O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 27] 27.2 Can You Trust Your Suppliers?
Chapter 27
Who Do You Trust?
27.2 Can You Trust Your Suppliers?
Your computer does something suspicious. You discover that the modification dates on your system
software have changed. It appears that an attacker has broken in, or that some kind of virus is spreading.
So what do you do? You save your files to backup tapes, format your hard disks, and reinstall your
computer's operating system and programs from the original distribution media.
Is this really the right plan? You can never know. Perhaps your problems were the result of a break-in.
But sometimes, the worst is brought to you by the people who sold you your hardware and software in
the first place.
27.2.1 Hardware Bugs
The fact that Intel Pentium processors had a floating-point problem that infrequently resulted in a
significant loss of precision when performing some division operations was revealed to the public in
1994. Not only had Intel officials known about this, but apparently they had decided not to tell their
customers until after there was significant negative public reaction.
Several vendors of disk drives have had problems with their products failing suddenly and
catastrophically, sometimes within days of being placed in use. Other disk drives failed when they were
used with UNIX, but not with the vendor's own proprietary operating system. The reason: UNIX did not
run the necessary command to map out bad blocks on the media. Yet, these drives were widely bought
for use with the UNIX operating system.
Furthermore, there are many cases of effective self-destruct sequences in various kinds of terminals and
computers. For example, Digital's original VT100 terminal had an escape sequence that switched the
terminal from a 60Hz refresh rate to a 50Hz refresh rate, and another escape sequence that switched it
back. By repeatedly sending the two escape sequences to a VT100 terminal, a malicious programmer
could cause the terminal's flyback transformer to burn out - sometimes spectacularly!
A similar sequence of instructions could be used to break the monochrome monitor on the original IBM
PC video display.
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch27_02.htm (1 of 6) [2002-04-12 10:45:21]