Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by gamer191 on Friday March 29, 2024 @10:13PM (#39871214)

> That's quite backwards. Governments are far more likely to deploy a complex attack against a single target (see also: Stuxnet); other attackers (motivated primarily by money) are far more likely to cast a wide net.

Governments are well known to keep vulnerabilities hidden (see EternalBlue). Intentionally introducing a vulnerability doesn’t seem that backwards tbh

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Repulsion9513 on Saturday March 30, 2024 @01:38AM (#39872135)

Oh for sure. I'm not suggesting that this wasn't a government actor, although I'd only give you 50/50 odds on it myself. It coulda just been someone with a bunch of time, like phreakers of old.

[ Parent | on HN ]