4 ms·
> Maybe this attacker got sloppy this attacker did not get sloppy, they got control of a critical piece of free software, and got a still-not-fully-understood
by bananapub 3y ago
> Maybe this attacker got sloppy
this attacker did not get sloppy, they got control of a critical piece of free software, and got a still-not-fully-understood piece of malware in to, past whatever peer review we like to imagine we have, then got it uploaded into at least two critical linux distributions, past whatever peer review we like to imagine we have, and was only found, two years in to the operation, by pure luck and a very dedicated engineer.
- asveikau 3y agoIt was actually found less than two months after it was introduced in 5.6.0. Now, the attacker maintained the project for 2 years before that, and we don't know what else they inserted, but the known vulnerability was only in a release since February.
- account42 3y agoThey did get sloppy though - the injected code slows down sshd startup enough that someone noticed and investigated. This could have been avoided.