2 ms·
The attack you describe is plausible but very visible (your backdoor code will be visible on the package manager and generally not easy to take down). I doubt i
by rcxdude 6y ago
The attack you describe is plausible but very visible (your backdoor code will be visible on the package manager and generally not easy to take down). I doubt it's the kind of thing that is likely to be used as part of this kind of attack, which wants to remain invisible for as long as possible.
- thu2111 6y agoYou just have to make it look like a plausible error. There are enough ways to construct accidental RCE bugs in most languages that it's not an issue. And let's face it, how many people are reverse engineering compiled binaries on repos to look for back doors? It doesn't matter if it gets detected a year later when people go looking, as by then it's achieved its purpose already.