Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd...
by CommitSyn on Monday April 01, 2024 @11:38PM
(#39902150)
Is it possible it was part of a planned or current exploit chain, some other way it could have been utilized?
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd...
by wholinator2 on Tuesday April 02, 2024 @06:36AM
(#39904191)
Yes, i think one thing we should learn from this is that suspicious code is suspicious code, and anyone asserting that some suspicious code cannot be exploited is suspicious themselves. I don't think we should inquisition half the industry, but i do think people should be a lot more careful about saying that one small exploitable thing definitely cannot be part of a larger exploit.
It's obvious, basically no one knows what's going on in the _vast_ majority of code running out systems these days. And even if you know 99% the attackers only need to be right once
(a) not exploitable without the existence of a much higher-severity exploit -- sure you can clear the screen, but that's low impact
(b) possible to trigger on other extant paths; see https://github.com/libarchive/libarchive/issues/2107 so it seems nothing new was introduced
(c) kind of contrived to get to execute; you have to somehow fail to extract the archive but on the happy path you'll see a bunch of weirdly-named files
I think it's distinctly higher-probability that this change was just meant to build credibility for the GitHub account. The diff is a fairly trivial patch to a minor issue filed around the same time as the pull request.