XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tejohnso on Saturday March 30, 2024 @06:43PM (#39879407)

> possible even some arm of the U.S. govt.

Possible. But why mention U.S. specifically? Is it more likely than Russia, Iran, China, France ... ?

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by pcthrowaway on Saturday March 30, 2024 @06:51PM (#39879463)

> This individual/organization needs to be on the top of every country's most wanted lists

Because if the "organization" is a U.S. agency, not much is going to happen here. Russia or China or North Korea might make some strongly worded statements, but nothing is going to happen.

It's also very possible that security researchers won't be able to find out, and government agencies will finger-point as a means of misdirection.

For example, a statement comes out in a month that this was North Korea. Was it really? Or are they just a convenient scapegoat so the NSA doesn't have to play defense on its lack of accountability again?

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by mardifoufs on Saturday March 30, 2024 @06:45PM (#39879425)

The US is behind more documented backdoors than those other countries.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by EasyMark on Saturday March 30, 2024 @08:31PM (#39880135)

Highly likely, China has been estimated to have cyberhacking resources that are 10-50x what the USA has currently. It's not even close. The USA will have to up it's game soon or accept China being able to shut down large swathes of the grid and critical infrastructure at will

[ Parent | on HN ]