Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is so absurdly simple and yet devastating. Reading some of the comments on the Github issue you posted, this stood out (I don't know anything about lucky7coin):

> So disappointing such code was not reviewed by Vern and team before running it on the server where damage could result.

So this code was actually put into production somewhere at some point -- wow. And cursory code review and compiling from source will do absolutely nothing here.



This is why you dump out source after the preprocessor has had its way with it.

gcc -E somethinghokey.c | less

The only thing you could hope to do would be to look for PRIVMSG in the binary after compiling or to look at the file post preprocessor.


That often expands into hundreds of thousands of lines though. It's more routine to go backdoor-hunting in binaries; you've given me the interesting idea of running `strings` on the binary and looking for anything that's not in the source.


Watch out for running `strings` on untrusted input!

See e.g. https://lcamtuf.blogspot.com.au/2014/10/psa-dont-run-strings...


This makes me sad. Literally the whole point of 'strings' is for poking around in unknown files, and they managed to break even that.


Instead, do it like a pro and run it from a live CD or a throwaway VM. Any work on untrusted code should be done in an trust-reduced environment.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: