3 ms·
Another point relevant on the timeline is when downstream starts using binaries instead of source. I think people are flying past that important piece of the h
by sloowm 3y ago
Another point relevant on the timeline is when downstream starts using binaries instead of source.
I think people are flying past that important piece of the hack. Without that this would not have been possible. If there is a trusted source in the middle building the binaries instead of the single maintainer and the hacker this attack becomes extremely hard to slip by people.
- Denvercoder9 3y ago> Another point relevant on the timeline is when downstream starts using binaries instead of source. No downstream was using binaries instead of source. Debian and Fedora rebuild everything from source, they don't use the binaries supplied by the maintainer. The backdoor was inserted into the build system.
- testplzignore 3y agoI'm not familiar with how distros get the source code for upstream dependencies. I'm trying to understand what Andres meant when he said this: > One portion of the backdoor is solely in the distributed tarballs Is it that the tarball created and signed by Jia had the backdoor, but this backdoor wasn't present in the repo on github? And the Debian (or any distro) maintainers use the source code from tarball without comparing against what is in the public github repo? And how does that tarball get to Debian?
- Hackbraten 3y agoExactly. The threat actor had signed and uploaded the compromised source tarball to GitHub as a release artifact. They then applied for an NMU (non-maintainer upload) with Debian, which got accepted, and that's how the tarball ended up on Debian's infrastructure.
- sloowm 3y agoThanks for the extra explanation. I guess this is harder to protect against than I thought and it's more that some distro's got somewhat lucky than debian and fedora doing something that is out of the ordinary.
- ajoberstar 3y agoThat's not what happened. Downstream was building from source, that source just had malicious code in it. One part was binary, the test file (pretty common), but checked into the repo. One part was in the build config/script, but was in the source tarball and not in the repo.