[Full-disclosure] OpenBSD has Open Backdoored Software Distribution - admitted by Theo
mrx at propergander.org.uk
Thu Dec 23 00:36:03 GMT 2010
-----BEGIN PGP SIGNED MESSAGE-----
On 23/12/2010 00:00, Dan Kaminsky wrote:
> On Wed, Dec 22, 2010 at 3:47 PM, Dave Nett <dave.nett at yahoo.com> wrote:
>> Long mail which just admit has backdoor, poor Theo.
> (g) I believe that NETSEC was probably contracted to write backdoors
> as alleged.
> (h) If those were written, I don't believe they made it into our
> tree. They might have been deployed as their own product.
> You had only one more sentence to read! Just one!
"> where would you start auditing the code? It's just too much.
Actually, it is a very small part of the tree..."
I am aware that compilers can be coded to introduce "features" into binaries that are not in the actual source code itself.
So with all due respect and possibly much ignorance on my part, what is a code audit going to achieve if one uses the shipped compiler to
compile the source? Unless one codes ones own compiler can any binary be trusted?
Would not reversing the compiled code lead to a proper insight? Are the compiled binaries that handle these crypto functions so complex that
they cannot be reversed by a skilled assembly coder? I guess that such a coder would have to be an expert cryptographer too, or at least
collaborate with one.
My curiosity is genuine, I am trying to educate myself about such things.
Mankind's systems are white sticks tapping walls.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----
Full-Disclosure is hosted and sponsored by Secunia.