never tell 2 bytes is sifted for reassemble elsewhere. Is you
> send packets to gOOgle, no one stop think about this.
>

Is you did, but you is obviously smarter than the average bear.

>
> Packets =====-> Google
>         |
>         |
> 2bytes sniffed { reassemble bytes later }
>
> Is anyone see packets who can tell what is go through the wire? No
> one. Is ICMP used for covert backdoor or is this message can be sent
> when someone browse in HTTP header later, or, e.g.:
>

Is ICMP not blocked at edge of network, because everyone dumber than rocks 
and no one have IDS because is way to sofisticatable than the average bear.

> Network Stack Program -- is someone ping with special ICMP code --
> come to papa --  you send response to knocker with 2bytes in
> unreachable. Knocker reassemble full message. Sidechannel backdoor!
>

If Papa have sniffer on your network, you is have bigger problem than papa.

> Network stack program possible to blame as is Theo change ICMP in 2007
> and he also was spoofing time, do not is believe me, is see for
> yourself: http://seclists.org/bugtraq/2005/Jul/93
>

Now we get to the bottom line.  Theo is eeeeevvviiilll because, well Theo 
is Theo.

> From: Theo de Raadt <deraadt () cvs openbsd org>
> Date: Wed, 06 Jul 2005 20:17:36 -0600
>
> Is yet, he send in 2007. For why is he underhanded the world?
>

Is he want to dominate world, because he is eeeevvvviiiillll.  Just like 
Bill Gates.....

Is you need me send you to some meds?

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/