News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by formerly_proven on Saturday March 30, 2024 @06:20PM (#39879237)
Which strongly suggests that they planned and/or executed more backdoors via Jia Tan’s access.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by pja on Saturday March 30, 2024 @06:40PM (#39879382)
I guess xzdec was supposed to sandbox itself where possible so they disabled the sandbox feature check in the build system so that future payload exploits passed to xzdec wouldn’t have to escape the sandbox in order to do anything useful?

Sneaky.

[ Parent | on HN ]