Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Well, there is a pretty logical explanation.

Libsystemd was moving to a dlopen architecture for its dependencies.

This means that the backdoor would not load as the sshd patch only used libsystemd for notify, which does not need liblzma at all.

So they IMHO gave it a last shot. It's OK if it burns as it would be useless in 3 months (or even less).

The collateral is the backdoor Binary, but given enough engineering power it will be irrelevant in 2-3 months, too.



I think this is probably the right answer.

The only thing that makes me think this was amateurs/criminals instead of professionals is that I tend to think that professionals are more interested in post attack security.

So if the gate was closing an amateur would say, "Act now! Let's get what we can!" A professional would say, "This is all going to come to light real soon - our exploit won't be read and there's a high chance of this all falling apart. Pull out everything, cover our tracks to the degree we can and find another opportunity to pull this off."

But then again I also think on professionals would work an exploit that takes years. Criminals by their nature want a quick payout (If I had the patience for a long con I'd just get a job) a motivated individual amateurs (i.e. crazy people) rarely have a wide enough skill set.


This particular backdoor might have become useless anyway, but control of liblzma would have continued to be very valuable. Not only is it used in so many places (the embedded version even in the kernel), it also is a common part of the toolchain used to build everything else allowing for trusting trust style attacks.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: