News for hackers. Stuff that matters.

A comment on What we know about the xz Utils backdoor that almost infected the world. Parent comment

Re:What we know about the xz Utils backdoor that almost infe... by jcranmer on Monday April 01, 2024 @12:08PM (#39895707)
It means the libraries are only loaded when they are needed, so if you never use the (e.g.) xz compression feature, the xz library will not be loaded, and a backdoor added in the xz library simply can't trigger.

(Another side note is this may change the initialization order of libraries--so the initialization functions of an xz library don't run until xz is first used, and this may fail to let you intercept the ssh routines in time.)

[ Parent | on HN ]
Re:What we know about the xz Utils backdoor that almost infe... by account42 on Tuesday April 09, 2024 @04:54AM (#39977491)
> this may fail to let you intercept the ssh routines in time

It only makes it harder since you can always patch the code of the entire process at runtime (remapping things writable as needed).

[ Parent | on HN ]