Re: [Full-disclosure] Barracuda backdoor

[Benji <me@xxxxxxxxx>]

Do you actually have any evidence of a backdoor? Or could this just be a
remote 'turn-off' switch as such? I'm not saying that one is better than the
other, but they are very different features.

On Thu, Apr 28, 2011 at 11:09 AM, Tõnu Samuel <tonu@xxxxxx> wrote:

> Hello!
>
> We have alarming case with Barracuda products here.
>
> Customer bought Barracuda hardware years ago and paid for it. No leasing
> etc. Product is Barracuda Spam Firewall 800 which is $40k product.
> Customer also paid for not-so-cheap annual subscription fees each year.
>
> One day their Barracuda product stopped working.
>
> After investigating problem it came out that Barracuda reseller and
> Barracuda itself have some misunderstandings and because of this
> Barracuda not only disabled all kind of subscription services but also
> used some kind of backdoor in their products to disable product customer
> had paid long time ago.
>
> Message was shown "Error: Activation has not been completed. Please
> activate your Barracuda Spam & Virus Firewall to enable functionality.
> (Click here to activate)". Customer was blocked to make any changes in
> admin interface of product. Even more irritating was fact that admin
> wanted to see why some e-mails were lost and was denied even to see logs!
>
> Notice - Barracuda have not just disabled some online services (which
> were paid too) but they remotely disabled hardware product which does
> not belong to them.
>
> I think users should be warned for companies like Barracuda. As much I
> understand this is also criminal violation to sabotage some other
> company network resources.
>
>   Tõnu
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/