4 ms·
Without having a Twitter account I have a really hard time following these threads. Is there some write up? Edit : Check comments. Yes, the backdoor hasn't be
by bilekas 3y ago
Without having a Twitter account I have a really hard time following these threads. Is there some write up?
Edit : Check comments.
Yes, the backdoor hasn't been decompiled/reverse engineered yet. But it feels like clickbait to say : "It goes deeper"... Obviously. Nobody knows what it fully does yet. There was no assumption of knowing what it did.
- aeyes 3y agoShort summary is that it allows auth bypass, not just RCE.
- bilekas 3y agoYes, I understand.. It's just not a surprise.
- ckcheng 3y agoIt was surprising because previously we had: 'XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."' [0]. [0]: https://news.ycombinator.com/item?id=39877267 https://news.ycombinator.com/item?id=39877267 (811 comments)
- bilekas 3y agoDid you understand the XZ backdoor before the rest of us ? We will figure it out. With all of our stubborn ways, we can document it. Clap
- mr_mitm 3y agoRCE as root is already the worst case though. The auth bypass is basically just a convenience feature of the backdoor. So yeah it's mildly interesting but not really a new development of the story.
- deleted 3y ago[deleted]