Re: [cobalt-users] procmail and other GPL source...

[SteelHead <brk@xxxxxxxx>]

reply at the bottom.
----- Original Message -----
From: "Sean Slavin" <sslavin@xxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Wednesday, July 25, 2001 4:00 PM
Subject: RE: [cobalt-users] procmail and other GPL source...


> i hate to beat this any more but i'm still confused... i'm a software
> engineer and i know about building back doors. the only way i can use a
> back door is to know how to get to the machine. if the machine is
> blocked by a firewall then it's not visible to the outside world. yes
> the firewall will have a mapped IP and port 80 open but a smart admin
> will have inbound traffic on that port blocked. i spose if your users
> are given shell access, then cobalt could telnet in as well but then
> they would have had to bury a login somewhere and you could probably
> find that by looking long enough.
>
> well, i'll leave this alone now and go take a peek thru the archives and
> see if i can get un-confused...
>
> 8)
> sean
>
> -----Original Message-----
> From: Dan Kriwitsky [mailto:webhosting@xxxxxxxxx]
> Sent: Wednesday, July 25, 2001 1:34 PM
> To: cobalt-users@xxxxxxxxxxxxxxx
> Subject: RE: [cobalt-users] procmail and other GPL source...
>
>
> > It is common for the developers of software to create a "back door" to
> > access software in case of trouble or for convinent software service.
> It
> > may be scary, but can be a preferred method of accessing a Cobalt
> device
> > that has "locked" out eveyone else.  Imangine being locked out of the
> box
> > cause you reset the password, and you are 500 miles away from the
> server,
> > and the co-lo folks have an absolute "hands-off" policy
> > preventing the tech
> > (if you can get to her) from using the front panel reset.
> >
>
> IIRC they use the  MAC address somehow. I think it may have been
> discussed a
> long time ago in the archives.
> --
> Dan Kriwitsky
> 
>
> _______________________________________________
>
Ok, if there is a single port open, it is possible to create a hack to slip
in enogh info to trigger a "backdoor response" with jyst a fewe bytes.  I
dunno how, but I can assure you that all it takes is Knowledge, Skill and
Patience.  It is possble, even, to design a bit of firmware that listens for
a code sequence over the ethernet prt that is independent of the OS.  The
raq I currently own is mine by default.  I got it when the OS weged (it was
slammed hard as the host box for a Ford Dealership.) and we tried for 4
hours to get it to crack.  The guru at Cobalt even *said he had a sequence
to open a broken box that would not respond* while we were trying to get her
open.

I dunno if it was a backdoor, but after 10 hours of fighting, there were not
many options left to try.

I would not worry.

Bill