1 00:00:00,090 --> 00:00:03,300 In this lesson, we'll cover backdoors and logic bombs. 2 00:00:03,300 --> 00:00:04,800 Now, a backdoor is originally placed 3 00:00:04,800 --> 00:00:07,410 into computer programs to bypass the normal security 4 00:00:07,410 --> 00:00:10,050 and authentication functions of those systems. 5 00:00:10,050 --> 00:00:12,090 Now, if this sounds like a horrible idea to you, 6 00:00:12,090 --> 00:00:12,923 you're right, 7 00:00:12,923 --> 00:00:15,510 because it really is a horrible security practice. 8 00:00:15,510 --> 00:00:17,280 So why were backdoors created 9 00:00:17,280 --> 00:00:19,200 in some of our applications and programs? 10 00:00:19,200 --> 00:00:20,190 Well, it's actually something 11 00:00:20,190 --> 00:00:22,320 that goes all the way back to the 1980s 12 00:00:22,320 --> 00:00:24,180 because manufacturers and programmers 13 00:00:24,180 --> 00:00:25,470 were adding in these back doors 14 00:00:25,470 --> 00:00:27,180 as a way to get back into their system 15 00:00:27,180 --> 00:00:28,470 to do maintenance and repairs 16 00:00:28,470 --> 00:00:30,660 without having to go through all the authentications 17 00:00:30,660 --> 00:00:31,770 or going through the firewalls 18 00:00:31,770 --> 00:00:32,883 and all the layers of security 19 00:00:32,883 --> 00:00:34,620 that they normally would if they went through 20 00:00:34,620 --> 00:00:37,050 the public facing portions of that application. 21 00:00:37,050 --> 00:00:39,390 Now, back in the 1980s and 1990s 22 00:00:39,390 --> 00:00:41,280 and even into the early 2000s, 23 00:00:41,280 --> 00:00:43,200 backdoors were a commonplace thing 24 00:00:43,200 --> 00:00:45,900 that was put into our applications by programmers. 25 00:00:45,900 --> 00:00:48,150 But in modern networks, we consider this 26 00:00:48,150 --> 00:00:50,880 to be a breach of secure coding best practices, 27 00:00:50,880 --> 00:00:52,950 even though you'll still find some programmers 28 00:00:52,950 --> 00:00:55,110 who add backdoors into their code. 29 00:00:55,110 --> 00:00:58,590 So these days, most software will not have a backdoor 30 00:00:58,590 --> 00:00:59,820 because they've been patched up 31 00:00:59,820 --> 00:01:02,220 because we know how bad these things are for security 32 00:01:02,220 --> 00:01:04,050 but there is still some things out there 33 00:01:04,050 --> 00:01:05,670 that act like back doors. 34 00:01:05,670 --> 00:01:07,020 Do you know what those might be? 35 00:01:07,020 --> 00:01:09,360 Well, it's a Remote Access Trojan. 36 00:01:09,360 --> 00:01:11,970 Now, a Remote Access Trojan can be placed by a threat actor 37 00:01:11,970 --> 00:01:13,800 onto your computer to help them maintain 38 00:01:13,800 --> 00:01:15,810 persistent access to your system. 39 00:01:15,810 --> 00:01:18,390 So if an attacker is able to trick one of your users 40 00:01:18,390 --> 00:01:20,700 into clicking on a sphere phishing link in an email, 41 00:01:20,700 --> 00:01:22,980 they may be able to install some kind of malware 42 00:01:22,980 --> 00:01:25,650 based on clicking that link, and now they have something 43 00:01:25,650 --> 00:01:28,380 that can create a callback connection to their system. 44 00:01:28,380 --> 00:01:30,180 This callback to the remote system 45 00:01:30,180 --> 00:01:32,700 will then allow the attacker to connect to your system 46 00:01:32,700 --> 00:01:35,520 while bypassing the system's default security posture. 47 00:01:35,520 --> 00:01:37,200 And this allows a remote access Trojan 48 00:01:37,200 --> 00:01:38,910 to basically act like a backdoor 49 00:01:38,910 --> 00:01:41,490 in order to allow the attacker to gain access to your system 50 00:01:41,490 --> 00:01:43,080 anytime they want. 51 00:01:43,080 --> 00:01:44,490 Next, we need to talk about something 52 00:01:44,490 --> 00:01:46,020 known as an Easter Egg. 53 00:01:46,020 --> 00:01:48,480 Now, Easter Eggs are another insecure coding practice 54 00:01:48,480 --> 00:01:50,520 that was used by programmers to provide a joke 55 00:01:50,520 --> 00:01:52,500 or gag gift to their users. 