• Mark Draughn (unregistered) in reply to smxlong
    smxlong:
    Martin:
    Kerbleckistanians are not stupid. I'm using similar technique, when clients refuse to pay. It's really usefull! c99.php is also good thing.

    If you're actually serious, then you are a criminal. Going back on a contract is a civil matter. By deleting files (even if they are copyrighted by you) from the client's servers, you are committing a felony computer crime. Just because they broke contractual obligations doesn't give you the right to commit a crime.

    Right, you're vandalizing his web site. However...you could probably cover this issue with language in the contract. Something like "If payments are delinquent more than 90 days, Developer may use technological means to disable and/or delete all software furnished under this Agreement, and Customer hereby grants the Developer access to Customer controlled computers or computer accounts in order to do so, and Customer hereby releases Developer from all liability for doing so and agrees to indemnify, defend and hold harmless..."

    Well, you get the idea. You'd probably have to agree to disable the backdoor once the contract is complete and paid in full. A lawyer could probably craft language that works.

  • What's with the ambiguity? (unregistered) in reply to hoodaticus
    hoodaticus:
    Alin:
    The guy got MORE than he bargained for... for a tenth of the price. Outsourcing rulez... NOT :))

    Indeed, by participating in the strategic weakining of the nation that secures freedom via balance of power to most of the planet, outsourcing is arguably more evil than even Google.

    "the nation that secures freedom" - NOT! "strategic weakining (of the nation) that secures freedom" - maybe

  • Procedural (unregistered) in reply to hoodaticus
    hoodaticus:
    Alin:
    The guy got MORE than he bargained for... for a tenth of the price. Outsourcing rulez... NOT :))

    Indeed, by participating in the strategic weakining of the nation that secures freedom via balance of power to most of the planet, outsourcing is arguably more evil than even Google.

    I don't want to disturb you while you are busy looking at your belly button there, but: a) We dont need your help. Really, we are doing fine without the incommensurable value that you bring with your killing of civilians and taking possessions of assets you couldnt otherwise buy on a free market. Go home. b) "Balance of power". That's you sitting on the heavy site, isn't it ? c) Weak-E-ning. Nu-C-L-E-A-R. Learn to write. It is freedom. No, not that kind; hold on, wait... don't shoot your students and steal their lunch money. Look up "freedom" in a dictionary. See how it doesn't involve coercion ? That's nice. Now try it.

  • Jim (unregistered)

    TRWTF is not running php in safe mode and allow drop on db for untrusted code

  • (cs) in reply to Vindico
    Vindico:
    grep -R unlink * | grep ".php"

    would work much better. Sorry to be anal, but if you are going to critique code, be ready to be equally critiqued.

    find -name '*.php' -exec grep -H unlink {} \;

    is better still. Now you aren't searching all your non-PHP files (think large images or PDFs) for that elusive unlink!

  • (cs) in reply to Zemm
    Zemm:
    find -name '*.php' -exec grep -H unlink {} \;
    That's quite a slow way of doing it since it runs one grep for every file. You'd be better off with this: 
    find -name '*.php' -print0 | xargs -0 grep -H unlink
    Though if I were you, I'd want to look out for other ways of deleting the code; there's just too many ways to do it (though in the article it looks like the client and the coder are perfectly made for each other in terms of stupidity).
  • (cs) in reply to D
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.
  • (cs) in reply to tOmcOlins
    tOmcOlins:
    csm:
    if derick is capable of firing up a shell and fixing it himself, what's the point of "ondra"? and who names their kid Ondra?

    Alex makes up fake names for these stories and sometimes he gets them mixed up.

    3rd attempt

    Actually, Ondra and Derrick are the same person. Alex just made up that second person so the original author doesn't look like a total asshat.

  • jre (unregistered) in reply to smxlong
    Imagine if you hired a contractor to re-roof your house, and then refused to pay. He can't just come back to your property and start ripping the roofing down. What he does is he sues you.

    Not Always,

    http://news.bbc.co.uk/1/hi/8267763.stm

    Although apparently the police frown on this sort of thing.

  • (cs)

    So many things wrong with that backdoor. So easy to spot, no ability to execute arbitrary commands, not obfuscated or hidden at all, and he practically told them about it. Tsk tsk!

    So many things wrong with having to submit my post twice, too.

  • illtiz (unregistered) in reply to lImbus
    lImbus:
    another real WTF is this useless use of cat. what's wrong with the following ? 
    grep unlink *.php
    or
    grep unlink -R *.php
    The fact I could instantly see the filename in question ?

    I demand that comment be given the blue tint.

  • Zaphod (unregistered) in reply to DaveK
    DaveK:
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.

    I get it regularly.

    And I get unobtanium too.

    Mostly off ebay.

    Along with electric penguin cleaners, left-handed pencils and uncut dilithium crystals.

