XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by saagarjha on Sunday March 31, 2024 @12:55AM (#39881559)

This is an arms race that is largely won by attackers, actually. Sophisticated attacks are caught by them sometimes but usually the author has far more knowledge or cleverer tricks than the person implementing the checks, who is limited by their imagination of what they think an attacker might do.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by wepple on Sunday March 31, 2024 @08:33PM (#39889626)

I’m not sure that attackers “win” this arms race; the cost has gone through the roof and their chance of detection constantly increases.

Indeed, defenders are often outgunned, but at a minimum we’ve pushed the level of effort way into nation-state territory, which is a good start.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by saagarjha on Monday April 01, 2024 @08:29PM (#39901067)

Indeed. But a lot of the effort has come from measures in areas that are much more stacked towards defenders (as it should).

[ Parent | on HN ]