News for hackers. Stuff that matters.

A comment on Microsoft finds privilege escalation vulnerability in Huawei driver. Parent comment

Re:Microsoft finds privilege escalation vulnerability in Hua... by noir_lord on Wednesday April 03, 2019 @07:14PM (#19568033)
On the other hand a reliable backdoor that also looks like sloppy code is better, as most of us are familiar with truly awful code it’s a nice layer of plausible deniability.

As the full saying goes.

Never attribute to malice what can be explained by stupidity...but don’t rule out malice.

[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Wednesday April 03, 2019 @07:20PM (#19568063)
By that logic we should be calling all vulnerabilities "backdoors" just in case.
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by peteradio on Wednesday April 03, 2019 @07:27PM (#19568094)
Perhaps you should because the end result is the same, shit code sinks ships. Somebody could have written it intentionally or somebody could have been a dumbshit. Doesn't matter to me because now my computer is compromised.
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Wednesday April 03, 2019 @08:11PM (#19568316)
I mean, the term 'backdoor' has a connotation of intentionality. Unless you write perfect code 100% of the time, you probably rely on the difference.
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by bsder on Wednesday April 03, 2019 @09:01PM (#19568519)
Freetype buffer overflow leads to privilege escalataion.

All code is security code.

[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Wednesday April 03, 2019 @09:10PM (#19568547)
Definitely don't disagree, but are the freetype developers being malicious when they leave in a bug?
[ Parent | on HN ]
Re:Microsoft finds privilege escalation vulnerability in Hua... by gsich on Thursday April 04, 2019 @01:48AM (#19569636)
>All code is security code.

Debian disagrees. They are wrong to do so.

[ Parent | on HN ]