  • Quirkafleeg (unregistered) in reply to Neil

    Let's just say that I know of some PHP stored in two (yes, count them, two) CVS repositories… and, yes, I have write access to both.

    (One's long-since obsoleted, and the other's been untouched for years…)

  • (cs) in reply to DaveK
    DaveK:
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.
    Win
  • That Guy (unregistered) in reply to Bim Job

    See, if I didn't see major league WTFs all the time that come out of the combination of idiot bosses and Kerblekistani outsourcing, I would call FUD too.

    But it happens again and again.

    The combination of idiot bosses + local developers usually reveals the bosses idiocy early. If it is easy to push bosses on requirements, the idiocy will be revealed right away.

    "Wait, if the user can't search for what they want, how is this product going to be even remotely useful?"

    Idiot bosses + outsourced developers can let the idiocy fester for months. The spec gets sent out, no questions get asked because each question takes 12 hours to answers, and GIGO.

    Indeed, idiot bosses tend to flee to Kerblekistani devs because they get tired of having local, competent, smart, expensive devs ask them hard questions that illustrate their idiocy. Kerblekistan just implements their idiocy.

  • Quirkafleeg (unregistered) in reply to Jan
    Jan:
    Jim:
    worthy of an un-necessary use of cat award!
    Go away, you troll! There is absolutely nothing wrong with using 'cat' in this way.
    Other than grep not being able to list the filenames? I would think that most people¹ would spot that one…

    ¹ Who know enough about grep.

  • Harrow (unregistered) in reply to budu
    budu:
    > At least Kerbleckistan is number one exporter of potassium.

    No, it's Canada!

    ?? Kerbleckistan exports Canada?

    -Harrow.

  • Twirrim (unregistered) in reply to DaveK
    DaveK:
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.

    In case you're serious, it's the precious mineral the invading humans want on the moon the alien race lives in, in the film Avatar.

    Yes the writers really were that imaginative.

  • Procedural (unregistered) in reply to Twirrim
    Twirrim:
    DaveK:
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.

    In case you're serious, it's the precious mineral the invading humans want on the moon the alien race lives in, in the film Avatar.

    Yes the writers really were that imaginative.

    Although the word itself was used in a high-end road bike ad from the early 2000s from, I believe, Specialized, who were jokingly one-upping the competition with a material so light, so stiff, and so rare, that nobody could get it. Ever. It was pretty funny.

  • (cs) in reply to Twirrim
    Twirrim:
    DaveK:
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.

    In case you're serious, it's the precious mineral the invading humans want on the moon the alien race lives in, in the film Avatar.

    Yes the writers really were that imaginative.

    Not quite. It's a common term in both science fiction and real-world engineering. It's been in common usage for close to 60 years. Its usage in "Avatar" was almost certainly a deliberate homage to this, not a case of the writers being "unimaginative" as you seem to imply.

  • Franz Kafka (unregistered) in reply to Twirrim
    Twirrim:
    DaveK:
    D:
    Not to forget unobtainium. I wonder where the name comes from.
    What's "unobtainium"? I don't get it.

    In case you're serious, it's the precious mineral the invading humans want on the moon the alien race lives in, in the film Avatar.

    Yes the writers really were that imaginative.

    If the writers were that daft, it sort of makes me not want to see the movie.

    Quirkafleeg:
    Jan:
    Jim:
    worthy of an un-necessary use of cat award!
    Go away, you troll! There is absolutely nothing wrong with using 'cat' in this way.
    Other than grep not being able to list the filenames? I would think that most people¹ would spot that one…

    ¹ Who know enough about grep.

    grep -c gives you filenames, or did you oversnip?

  • Fat Git (unregistered) in reply to Ben

    Sounds like NI LabView to me. Horrible write-only stuff.

  • anonymous (unregistered) in reply to smxlong
    smxlong:
    I don't know what you mean by "lawyer crap." Sue somebody for deleting files? If somebody deleted files from my server, I'd report them to the FBI. No lawyer involved.
    By "lawyer crap" he meant "I will be dismissive about this because I don't understand it".
  • Ben (unregistered) in reply to Chris
    Chris:
    [TICK] PHP. [TICK] Developer. [TICK] Version control. [TICK] Backups

    No comments, unit tests, documentation, code review, &c, &c. QED, PHP drones are all oxygen thieves.

