News for hackers. Stuff that matters.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by acdha on Friday March 29, 2024 @01:45PM (#39866911)
This does make me wonder how much they made a deliberate effort to build an open source portfolio so they’d look more legitimate when time came to mount an attack. It seems expensive but it’s probably not really much at the scale of an intelligence agency.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kube-system on Friday March 29, 2024 @02:28PM (#39867394)
What's the salary for a software engineer in urban China? 60-80k/yr USD? Two years of that salary is cheaper than a good single shoulder fired missile. Seems like a pretty cheap attack vector to me. A Javelin is a quarter million per pop and they can only hit one target.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by acdha on Friday March 29, 2024 @06:10PM (#39869532)
Yeah, exactly - when your army is measured in the millions, picking n hundred with technical aptitude is basically a rounding error.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by alwayslikethis on Friday March 29, 2024 @08:14PM (#39870470)
They are paid much less than that. However, American weapons are also far overpriced due to high labor costs, among other things. The Chinese probably have cheaper weapons.
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by catkitcourt on Sunday March 31, 2024 @08:20AM (#39883600)
Unless the payment is performed by foreign entity (which means a US employer is hiring a Chinese hacker), it's not a wise choice to do currency exchange when measuring salary, because it would erase other facts affecting salary, like CPI or housing price.

Apart from (both visible and invisible) taxes, I expect a senior programmer would earn ~500-700k CNY per year. Game programmers may reach up to 200k. For a team able to perform such attack, 1M/yr avg. might be reasonable.

But if this is not a state-sponsored attack, I can't find enough interest. And, if this is state-backed...contractor or some dishonest officials would a huge part, so the real cost might be >2M/yr. Considering you can get nothing during 2 year's lurking I doubt if it's feasible enough.

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bombcar on Friday March 29, 2024 @02:00PM (#39867081)
If I were doing it, I'd have a number of these "burner committers" ready to go when needed.

If I were doing it AND amoral, I'd also be willing to find and compromise committers in various ways.