Date: Mon, 5 Jan 1998 12:29:09 -0500
From: EM3405@cgi.ca (Larry Werring)
Subject: Easter Eggs in Commercial Software

Do you know what kind of hidden features are hidden in commercial
applications?  Do you know how much disk space is wasted as a result of
these hidden applications (known as Easter eggs) within commercial
applications?  What do Easter eggs have to say about project management,
quality control and configuration management of the company developing
products containing the Easter eggs?  How much extra is the consumer paying
for products to cover the cost of developing these hidden and utterly
useless applications?  How much time is being wasted by employees at the
expense of their employer (usually the customer who paid for the
application) to look for and play with these Easter eggs? What other unknown
features are embedded within commercial products? Can you trust any
commercially developed product?  What follows are two examples of Easter
eggs hidden within commercial applications (I have used Microsoft products
only to demonstrate how elaborate an Easter egg can be).

Example 1:

Open Excel 97.
Open a new worksheet and press the F5 key.
Type X97:L97 and press the Enter key.
Press the Tab key.
Hold Ctrl-Shift and click the Chart Wizard button on the tool bar.
Once the Easter egg is activated, use the mouse to fly around - right
button for forward, left for reverse.

Note: If you don't have DirectX drivers installed you will only get a list
of developer names.  If you do, you will encounter a flight simulator.  Can
you find the focal point of the virtual region with the scrolling display?

Example 2:
Open Internet Explorer.
Select "About Internet Explorer" from the help menu.
Hold down the Ctrl key and use the mouse to select and drag the "e" in the
upper right hand corner onto the picture of the Earth and release the Ctrl key.
Hold down the Ctrl key again and use the mouse to drag the "e" so that it
pushes the words "Microsoft Internet Explorer 4.0" out of the way and
return the "e" to the planet earth.
If it hasn't already started to run, press the "unlock" button to see a
display of all the IE 4.0 development team.

Note: This Easter egg is lengthy.  The author has attempted to interject
humour at various points in the display but has failed miserably.  In fact,
the author admits to a crime committed by one or more members of the team
(theft of construction sign - remember the teenager convicted of multiple
counts of manslaughter for stealing a traffic sign).  Also, at the very end
of the display, the author impugns the character of several team members
(basis for possible defamation of character suit by the individuals?).  I'll
bet that this Easter egg was never approved by the IE 4.0 project manager or
Bill Gates.

So-called Easter Eggs are hidden within many Microsoft applications (Windows
95 and NT, for example).  However, other products apparently have them as
well (e.g. Netscape and Macintosh System 7.5 for example).

I remember the days when every line of code was examined before we would
allow a program to be used in a trusted environment.  This was deemed too
expensive so now we "trust" software creators.  How can you "trust" any
commercial product sold by a major manufacturer when it can be demonstrated
that many products from the manufacturer include hidden applications and
possibly functions as part of the product.

Note:  I addressed an e-mail about this to Microsoft's Security guru's but,
as usual, got nothing back but an acknowledgement of receipt.

Larry Werring, IT Security Consultant