Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

The wikipedia article on Limewire says that "LimeWire 5.5.11 and newer have been disabled using a backdoor installed by the company".

How are such backdoors implemented? Is it as simple as the the program going out and checking a web service and disabling itself? If it's in fact so simple, it has to be stored somewhere on the user's drive (in a plist, or in the registry for example). It's hard to imagine no one has in fact figured out a way to turn that flag off and use the program.

share|improve this question
3  
It took about 2 days for someone to figure it out. See en.wikipedia.org/wiki/LimeWire_Pirate_Edition –  jfrankcarr Mar 19 '12 at 3:15
    
Ken Thompson's Classic paper shows you how. http://cm.bell-labs.com/who/ken/trust.html –  Tim Williscroft Mar 19 '12 at 6:03

2 Answers 2

The typical concept of a back door in software is one which allows the creator undisclosed and unwanted access to installations of his software. The simplest method would be to hard-code additional credentials to the system.

There is an important distinction between this meaning and a piece of software that routinely checks for updates, even though they function entirely the same. The user knows and wants it to happen. It's only a cultural shift that turns the outrageous transgression of altering my machine into a typical and daily occurrence that happens with today's software. But at least they're usually nice enough to ask first.

share|improve this answer

In the case of Borland's Interbase (now called Firebird), there was a hidden super-user that the system required in order to work. This hidden super-user could not be disabled, and it had a known password that could not be changed (until a patch became available to do so). This would allow anyone who knew the hardcoded username/password combination to access any installation. Disabling this account breaks the system because it can no longer authenticate users.

CERT advisory on Interbase.

Is it as simple as the the program going out and checking a web service and disabling itself?

This is generally how many forms of license management work. Some simply check to see if "my serial number" is in use, and if so, they exit. Some use a form of PKI and revoke local certificates if the license is invalid. For example, Adobe Reader pings crl.adobe.com when it starts to see if any licenses have been revoked, as the key to enable plugins to work in the free reader require a digital key. If a plug-in does things that violate the licence, the cert enabling it will be revoked. License management is a very complicated process because you've got to stay one step ahead of the crackers, and even minor bugs in your licensing code will cause major customer problems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.