Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl...
by bandrami on Sunday March 31, 2024 @01:39AM
(#39881738)
> If the prior is 1
That would surprise me greatly
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl...
by lazyasciiart on Sunday March 31, 2024 @04:59AM
(#39882605)
I think you’re saying “I would be surprised if there is only 1 exploit like this that already exists” which is what the previous comment was also saying. “If the prior is one” is often used to mean “we know for sure that there is one”.
If the prior is 1 was out there (this one), the chances that there is 1+ still undetected seems fairly high to me.
To behaviourally detect this requires many independent actors to be looking in independent ways(e.g. security researchers, internal teams). Edit: I mean with private code & tests (not open source, nor purchasable antivirus). It's not easy to donate to Google Zero. Some of the best funded and most skilled teams seem to be antivirus vendors (and high value person protection). I hate the antivirus industry yet I've been helped by it (the anti-tragedy of the commons).
Commonly public detection code (e.g. open source) is likely to be defeated by attackers with a lot of resources.
Hard to protect ourselves against countries where the individuals are safe from prosecution. Even nefarious means like assasination likely only work against individuals and not teams.