3

The wikipedia article on Limewire says that "LimeWire 5.5.11 and newer have been disabled using a backdoor installed by the company".

How are such backdoors implemented? Is it as simple as the the program going out and checking a web service and disabling itself? If it's in fact so simple, it has to be stored somewhere on the user's drive (in a plist, or in the registry for example). It's hard to imagine no one has in fact figured out a way to turn that flag off and use the program.

2

In the case of Borland's Interbase (now called Firebird), there was a hidden super-user that the system required in order to work. This hidden super-user could not be disabled, and it had a known password that could not be changed (until a patch became available to do so). This would allow anyone who knew the hardcoded username/password combination to access any installation. Disabling this account breaks the system because it can no longer authenticate users.

CERT advisory on Interbase.

Is it as simple as the the program going out and checking a web service and disabling itself?

This is generally how many forms of license management work. Some simply check to see if "my serial number" is in use, and if so, they exit. Some use a form of PKI and revoke local certificates if the license is invalid. For example, Adobe Reader pings crl.adobe.com when it starts to see if any licenses have been revoked, as the key to enable plugins to work in the free reader require a digital key. If a plug-in does things that violate the licence, the cert enabling it will be revoked. License management is a very complicated process because you've got to stay one step ahead of the crackers, and even minor bugs in your licensing code will cause major customer problems.

0

The typical concept of a back door in software is one which allows the creator undisclosed and unwanted access to installations of his software. The simplest method would be to hard-code additional credentials to the system.

There is an important distinction between this meaning and a piece of software that routinely checks for updates, even though they function entirely the same. The user knows and wants it to happen. It's only a cultural shift that turns the outrageous transgression of altering my machine into a typical and daily occurrence that happens with today's software. But at least they're usually nice enough to ask first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.