I believe in the early 90's there was a serious problem discovered in intel
chips that allowed certain standard code to be run to overflow programs
arbitrarily and gain access to operating systems in an administrative capacity.
Also I remember the redhat (back in the day) repository being hacked and
backdoored versions of programs being put into it. I believe this also happened
to an early version of debian or fedora at some point also.
But I think you miss the point.
When they aren't preparing for security problems, the job of most security
professionals is to observe and react to these kinds of security problems.
The observer will exploit anything you are lax on. Discarding a security
concern because it doesn't seem important or of value to you is kinda stupid,
you should probably go find some other kind of work. Everything is important,
everything should be examined when and if possible. Thus the thread certainly
has merit.
It really makes me giddy when I see posts by trolls saying that security
through obscurity isn't really important, or that examining a possible act of
malice WITHIN one of the companies that is giving you software is not really an
important factor.
Even if it isn't an act of malice BY THEM, perhaps they have been hacked at the
very top levels of their software storage or their source code itself. Perhaps
something has gone wrong (what? no, couldn't be?).
Dismissing it is as stupid as dismissing the possibility that running some
unnamed, unknown executable on your windows box isn't a problem.
Scarey stuff. The job is to be paranoid. Not to be dismissive of those who ARE.
TheFinn.
