The xz sshd backdoor rabbithole goes quite a bit deeper
1–10 of 310 posts
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#2Luckily, thanks to Elon, we’ll never know since you haven’t have a Twitter account to view the thread.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#3Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#4The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#5Luckily, thanks to Elon, we’ll never know since you haven’t have a Twitter account to view the thread.
Change "twitter" to "twiiit" to get a random nitter instance:
https://twiiit.com/bl4sty/status/1776691497506623562
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#6The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."
> And it all got caught because of a fairly obvious perf regression
Always possible that was "parallel construction" evidence.
Someone at a TLA discovered the attack by some other means, had a quiet Signal chat with a former colleague who works at MS...
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#7The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."
Maybe I’m just being naive or too trusting, but this is sort of what I think when folks are getting worried about other backdoors like this in the wild.
Is it that they just got unlucky to get caught, or is this type of attack just too hard to pull off in practice?
I’d like to think the later. But, we really don’t know.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#8This is fantastic. Great work actually triggering the bug!
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#9[dead]
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#10[deleted]