4 ms·
Must be punching the air right now
by Alifatisk 3y ago
Must be punching the air right now
- cellis 3y agoOr...falling back on less noticed contingency plans...
- Ekaros 3y agoMy pet theory is that this was just one project they have been running for years. They are likely doing many more at same time. Slowly inserting parts in various projects and getting their contributors inside the projects.
- 0cf8612b2e1e 3y agoThat seems like a safe bet. If you are planning a multi year operation, it would be silly to do it all under a single account. Best to minimize the blast radius if any single exploit gets discovered.
- guyomes 3y agoSome of this activity was actually documented through the alleged data breach of a hacking company [1]. [1]: https://en.wikipedia.org/wiki/Hacking_Team https://en.wikipedia.org/wiki/Hacking_Team
- SAI_Peregrinus 3y agoIf it's an intelligence agency exploit, this is nearly certain. Getting agents hired as employees of foreign companies to provide intelligence is an ancient practice. Getting agents to be open source maintainers is a continuation of the same thing.
- noobermin 3y agoOr, they must be strapped into a chair having teeth being pulled out by whoever directed them.
- int_19h 3y agoWhy would they be? You don't get far with this kind of approach to valuable skilled human resources.
- TechDebtDevin 3y agoLikely a team of people at a three letter agency.
- morkalork 3y agoI wonder if they have OKRs too.
- TheBlight 3y agoEveryone keeps saying this but it seems unlikely to me that they'd do this for a relatively short window of opportunity and leave their methods for all to see.
- avidiax 3y agoYou are judging this by the outcome, as though it were pre-ordained, and also assuming that this is the only method this agency has. It is much more likely that this backdoor would have gone unnoticed for months or years. The access this backdoor provides would be used only once per system, to install other APT (advanced persistent threats), probably layers of them. Use a typical software RAT or rootkit as the first layer. If that is discovered, fallback to the private keys you stole, or the social engineer the company directory you copied. If that fails, rely on the firmware rootkit that only runs if it's timer hasn't been reset in 6 months. Failing that, re-use this backdoor if it's still available.
- TheBlight 3y agoIt was found in a few weeks so why is it more likely it wouldn't have been noticed for months/years with more people running the backdoored version of the code?
- ufo 3y agoWe were lucky that the backdoor called attention to itself, because it impacted the performance off ssh and introduced valgrind warnings.