  • Rodger C. (unregistered) in reply to D

    The name comes from "unobtainable" (you can't have it) and "ium" (ending of the last few elements on the periodic table). The mineral comes from Pandora, a moon of Polyphemus, which orbits Alpha Centauri A. It is a room temperature super-conductor for energy, which makes it very valuable: it's worth $20 Million per kilogram on Earth. However, It is vastly expensive to mine on Pandora since humans are unable to breathe in the Pandoran atmosphere. Because of this, all personnel are required to wear a mask and it is very cumbersome.Unobtainium has a unique magnetic field and properties of superconductivity, causing it to levitate. On Pandora, the magnetic effect causes huge outcroppings of Unobtainium to rip loose from the surface and float in the magnetic vortexes. These huge islands, named Hallelujah Mountains by Earth's explorers, are called Thundering Rocks by the Pandorans, who hold them sacred. The unique magnetic properties of Unobtainium are used to contain and direct the energy of the matter-antimatter annihilation which propels ships like ISV Venture Star. Without Unobtanium, interstellar commerce on this scale would not be possible. Unobtanium is not only the key to Earth’s energy needs in the 22nd century, but it is the enabler of interstellar travel and the establishment of a truly spacefaring civilization. Making a feed back loop, the more Unobtainium is mined, the more ships can be built, and more mining equipment can be sent to Pandora.

  • Sylver (unregistered) in reply to Protected
    Protected:
    I think the real wtf was the fact that the crappy developer actually led him onto find the backdoor. I would have just kept my mouth shut.

    What he wanted was to get paid/extort money. If he hadn't said anything, he might have gotten his revenge, but he would definitely not have gotten paid.

    He is an idiot. He could have deleted the files and told the customer that he had a copy of it, available upon receipt of the payment.

    In this case, the dev was in a situation where he was violating the agreement, and he had been paid for several months already, so using it would have been wrong.

    On the other end, every once in a while, you have an a*hole who orders work, receives it and does not pay. And if the customer does not pay, the work actually belongs to the dev who has done it and he is justified to delete it, if reasonable efforts to recover the money fails.

  • Maurits (unregistered) in reply to smxlong
    smxlong:
    Imagine if you hired a contractor to re-roof your house, and then refused to pay. He can't just come back to your property and start ripping the roofing down. What he does is he sues you.

    And puts a lien on your property.

  • Marian Kechlibar (unregistered) in reply to csm

    In the Czech language, Ondra is a familiar diminutive of Ondřej. And Ondřej is Czech for Andrew, and quite a widespread name.

  • Quirkafleeg (unregistered) in reply to Franz Kafka
    Franz Kafka:
    Quirkafleeg:
    Jan:
    Jim:
    worthy of an un-necessary use of cat award!
    Go away, you troll! There is absolutely nothing wrong with using 'cat' in this way.
    Other than grep not being able to list the filenames? I would think that most people¹ would spot that one…

    ¹ Who know enough about grep.

    grep -c gives you filenames, or did you oversnip?
    I don't quite see how you can get grep to list filenames when it's given none. Perhaps you'd care to expand upon that?

    (Context is in the article; and if it's not quoted, it can't be snipped…)

  • Jan (unregistered) in reply to Quirkafleeg
    Quirkafleeg:
    Jan:
    Jim:
    worthy of an un-necessary use of cat award!
    Go away, you troll! There is absolutely nothing wrong with using 'cat' in this way.
    Other than grep not being able to list the filenames? I would think that most people would spot that one…
    Well, sometimes that is something you want, and other times, it is not. For instance, you might not care about filenames, but only about the data; or want to do more processing on the results of the grep.

    There is no reason to be allergic to the word 'cat'.

  • Quirkafleeg (unregistered) in reply to Jan

    [cat | grep]

    Jan:
    Quirkafleeg:
    Other than grep not being able to list the filenames? I would think that most people would spot that one…
    Well, sometimes that is something you want, and other times, it is not. For instance, you might not care about filenames, but only about the data; or want to do more processing on the results of the grep.
    ‘-h’, a.k.a. ‘--no-filename’, solves that one.

    There is no reason to be allergic to the word 'cat'.
    Who said anything about aller… sniff… sniff sneeze sneeze sniff sneeze sneeze sneeze

    You owe me one clean keyboard.

  • Fred (unregistered) in reply to smxlong
    smxlong:
    Jungle Cat:
    Funny, I was thinking exactly the same thing about the guy who hired the Kerbleckistanian. It's his fault for hiring a guy he couldn't sue for deleting all his files, after he stiffed the guy.

    Extra-legal solutions are a two-way street, so take all that lawyer crap and shove it up your ...

    I don't know what you mean by "lawyer crap." Sue somebody for deleting files? If somebody deleted files from my server, I'd report them to the FBI. No lawyer involved.

    The FBI has no jurisdiction in Kerbleckistan. You'd be fucked.

  • John Winters (unregistered)

    Surely this would be a non-event anyway? Even if the original programmer did manage to invoke his back door you'd just restore all the files from the previous day's backup and then continue as normal (disabling the back door before restoring 'net access obviously).

    Mind you, I'm surprised a web application would be given write access to its own code.

