424: Security Holes

|< < Prev Comic #424 (May 16, 2008) Next > >|

Security Holes

Title text: True story: I had to try several times to upload this comic because my ssh key was blacklisted.

Explanation

The "Debian-OpenSSL fiasco" was a major security problem discovered in the Debian Linux distribution and its version of the cryptographic library called OpenSSL. With just a tiny change in the software, which was intended to have no effect on security, its random number generator was completely crippled, as was the security of all cryptographic keys generated by the system. The problem was created when a Debian developer removed one line of code that was crucial, even though it could seem like it did nothing useful. More detail about the fiasco: Crippling Crypto: The Debian OpenSSL Debacle, Debian's information page about the problem.

The title text refers also to this issue: After the security problem was found, all cryptographic keys generated or used on the broken operating system needed to be replaced. Many systems introduced special checks for such weak keys, adding the keys to blacklists, thereby preventing their use and forcing users to create new keys. Randall claims that he was affected by that when uploading this comic to the server.

The panels on the left present Cueball as a programmer who, on a whim, removes pieces of code, (commenting out the code by prepending the line with two slashes), presumably thinking that they are not necessary. The first removed line, MD_update(&m, buf, j);, is the exact piece of code that was removed in the Debian fiasco. The next panels show him commenting out fictitious lines of code apparently preventing bad things from happening.

The other part of the comic lists "security problems" that were allegedly discovered in other Linux variants afterwards:

Cryptographic software in Fedora Core was allegedly not secure against toy decoder rings. This is probably a reference to the association of the fedora with 1930s and 40s culture (especially gangsters and film noir), and the contemporaneous introduction and popularity of toy decoder rings.

Xandros (used in Asus Eee PC netbooks) gave superuser privileges to anybody "if asked in a stern voice." This is likely a reference to the fact that the preinstalled Xandros OS did not require a password for root privileges by default.

Gentoo would succumb to flattery, which may be a reference to Gentoo's notorious difficulty to manage. Any user who is capable of understanding it might have a large ego, and therefore be susceptible to flattery.

OLPC OS could have been attacked using Jeff Goldblum's laptop computer, which refers to a scene in the Independence Day movie, where Jeff Goldblum's character was able to hack into an alien spaceship using his Apple PowerBook computer - which is a topic of great contempt by geeks who point to the absurdity of such a construction.

Slackware gave superuser privileges to anybody who "says Elvish word for 'friend'," which refers to a scene in The Lord of the Rings, where the entrance door to Moria could have been opened using a password mellon, the Elvish word for "friend," as indicated on the door itself.

And Ubuntu, which is another Linux distribution, was allegedly found to be actually Windows Vista, the latest version of Microsoft Windows at this time in 2008. This may be a reference to Ubuntu being developed with non-advanced users in mind, with many fail-safes and additional features being turned on by default, which had more in common with Windows than any other Linux-based operating system at the time.

Transcript

[Cueball sitting at computer.]

Cueball: I'll just comment out these lines...

// MD_update(&m, buf, j);

// do_not_crash();

// prevent_911();

In the rush to clean up the debian-openssl fiasco, a number of other major security holes have been uncovered:

[A two-column table is shown:]

Affected System

Security problem

---

Fedora Core

Vulnerable to certain decoder rings

Xandros (EEE PC)

Gives root access if asked in a stern voice

Gentoo

Vulnerable to flattery

OLPC OS

Vulnerable to Jeff Goldblum’s PowerBook

Slackware

Gives root access if user says Elvish word for “friend”

Ubuntu

Turns out distro is actually just Windows Vista with a few custom themes

 add a comment! ⋅  add a topic (use sparingly)! ⋅  refresh comments!

Discussion

Could the Slackware one imply that harder nerds/geeks are more fond of this specific Linux distro? 108.162.212.196 01:00, 4 December 2013 (UTC)

Perhaps he's also implying aliens use OLPC? 108.162.216.45 (talk) (please sign your comments with ~~~~)

I think the Xandros/EEE PC vulnerability "gives access if asked in a stern voice" is a reference to comic 413: New Pet, where Cueball and Megan made a pet out of a EEE PC on wheels inside a hamster ball. Pets sometimes need to be talked to sternly if they're unwilling to obey commands; in this case, a EEE PC needs to be talked to sternly in order to give the commander root access. Codefreak5 (talk) 21:36, 15 July 2014 (UTC)

I like to think teh "exploit" is just sudo sudo [arbitrary command]. AzureArmageddon 15:40, 1 October 2023 (UTC)

The Gentoo explanation does not make sense. Gentoos succumbing to flattery should mean the users use flattery on the Gentoo, not the other way around. --flewk (talk) 16:43, 28 December 2015 (UTC)

Crippling Crypto (the first article mentioned as offering more detail on the Debian-OpenSSL vulnerability) analogises the resulting problem by partly reproducing 221: Random Number. Should this be mentioned in this article or in 221, or both, or not mentioned in either? 108.162.250.87 09:39, 30 November 2020 (UTC)

This has aged interestingly, given that about half of those security problems are legitimate weaknesses of current LLM AI models. Not the same as operating systems, of course, but you'd be terrified by how much people already trust them to be secure.172.71.183.72 12:00, 25 March 2024 (UTC)