News for hackers. Stuff that matters.

A comment on Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094). Parent comment

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by webmaven on Monday April 01, 2024 @02:24PM (#39897373)
Was the performance issue pure luck? Or was it a subtle bit of sabotage by someone inside the attacking group worried about the implications of the capability?

If it had been successfully and secretly deployed, this is the sort of thing that could make your leaders much more comfortable with starting a "limited war".

There are shades of "Setec Astronomy" here.

[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by papascrubs on Monday April 01, 2024 @07:44PM (#39900755)
Plot twist:

It was a psyop to increase the scrutiny around OSS components.

Kidding. Mostly...

But given the amount of scrutiny folks are going to start putting into some supply chains... Probably cheaper to execute than most company's annual security awareness budgets cost.

[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by neodymiumphish on Monday April 01, 2024 @09:09PM (#39901291)
Considering how difficult it might be (and identifiable) to attempt direct exploitation of this without being sure your target is vulnerable, it’s plausible the performance issue allowed for an identifiable delay in attempts. This might be useful in determining whether to attempt the exploit, with an auto-skip if it received a response in less than N milliseconds.
[ Parent | on HN ]