  • pueblonative (unregistered) in reply to Mark Draughn

    The irony of that being that if the developer was successful and smart enough to do that he very likely would have never landed in that situation in the first place. Plus, from what the OP said he very likely would have been doing the company a benefit if he had executed the code in the first place.

    For developers, this is probably a good lesson in never handing over the source code until payment is completely or nearly completely made. Put it on a test server or hand over a product that leaves an identifiable watermark.

  • caecus (unregistered) in reply to Fred
    Fred:
    smxlong:
    Jungle Cat:
    Funny, I was thinking exactly the same thing about the guy who hired the Kerbleckistanian. It's his fault for hiring a guy he couldn't sue for deleting all his files, after he stiffed the guy.

    Extra-legal solutions are a two-way street, so take all that lawyer crap and shove it up your ...

    I don't know what you mean by "lawyer crap." Sue somebody for deleting files? If somebody deleted files from my server, I'd report them to the FBI. No lawyer involved.

    The FBI has no jurisdiction in Kerbleckistan. You'd be fucked.

    Nowadays FBI is tough on people who waste their time.

  • Kempeth (unregistered)

    That's a dirty trick. But then again as others have said the site owner was probably better off starting from scratch anyway...

    It does however remind me of a situation a friend once had. He and two others founded their own company and developed a CMS. At some point one of them jumped off and took a copy of the project with him to get some customers for himself. Obviously the various attempts of convincing him to stop failed so they probed his webserver and found out that he had server-wide write enabled anonymous ftp access. They uploaded a few quick changes to the code so a message was displayed on every page saying that the site was run on stolen software...

    Captcha: bene, molto bene!

  • kftt (unregistered) in reply to lImbus
    lImbus:
    another real WTF is this useless use of cat. what's wrong with the following ? 
    grep unlink *.php
    or
    grep unlink -R *.php
    The fact I could instantly see the filename in question ?

    You mean 

    grep -R unlink *.php

  • quisling (unregistered) in reply to Twirrim
    Twirrim:
    Mavrik:
    Because even us non-english speakers prefer to comment code (even if in bad) english.

    Partly because of language limitation (some things just don't translate well :\ ) or because sometimes your code has to be maintained by a foreigner, who would get annoyed at functions called "IzpišiBesedilo(String nekaj)".

    Sure, but your nasty backdoor?

    Naw, i keep my backdoor clean... and trimmed!

  • quisling (unregistered) in reply to Lol@u
    Lol@u:
    smxlong:
    I don't know what you mean by "lawyer crap." Sue somebody for deleting files? If somebody deleted files from my server, I'd report them to the FBI. No lawyer involved.
    Yeah, they are pretty cool guys! They will invade foreign countries to get your money back and aren't afraid of anything!
    You're thinking about the Military, not the FBI. And Oil, not Money (we just add a few more rows in the HasMoney database as needed -- hope we don't owe you billions of dollars, tee-hee!). But other than that, you're right on, Lol@ipop!
  • Ido Green (unregistered)

    Excellent stuff... so true I want to smile/cry :)

  • AdT (unregistered) in reply to dkf
    dkf:
    find -name '*.php' -print0 | xargs -0 grep -H unlink

    find expects a path argument, so it's "find . -name" and so on. Also, you only want to grep regular files: "find . -type f -name" etc.

    Captcha: veniam (veni, veni, venias, ne me mori facias)

  • emdx (unregistered) in reply to steenbergh
    steenbergh:
    Call me naive, but that's the dirtiest thing I've ever seen...

    Perhaps, but very often, such a backdoor is always included in the SECOND program one writes as a freelancer…

    CAPTCHA: cæcus

  • Someone (unregistered)

    LOL, "Ondra M." is an anagram of "random".

  • vsync (unregistered) 
    ack unlink
  • Anonymous Coward (unregistered) in reply to steenbergh

    No, the dirtiest trick was a small disk magnet on a system drive.
    It was a really weak one, would barely hold up a paper on a refridgerator, but over a few hours of hard spinning, eventually destroyed the data on the drive. A stronger one would have been noticed immediately, I think. This one was JUST strong enough to eat a few bits at a time.

  • itsmo (unregistered)

    Hey - has anyone mentioned that Ondra is Czech for Andy?

  • (cs)

    What he should have done is make the page print out things like "Dropping all tables", but not actually do anything, so the Kerbleckistani would think everything was deleted. If you know his IP address, route him to a default Apache page or something so he thinks he wiped the site (he doesn't sound smart enough to actually check)

  • Guntank (unregistered)

    Mr. Kerbablestan is literally a much more malicious (and illiterate) version of Paula.

    // I be so brillant if ($_GET['page'] == "delete_all_files"){ echo "paula"; mysql_query("DROP TABLE *"); unlink("index.php"); unlink("apps.php"); unlink("resources"); ... snip all files ... }

Leave a comment on “Maybe I Needing Later”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article