Proprietary Back Doors

Nonfree (proprietary) software is very often malware (designed to mistreat the user). Nonfree software is controlled by its developers, which puts them in a position of power over the users; that is the basic injustice. The developers often exercise that power to the detriment of the users they ought to serve.

A “back door” in a program is a channel designed to send the program commands from someone who is not supposed to be in control of the computer where the program is installed.

Here are examples of demonstrated back doors in proprietary software. They are sorted out according to what they are known to allow. Back doors that allow full control over the operating system are said to be “universal”.

If you know of an example that ought to be in this page but isn't here, please write to <[email protected]> to inform us. Please include the URL of a trustworthy reference or two to serve as specific substantiation.

Spying Altering user's data/settings Installing/deleting/disabling programs Full control Other/undefined

Spying

Many models of Internet-connected cameras contain a glaring back door—they have login accounts with hard-coded passwords, which can't be changed, and there is no way to delete these accounts either.

Since these accounts with hard-coded passwords are impossible to delete, this problem is not merely an insecurity; it amounts to a back door that can be used by the manufacturer (and government) to spy on users.
WhatsApp has a feature that has been described as a “back door” because it would enable governments to nullify its encryption.

The developers say that it wasn't intended as a back door, and that may well be true. But that leaves the crucial question of whether it functions as one. Because the program is nonfree, we cannot check by studying it.
Microsoft has backdoored its disk encryption.
Apple can, and regularly does, remotely extract some data from iPhones for the state.

This may have improved with iOS 8 security improvements; but not as much as Apple claims.

Altering user's data or settings

Android has a back door for remotely changing “user” settings.

The article suggests it might be a universal back door, but this isn't clear.
The Dropbox app for Macintosh takes control of user interface items after luring the user into entering an admin password.
A pregnancy test controller application not only can spy on many sorts of data in the phone, and in server accounts, it can alter them too.
Some D-Link routers have a back door for changing settings in a dlink of an eye.

The TP-Link router has a back door.

Many models of routers have back doors.
Google has long had a back door to remotely unlock an Android device, unless its disk is encrypted (possible since Android 5.0 Lollipop, but still not quite the default).
Caterpillar vehicles come with a back door to shutoff the engine remotely.
Modern gratis game cr…apps collect a wide range of data about their users and their users' friends and associates.

Even nastier, they do it through ad networks that merge the data collected by various cr…apps and sites made by different companies.

They use this data to manipulate people to buy things, and hunt for “whales” who can be led to spend a lot of money. They also use a back door to manipulate the game play for specific players.

While the article describes gratis games, games that cost money can use the same tactics.
Samsung Galaxy devices running proprietary Android versions come with a back door that provides remote access to the files stored on the device.
The Amazon Kindle-Swindle has a back door that has been used to remotely erase books. One of the books erased was 1984, by George Orwell.

Amazon responded to criticism by saying it would delete books only following orders from the state. However, that policy didn't last. In 2012 it wiped a user's Kindle-Swindle and deleted her account, then offered her kafkaesque “explanations.”

Do other ebook readers have back doors in their nonfree software? We don't know, and we have no way to find out. There is no reason to assume that they don't.
The iPhone has a back door for remote wipe. It's not always enabled, but users are led into enabling it without understanding.

Installing, deleting or disabling programs

Corel Paintshop Pro has a back door that can make it cease to function.

The article is full of confusions, errors and biases that we have an obligation to expose, given that we are making a link to them.
- Getting a patent does not “enable” a company to do any particular thing in its products. What it does enable the company to do is sue other companies if they do some particular thing in their products.
- A company's policies about when to attack users through a back door are beside the point. Inserting the back door is wrong in the first place, and using the back door is always wrong too. No software developer should have that power over users.
- “Piracy” means attacking ships. Using that word to refer to sharing copies is a smear; please don't smear sharing.
- The idea of “protecting our IP” is total confusion. The term “IP” itself is a bogus generalization about things that have nothing in common.
  
  In addition, to speak of “protecting” that bogus generalization is a separate absurdity. It's like calling the cops because neighbors' kids are playing on your front yard, and saying that you're “protecting the boundary line”. The kids can't do harm to the boundary line, not even with a jackhammer, because it is an abstraction and can't be affected by physical action.
Some “Smart” TVs automatically load downgrades that install a surveillance app.

We link to the article for the facts it presents. It is too bad that the article finishes by advocating the moral weakness of surrendering to Netflix. The Netflix app is malware too.
Baidu's proprietary Android library, Moplus, has a back door that can “upload files” as well as forcibly install apps.

