News for hackers. Stuff that matters.

A comment on Webmin 1.890 Exploit – What Happened?. Parent comment

Re:Webmin 1.890 Exploit – What Happened? by tecleandor on Sunday August 25, 2019 @03:55PM (#20795111)
Seems like there was no commit. Instead of commiting code, 'they' hacked the build server somehow, and modified files on a synced directory Webmin used for building its packages.
[ Parent | on HN ]
Re:Webmin 1.890 Exploit – What Happened? by mistrial9 on Sunday August 25, 2019 @03:58PM (#20795138)
doesn't git hold a checksum for all files changed in a change-set ?
[ Parent | on HN ]
Re:Webmin 1.890 Exploit – What Happened? by kontorlaore on Sunday August 25, 2019 @04:21PM (#20795314)
As an optimization git doesn't check files with an "old" date.

Running git status in an 1 GB checkout directory will return instantly. Do you really believe it has hashed all those files?

[ Parent | on HN ]
Re:Webmin 1.890 Exploit – What Happened? by structural on Sunday August 25, 2019 @04:24PM (#20795330)
That doesn't stop you from changing something in your working copy.

The hack here is that the working copy used to build from wasn't a clean clone on each build, so just fetching changes from the (un-pwned) github repository would apply those changes and not affect the modified file on the build server.

[ Parent | on HN ]