The backdooring of SquirrelMail [LWN.net]

The backdooring of SquirrelMail

Posted Dec 20, 2007 15:30 UTC (Thu) by NAR (subscriber, #1313)
In reply to: The backdooring of SquirrelMail by scarabaeus
Parent article: The backdooring of SquirrelMail

Exactly. How do we know that someone didn't crack the workstation of an apache or firefox
developer, didn't slip a backdoor into the code and currently isn't waiting for the highest
bidder to sell the access to these computers? Yes, I know, there is peer review, but it
obviously didn't work in the case of SquirrelMail...

(Log in to post comments)

How do we know?

Posted Dec 20, 2007 15:43 UTC (Thu) by corbet (editor, #1) [Link]

Peer review did work with SquirrelMail - somebody reviewed the checksum and raised the alarm. There was no possibility for review to happan any earlier - that code did not go through the ordinary process. The fact that almost all backdoor attempts have targeted the distribution point (the final tarball) rather than some point earlier in the process suggests that getting a backdoor in that way is hard.

In other cases where backdoors have actually made it into source repositories (interbase, for example, or the mICQ incident), peer reviewers have caught the problem. The interbase backdoor lasted for a year and a half, but I do not think it was being exploited. It was something the developers left in by mistake. I do not know of a case where a trojan was introduced into a free software project, then was exploited for any significant period of time before being found.

That, of course, does not say that no such compromise exists. But I would be more concerned about long-term backdoors if there had been some cases of compromises which lasted for an intermediate period of time.