IRIX's tape devices (/hw/dev/) are sometimes created with a wrong set of permissions, making them open for everyone to read, and thus restore backed up files from a tape device, using a program called xfsrestore.
By exploiting a wrong set of permissions set on the tape devices on an IRIX system, a user can restore sensitive files such as the shadowed password file. All the user needs is to have read permission on a tape devices. When the user knows the administrator is going to backup the system's sensitive files (such as /etc/shadow) he can change his password to cause it to be backed up and then he simply has to restore the file (to his local directory) when the backup ends. Also, a malicious user can rewind a tape device while the system is backing up files, essentially distrusting the backup process.