56 00:01:52,500 --> 00:01:54,090 Essentially, there would be different things 57 00:01:54,090 --> 00:01:55,590 that would happen in different video games 58 00:01:55,590 --> 00:01:57,000 or different pieces of software 59 00:01:57,000 --> 00:01:59,340 when certain pieces of code were executed. 60 00:01:59,340 --> 00:02:01,350 For example, several years ago, 61 00:02:01,350 --> 00:02:03,990 Google added an Easter Egg into their search application 62 00:02:03,990 --> 00:02:05,910 and you can actually still access it today. 63 00:02:05,910 --> 00:02:06,930 If you want to try it out, 64 00:02:06,930 --> 00:02:09,030 simply head over to google.com right now 65 00:02:09,030 --> 00:02:11,550 and type in do a barrel roll into the search bar 66 00:02:11,550 --> 00:02:12,720 and then press enter. 67 00:02:12,720 --> 00:02:16,410 Then you'll see the whole webpage do a 360 degree rotation 68 00:02:16,410 --> 00:02:19,290 as if it was doing a barrel roll inside of an airplane. 69 00:02:19,290 --> 00:02:21,120 Now, this code has no real function 70 00:02:21,120 --> 00:02:23,100 except to act as a joke or a gag 71 00:02:23,100 --> 00:02:26,100 or a hidden secret inside of the search application. 72 00:02:26,100 --> 00:02:28,500 And that is why this is considered to be an Easter Egg 73 00:02:28,500 --> 00:02:29,820 because the Google programmers 74 00:02:29,820 --> 00:02:31,707 decided to put this silly feature into the code 75 00:02:31,707 --> 00:02:33,840 for the company's most widely used product, 76 00:02:33,840 --> 00:02:35,490 the Google search bar. 77 00:02:35,490 --> 00:02:36,450 Now in general, 78 00:02:36,450 --> 00:02:38,670 you're going to find Easter Eggs are pretty harmless 79 00:02:38,670 --> 00:02:41,460 but they do add additional code into the applications 80 00:02:41,460 --> 00:02:43,380 which could create some additional vulnerabilities 81 00:02:43,380 --> 00:02:45,300 that a threat actor could exploit. 82 00:02:45,300 --> 00:02:47,550 Now, over the years, I have worked as a penetration tester 83 00:02:47,550 --> 00:02:48,990 and I have found that Easter Eggs 84 00:02:48,990 --> 00:02:51,390 generally have more vulnerabilities associated with them 85 00:02:51,390 --> 00:02:53,040 than the rest of the application. 86 00:02:53,040 --> 00:02:55,110 And the reason for this is that this type of code 87 00:02:55,110 --> 00:02:57,510 that creates the Easter Egg is usually meant as a joke 88 00:02:57,510 --> 00:02:59,070 and it's added right before a product 89 00:02:59,070 --> 00:03:00,210 is going to be released. 90 00:03:00,210 --> 00:03:01,470 And this means it doesn't always go through 91 00:03:01,470 --> 00:03:03,690 the same rigorous forms of security testing 92 00:03:03,690 --> 00:03:05,790 that the rest of the application did. 93 00:03:05,790 --> 00:03:06,840 Now, you may be wondering 94 00:03:06,840 --> 00:03:09,810 why am I talking about Easter Eggs inside of this video? 95 00:03:09,810 --> 00:03:11,130 Well, it's because Easter Eggs 96 00:03:11,130 --> 00:03:13,350 are closely linked to logic bombs. 97 00:03:13,350 --> 00:03:15,390 Now, logic bombs is the next thing we're going to talk about. 98 00:03:15,390 --> 00:03:17,490 And as I said, they're very similar to Easter Eggs 99 00:03:17,490 --> 00:03:19,320 and many consider them to be an evolution 100 00:03:19,320 --> 00:03:20,550 of earlier Easter Eggs 101 00:03:20,550 --> 00:03:22,920 but they have a more malicious intent. 102 00:03:22,920 --> 00:03:24,900 Logic bombs are a type of malicious code 103 00:03:24,900 --> 00:03:27,420 that's inserted into a program and that malicious code 104 00:03:27,420 --> 00:03:30,360 will only execute when certain conditions have been met. 105 00:03:30,360 --> 00:03:33,540 For example, a disgruntled employee may insert a logic bomb 106 00:03:33,540 --> 00:03:35,370 into the server's code so that the program 107 00:03:35,370 --> 00:03:37,410 will query the company's active directory server 108 00:03:37,410 --> 00:03:39,120 every single day at midnight. 