News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by rdtsc on Friday March 29, 2024 @05:57PM (#39869440)
I got the same idea. On XZ dev mailing list there were a few discussions about "is there a maintainer?" 2-3 years ago. It's not hard to find these types discussions and then dedicate a few years of effort to start "helping out" and eventually be the one signing releases for the project. That's peanuts for a state actor.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by throwaway384638 on Friday March 29, 2024 @07:01PM (#39869967)
This right here. This is exactly what I would be doing - find small broke maintainers offer them a few hundred grand - with a target in mind.
[ Parent | on HN ]