XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by Ekaros on Saturday March 30, 2024 @07:12PM (#39879567)

Or very untargeted. Something intended just to lay dormant by chance if succeeded...

It is very good backdoor to have if you at whatever time have dozens of options. See sshd running, test this you are done if it works, if not move to something else.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by dools on Saturday March 30, 2024 @07:27PM (#39879656)

Or targeted not really at doing anything but at researching the nature of supply chain vulnerabilities themselves.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by takeda on Saturday March 30, 2024 @10:07PM (#39880686)

This doesn't look like a research.

This looks like state sponsored attack. Imagine having a backdoor that you can just go to any Linux server and with your key you can make it execute any code you wish without any audit trail. And no one without the key can do it, so even if your citizens use such vulnerable system other states won't be able to use your backdoor.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by cjbprime on Sunday March 31, 2024 @12:53AM (#39881547)

Spending two years actually maintaining an open source project that you will later backdoor is a very expensive way to perform such research.

[ Parent | on HN ]