4 ms·
It does make me wonder if something else was changed and this was what they wanted you to notice (as a diversion).
by stordoff 6y ago
It does make me wonder if something else was changed and this was what they wanted you to notice (as a diversion).
- lioeters 6y agoI think that's a good point. Apparently they had the ability to make commits as any user, which was a huge opportunity. Then they waste it on such an obvious backdoor? It does seem possible that this was a diversion tactic. Edit: Elsewhere someone mentioned, this could have been "marketing" - to demonstrate their ability to take over accounts.
- orangepanda 6y ago> this could have been "marketing" - to demonstrate their ability to take over accounts. Hot take - They burned it, in a very visible way, to prove they've had access since 2017 (or whatever the investigation will reveal). A full security audit isnt very feasible. Would force everyone to either downgrade and face known vulnerabilities, or do nothing and face high-risk unknown vulnerabilities.