📸

across them by making some non-instinctive move: for example, on certain computer gaming machines the instinct is to hold two lemons (if three lemons wins a prize) and then to spin for the third lemon. This almost never wins. But if the player doesn't hold the two lemons and simply re-spins, the three lemons will automatically come up. On another arcade game, one which offers a sizeable jackpot, it is said that the player brave enough to refuse it and start the machine again will be rewarded by winning two jackpots.

On a more sophisticated level, back doors are also provided on operating systems for emergencies. Access to these back doors is reserved for the computer manufacturer; procedures for gaining entry to the system from the emergency back doors are highly confidential, highly complex, and not the sort that could be stumbled over by accident.

The back door on the VAXen, though, was out in the open. It wasn't simply for emergencies; its security was far too trivial.

The VAX operating system, VMS, had been subjected to stringent tests by the American authorities and was supposed to comply with the exacting orange-book security standards established by the US Department of Defense.⁴ Under the orange-book testing program, technically qualified intruders attempt to break through the security features of a computer; the tests can take up to six months, depending on the level of security required. It beggared belief that VMS could have gone through such testing without the back door being discovered.⁵

Responding to complaints from its users, Digital issued a mandatory patch, a small program designed specifically to close the back door, in May 1987. Despite the mandatory tag, many users didn't bother to install it. So, at least for a time, VAX computers across the world provided hackers with an open house – if they knew about the security gap.

Back doors are, of course, deliberate. They aren't simple bugs in the program or errors in the system: they are written by a programmer for a specific purpose. In the case of the VAX back door, the who and the why remain mysterious, though it is clear that whoever did it had to have access to the VMS source code, its basic operating instructions. One rather far-fetched (though not impossible) idea is

📸