3 ms·
The questions this backdoor raises: - what other ones exist by this same team or similar teams? - how many such teams are operating? - how many such dependen
by sneak 3y ago
The questions this backdoor raises:
- what other ones exist by this same team or similar teams?
- how many such teams are operating?
- how many such dependencies are vulnerable to such infiltration attacks? what is our industry’s attack surface for such covert operations?
I think making a graph of all major network services (apache httpd, postgres, mysql, nginx, openssh, dropbear ssh, haproxy, varnish, caddy, squid, postfix, etc) and all of their dependencies and all of the committers to all of those dependencies might be the first step in seeing which parts are the most high value and have attracted the least scrutiny.
This can’t be the first time someone attempted this - this is just the first unsuccessful time. (Yes, I know about the attempted/discovered backdoor in the linux kernel - this is remote and is a horse of a different color).
- almostnormal 3y agoWhy did they decide to create a backdoor, instead of using a zeroday like everyone else? Why did they implement a fully-featured backdoor and attempted to hide the way it is deployed, instead of deploying something innocent-looking that might as well be a bug if detected? These must have been conscious decisions. The reasons might provide a hint what the goals might have been.
- formerly_proven 3y agoEd448 is orders of magnitude better NOBUS than hoping that nobody else stumbles over the zero-day you found.
- Ekaros 3y agoIf they seemingly almost succeeded how many others have already done similar backdoor? Or was this actually just poking on things seeing if it was possible to inject this sort of behaviour?
- bdd8f1df777b 3y agoPresumably because other people can also utilize the “bug” they create intentionally but looking inadvertently. This backdoor however is activated by the private key only the attacker has so it’s airtight.
- im3w1l 3y agoWild guess, but it could be that whoever was behind this was highly motivated but didn't have the skill required to find zerodays and didn't have the connections required to buy them (and distrusted the come one come all marketplaces I assume must exist).
- mdavidn 3y agoAlso: Why did Debian patch a service that runs as root and accepts connections from the internet to load unnecessary libraries?
- account42 3y agoAlso: Why did Debian apply patches to a service that runs as root (when those patches have been rected upstream) for a second time after such behavior has already led to a widely known vulnerability in Debian.