built-in backdoors in proprietary software

[lsat 23]

Sometimes it was caused by abiding Law Interception Interface regulation, sometimes it's the company's own initiative.

 

Skype- patent No 20110153809

 

Cisco - RFC 3924

 

Microsoft - NSAKEY

 

hushmail.com - obtains copy of your passphrase ( mazeman23, thanks for info)

 

Let's continue with other findings :-)

[InactiveUser 188]

Microsoft turning bugs into backdoors before fixing them:
http://techrights.org/2013/06/15/nsa-and-microsoft/

Stealth Windows updates:
https://www.informationweek.com/microsoft-updates-windows-without-user-permission-apologizes/d/d-id/1059183?

Apple circumventing its own security measures (i.e. supposedly encrypted backups), using undocumented iOS functions:
http://arstechnica.com/security/2014/07/undocumented-ios-functions-allow-monitoring-of-personal-data-expert-says/

HP's root backdoor to storage devices:
http://news.dice.com/2013/07/11/hp-keeps-installing-secret-backdoors-in-enterprise-storage/

"undocumented test interfaces" remote backdoors in Cisco routers:
http://www.csoonline.com/article/2136221/network-security/cisco-confirms-undocumented-backdoor.html

Undocumented, hardcoded backdoor accounts in Barracuda network appliances:
http://www.networkcomputing.com/network-security/barracuda-security-equipment-contains-hardcoded-backdoors/d/d-id/1108344?

Google's GTalkService / Google Play (remote app installation):
https://jon.oberheide.org/blog/2010/06/25/remote-kill-and-install-on-google-android/
https://jon.oberheide.org/blog/2010/06/28/a-peek-inside-the-gtalkservice-connection/
https://www.duosecurity.com/blog/when-angry-birds-attack-android-edition

Samsung Galaxy backdoor, allowing remote file i/o (disputed):
https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor

Hardware vendors providing HDD firmware source code to NSA & friends:
http://www.reuters.com/article/2015/02/16/us-usa-cyberspying-idUSKBN0LK1QV20150216

The last one is not a built-in backdoor, but arguably even worse:
Enabling the agencies to craft undetectable firmware modifications.


Using proprietary software always means losing control over your hardware. The scary thing is: the most important kind of software - firmware - is almost always proprietary and / or inaccessible to the user. It's not going to get better anytime soon: Potential for CPU microcode backdoors

[lsat 23]

Let's continue :-)

 

Lenovo's Superfish adware

Comodo's PrivDog
 

You can check up, whether you're infected here:

https://filippo.io/Badfish/