Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kube-system on Friday March 29, 2024 @02:28PM (#39867394)

What's the salary for a software engineer in urban China? 60-80k/yr USD? Two years of that salary is cheaper than a good single shoulder fired missile. Seems like a pretty cheap attack vector to me. A Javelin is a quarter million per pop and they can only hit one target.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by acdha on Friday March 29, 2024 @06:10PM (#39869532)

Yeah, exactly - when your army is measured in the millions, picking n hundred with technical aptitude is basically a rounding error.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by alwayslikethis on Friday March 29, 2024 @08:14PM (#39870470)

They are paid much less than that. However, American weapons are also far overpriced due to high labor costs, among other things. The Chinese probably have cheaper weapons.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by catkitcourt on Sunday March 31, 2024 @08:20AM (#39883600)

Unless the payment is performed by foreign entity (which means a US employer is hiring a Chinese hacker), it's not a wise choice to do currency exchange when measuring salary, because it would erase other facts affecting salary, like CPI or housing price.

Apart from (both visible and invisible) taxes, I expect a senior programmer would earn ~500-700k CNY per year. Game programmers may reach up to 200k. For a team able to perform such attack, 1M/yr avg. might be reasonable.

But if this is not a state-sponsored attack, I can't find enough interest. And, if this is state-backed...contractor or some dishonest officials would a huge part, so the real cost might be >2M/yr. Considering you can get nothing during 2 year's lurking I doubt if it's feasible enough.

[ Parent | on HN ]