AK's weblog

A few days ago, Clifford Wolf and I released trapdoor2. trapdoor2 allows remote users to execute local commands by sending 'magic cookies'. This is meant to be used to temporarily alter firewall rules, i.e. to open some kind of trapdoor so that users can access a service like ssh on a machine only from their current machine for a short period.



But trapdoor2 can be used for more than just that. Another ideas would be restarting services. For this use case, the WAP/WML (Wireless Application Protocol/Wireless Markup Language) support comes in handy: all you need is a mobile phone with GPRS to do important system administration tasks. Of course, trapdoor2 also support "traditional" HTML. For security reasons, trapdoor2 is HTTPS only. It even supports several SSL/TLS libraries, i.e. OpenSSL and GNU TLS. So you will be left in the rain when yet another vulnerability in OpenSSL is being found.

Some of my five readers might remember my little hack ContraPolice. Well, today, I did some little research out of pure boredom, and look where it is being referenced:

• The Annvix Project uses ContraPolice for hardening dietlibc.


• ContraPolice is in the bibliography to a vulnerability analysis seminar at the University of California in Santa Barbara.

This is just great. I never expected this little hack to spread so widely. But still, I'm happy that my code is being adopted, actually being used an probably making the (security) world a better place.