2 ms·
I guess it seems like the operational parts are a bit poorly done. Valgrind issues, adding a new version with symbols removed, the aforementioned performance is
by bawolff 3y ago
I guess it seems like the operational parts are a bit poorly done. Valgrind issues, adding a new version with symbols removed, the aforementioned performance issues. Like i would assume the type of person who would do this sort of thing, over a 2 year period no less, would test extensively and be sure all their i's are dotted. Its all kind of surprising given how audacious the attack is.
- dist-epoch 3y agoThere are so many variations of Linux/FreeBSD and weird setups and environments that it's almost guaranteed that you'll hit a snag somewhere if you do any major modification like inserting a backdoor.
- bombcar 3y agoIt's hard enough to get code to work correctly; getting it to be also doing something else is even harder. The way they went around it, however, was brilliant. Completely reduce the variables to directly target whatever it is you're attacking. Reminds me of stuxnet somewhat.
- SkiFire13 3y agoNote that in this case the backdoor was only inserted in some tarballs and enabled itself only when building deb/rpm packages for x86-64 linux and with gcc and the gnu linker. This should already filter out the most exotic setups and makes it harder to reproduce.
- 1oooqooq 3y agothe point we got, when even exploits have to rely on user agent string sniffing. reminds me of the gnu hack discovered because one of the savannah build hosts was some odd architecture the exploit wasn't expecting
- rdtsc 3y agoBut they almost got away with it. We could have found ourselves 5 years later with this code in all stable distribution versions, IoT devices etc. Also, we only catch the ones that we ... catch. The ones that do everything perfectly, unless they come out and confess eventually, we don't get to "praise" them for their impeccable work.