It is used by 14,000 Android applications.
In addition to its universal back door, Windows 8 has a back door for remotely deleting apps.

You might well decide to let a security service that you trust remotely deactivate programs that it considers malicious. But there is no excuse for deleting the programs, and you should have the right to decide whom (if anyone) to trust in this way.
In Android, Google has a back door to remotely delete apps. (It was in a program called GTalkService, which seems since then to have been merged into Google Play.)

Google can also forcibly and remotely install apps through GTalkService. This is not equivalent to a universal back door, but permits various dirty tricks.

Although Google's exercise of this power has not been malicious so far, the point is that nobody should have such power, which could also be used maliciously. You might well decide to let a security service remotely deactivate programs that it considers malicious. But there is no excuse for allowing it to delete the programs, and you should have the right to decide who (if anyone) to trust in this way.
The iPhone has a back door that allows Apple to remotely delete apps which Apple considers “inappropriate”. Jobs said it's OK for Apple to have this power because of course we can trust Apple.

Full control

New GM cars offer the feature of a universal back door.

Every nonfree program offers the user zero security against its developer. With this malfeature, GM has explicitly made things even worse.
The Furby Connect has a universal back door. If the product as shipped doesn't act as a listening device, remote changes to the code could surely convert it into one.
Sony has brought back its robotic pet Aibo, this time with a universal back door, and tethered to a server that requires a subscription.
Tesla used software to limit the part of the battery that was available to customers in some cars, and a universal back door in the software to temporarily increase this limit.

While remotely allowing car “owners” to use the whole battery capacity did not do them any harm, the same back door would permit Tesla (perhaps under the command of some government) to remotely order the car to use none of its battery. Or perhaps to drive its passenger to a torture prison.
Vizio “smart” TVs have a universal back door.
Xiaomi phones come with a universal back door in the application processor, for Xiaomi's use.

This is separate from the universal back door in the modem processor that the local phone company can use.
Microsoft Windows has a universal back door through which any change whatsoever can be imposed on the users.

This was reported in 2007 for XP and Vista, and it seems that Microsoft used the same method to push the Windows 10 downgrade to computers running Windows 7 and 8.

In Windows 10, the universal back door is no longer hidden; all “upgrades” will be forcibly and immediately imposed.
The Amazon Echo appears to have a universal back door, since it installs “updates” automatically.

We have found nothing explicitly documenting the lack of any way to disable remote changes to the software, so we are not completely sure there isn't one, but this seems pretty clear.
A Chinese version of Android has a universal back door. Nearly all models of mobile phones have a universal back door in the modem chip. So why did Coolpad bother to introduce another? Because this one is controlled by Coolpad.
Some applications come with MyFreeProxy, which is a universal back door that can download programs and run them.
ChromeOS has a universal back door. At least, Google says it does—in section 4 of the EULA.
In addition to its book eraser, the Kindle-Swindle has a universal back door.
Almost every phone's communication processor has a universal back door which is often used to make a phone transmit all conversations it hears. See Malware in Mobile Devices for more info.

Other or undefined

Intel's intentional “management engine” back door has unintended back doors too.
A Capcom's Street Fighter V update installed a driver that could be used as a back door by any application installed on a Windows computer, but was immediately rolled back in response to public outcry.
Dell computers, shipped with Windows, had a bogus root certificate that allowed anyone (not just Dell) to remotely authorize any software to run on the computer.
ARRIS cable modem has a back door in the back door.
“Self-encrypting” disk drives do the encryption with proprietary firmware so you can't trust it. Western Digital's “My Passport” drives have a back door.
Mac OS X had an intentional local back door for 4 years, which could be exploited by attackers to gain root privileges.
Here is a big problem whose details are still secret: The FBI asks lots of companies to put back doors in proprietary programs. We don't know of specific cases where this was done, but every proprietary program for encryption is a possibility.
The German government veers away from Windows 8 computers with TPM 2.0 (original article in German), due to potential back door capabilities of the TPM 2.0 chip.
Here is a suspicion that we can't prove, but is worth thinking about: Writable microcode for Intel and AMD microprocessors may be a vehicle for the NSA to invade computers, with the help of Microsoft, say respected security experts.
HP “storage appliances” that use the proprietary “Left Hand” operating system have back doors that give HP remote login access to them. HP claims that this does not give HP access to the customer's data, but if the back door allows installation of software changes, a change could be installed that would give access to the customer's data.

The EFF has other examples of the use of back doors.