3 ms·
A creapy exploit...” the Webmin source code had been maliciously modified to add a non-obvious vulnerability’ question: how is or was the proces for commiting t
by runningmike 7y ago
A creapy exploit...” the Webmin source code had been maliciously modified to add a non-obvious vulnerability’ question: how is or was the proces for commiting the malicious pull request in July 2018 orgazized?
- tecleandor 7y agoSeems like there was no commit. Instead of commiting code, 'they' hacked the build server somehow, and modified files on a synced directory Webmin used for building its packages.
- mistrial9 7y agodoesn't git hold a checksum for all files changed in a change-set ?
- kontorlaore 7y agoAs an optimization git doesn't check files with an "old" date. Running git status in an 1 GB checkout directory will return instantly. Do you really believe it has hashed all those files?
- structural 7y agoThat doesn't stop you from changing something in your working copy. The hack here is that the working copy used to build from wasn't a clean clone on each build, so just fetching changes from the (un-pwned) github repository would apply those changes and not affect the modified file on the build server.