News for hackers. Stuff that matters.

A comment on The xz attack shell script. Parent comment

Re:The xz attack shell script by edflsafoiewq on Tuesday April 02, 2024 @10:05PM (#39912890)
The malicious .o is extracted from data in binary test files, but the backdoor is inserted entirely in the build phase. Running any test phase is not necessary.
[ Parent | on HN ]
Re:The xz attack shell script by rafaelmn on Wednesday April 03, 2024 @10:23AM (#39917917)
So if you ran build without test files it would fail. I get that this is hindsight thinking - but maybe removing all non essential files when packaging/building libraries reduces the surface area.
[ Parent | on HN ]