109 00:03:39,120 --> 00:03:41,520 If that disgruntled employee's account was terminated 110 00:03:41,520 --> 00:03:44,160 because they got fired, then that malicious code 111 00:03:44,160 --> 00:03:45,900 will perform some kind of bad action 112 00:03:45,900 --> 00:03:47,790 like deleting all the files on the server 113 00:03:47,790 --> 00:03:49,800 or transferring money from the corporate bank account 114 00:03:49,800 --> 00:03:51,780 over to the employee's personal bank account 115 00:03:51,780 --> 00:03:54,210 anytime they find that this account was deleted 116 00:03:54,210 --> 00:03:56,730 by the system when they do their midnight checks. 117 00:03:56,730 --> 00:03:58,710 Now, one of my favorite examples of a logic bomb 118 00:03:58,710 --> 00:04:02,400 actually comes from the classic 1993 movie "Jurassic Park." 119 00:04:02,400 --> 00:04:04,890 In the movie, the parks programmer Dennis Nerdy, 120 00:04:04,890 --> 00:04:07,680 decides he's going to put a logic bomb into the computer system 121 00:04:07,680 --> 00:04:09,030 that's operating the power grid 122 00:04:09,030 --> 00:04:11,100 that is going to keep all the dinosaurs inside 123 00:04:11,100 --> 00:04:12,750 their electrified enclosures. 124 00:04:12,750 --> 00:04:14,880 His logic bomb is designed to shut down the power 125 00:04:14,880 --> 00:04:16,740 for a few minutes so he can run in, 126 00:04:16,740 --> 00:04:19,829 steal some dinosaur embryos, and then sell them to get rich. 127 00:04:19,829 --> 00:04:22,260 Now everything begins to go according to his plan. 128 00:04:22,260 --> 00:04:23,310 At the designated time, 129 00:04:23,310 --> 00:04:25,200 the power is cut off to the enclosures 130 00:04:25,200 --> 00:04:27,150 and Dennis is able to sneak out of the room, 131 00:04:27,150 --> 00:04:28,350 go past all the alarms, 132 00:04:28,350 --> 00:04:29,910 because there's no power to them anymore, 133 00:04:29,910 --> 00:04:31,110 and get into the nursery 134 00:04:31,110 --> 00:04:33,270 to steal some of those dinosaur embryos. 135 00:04:33,270 --> 00:04:34,410 He thinks he's going to get off 136 00:04:34,410 --> 00:04:36,750 and sell those embryos and become a millionaire. 137 00:04:36,750 --> 00:04:38,310 Of course, it all goes bad for him 138 00:04:38,310 --> 00:04:40,260 and the dinosaurs are running rampant in the park 139 00:04:40,260 --> 00:04:41,970 because he turned off the electrical grid 140 00:04:41,970 --> 00:04:44,460 and he ends up getting killed by one of those dinosaurs. 141 00:04:44,460 --> 00:04:45,900 Now, that's not really the point here, 142 00:04:45,900 --> 00:04:48,510 but instead I want to provide you with a classic example 143 00:04:48,510 --> 00:04:51,210 of a logic bomb 'cause he set up some malicious code 144 00:04:51,210 --> 00:04:53,130 to create an action at a certain time 145 00:04:53,130 --> 00:04:55,770 and he had this malicious intent when he did it. 146 00:04:55,770 --> 00:04:58,230 So remember, a backdoor is a covert method 147 00:04:58,230 --> 00:05:01,050 of bypassing normal authentication or security controls 148 00:05:01,050 --> 00:05:02,760 in a system that's often introduced 149 00:05:02,760 --> 00:05:05,370 by the system's original designers or programmers. 150 00:05:05,370 --> 00:05:07,350 An Easter Egg is going to be a hidden feature 151 00:05:07,350 --> 00:05:09,870 or novelty within a program that's typically inserted 152 00:05:09,870 --> 00:05:12,330 by the software developers as an inside joke, 153 00:05:12,330 --> 00:05:14,430 and a logic bomb is the type of malicious code 154 00:05:14,430 --> 00:05:16,350 that's inserted into a piece of software 155 00:05:16,350 --> 00:05:18,270 that will then execute a harmful action 156 00:05:18,270 --> 00:05:20,460 when specific conditions have been met. 157 00:05:20,460 --> 00:05:21,870 In our modern applications, 158 00:05:21,870 --> 00:05:23,460 we should never include back doors, 159 00:05:23,460 --> 00:05:25,020 Easter Eggs or logic bombs 160 00:05:25,020 --> 00:05:27,360 because they do go against our secure coding standards 161 00:05:27,360 --> 00:05:28,590 and best practices. 162 00:05:28,590 --> 00:05:29,820 So you want to make sure you're scanning 163 00:05:29,820 --> 00:05:31,380 your customer developed applications 164 00:05:31,380 --> 00:05:32,910 to ensure that none of these three things 165 00:05:32,910 --> 00:05:34,950 are included in them if you want to ensure 166 00:05:34,950 --> 00:05:37,913 that you have the most secure network for your organization.