3 ms·
What I’d like to understand is it’s proven intentional? My understanding is it was a few added characters in a header file. I can’t tell you the number of time
by lettergram 3y ago
What I’d like to understand is it’s proven intentional?
My understanding is it was a few added characters in a header file. I can’t tell you the number of times I was tired and clicked an extra key before committing, or my cat walked across the keyboard while I was out of the room.
- userbinator 3y agoThat level of sophistication is certainly intentional.
- lettergram 3y agoThat’s not an explanation about exactly how intention was derived. I suppose I’m asking for the chain of events that led to the conclusion. I see lots of technical hot takes for how something could work, with no validation it does, nor intent behind it. I’d like to understand what steps we know were taken and how that presents itself.
- willbush 3y agoI think you're probably missing a lot context about the situation. Here's some useful links https://x0f.org/@FreePietje/112187047353892463 https://x0f.org/@FreePietje/112187047353892463 also https://gynvael.coldwind.pl/?lang=en&id=782 https://gynvael.coldwind.pl/?lang=en&id=782
- lettergram 3y agoAppreciate, that’s the context I was looking for
- adtac 3y agoIt was a few added characters in a header file to make it possible to deliver the actual payload: 80+ kilobytes of machine code. There's no way to actually tell, but I'd estimate the malware source code to be O(10000) lines in C. It's actually pretty sophisticated. You don't accidentally write a in-memory ELF program header parser.
- kortilla 3y agoYou should read up on the attack. The few characters were part of avoiding a specific case of detection. The back door is very large, is only added during tar build, and happens to only work when a special key is presented.