3 ms·

One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane techni

One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane technical details. This may be confirmed by regular vulnerabilities that are found in sometimes many decades old software, since vulnerabilities are much harder to find than backdoors. For example shellshock was 30 year old code, PwnKit 12 and log4j was ~10 ish. So if backdoors were commonplace, we probably would've found more by now. Perhaps that's changing now, the xz backdoor will for sure attract many copycats.

sjs382 3y ago
> Over time there is quite a large accumulation of hackers looking at the most mundane technical details. Are there though? Even if true, there are probably enough places with very few eyes on them.
- almostnormal 3y ago
  Maybe something could be built to put more eyeballs on things. A kind of online-tool that collects the sources to build some relevant distributions, a web front-end to show a random piece of code (filtered by language, probability to show inreasing by less-recently/frequently/qualified viewed) to a volunteering visitor to review. The reviewer leaves a self assesment about their own skills (feed back into selection probability) and any potential findings. Tool-staff double-checks findings (so that the tool does not create too much noise) and forwards to the original authors (bugs) or elsewhere (backdoors). A bit like wikipedias show random page.
cjbprime 3y ago
Doesn't your data prove the opposite point? There are so many vulnerabilities and so few people looking for them that even the thirty year old ones have barely been found. A healthy feedback loop would have trended the average age of each vulnerability at the time of detection to be *short".
- formerly_proven 3y ago
  Most backdoors that are found are really obvious garbage. Like hardcoded credentials or keys in appliances.
  - brokenmachine 3y ago
    This also had hardcoded credentials, just quite well obfuscated. So I learned yesterday what a Trie is. https://en.wikipedia.org/wiki/Trie https://en.wikipedia.org/wiki/Trie
hinkley 3y ago
I’m not convinced that if I found a bug that I’d notice all the security implications of fixing it. Occasionally yes, but I wonder how many people have closed back doors just by fixing robustness issues and not appreciated how big of a bug they found.
- beeboobaa3 3y ago
  Sure, but this xz backdoor is far, far more involved than that.

sjs382 3y ago

> Over time there is quite a large accumulation of hackers looking at the most mundane technical details. Are there though? Even if true, there are probably enough places with very few eyes on them.

almostnormal 3y ago
Maybe something could be built to put more eyeballs on things. A kind of online-tool that collects the sources to build some relevant distributions, a web front-end to show a random piece of code (filtered by language, probability to show inreasing by less-recently/frequently/qualified viewed) to a volunteering visitor to review. The reviewer leaves a self assesment about their own skills (feed back into selection probability) and any potential findings. Tool-staff double-checks findings (so that the tool does not create too much noise) and forwards to the original authors (bugs) or elsewhere (backdoors). A bit like wikipedias show random page.

cjbprime 3y ago

Doesn't your data prove the opposite point? There are so many vulnerabilities and so few people looking for them that even the thirty year old ones have barely been found. A healthy feedback loop would have trended the average age of each vulnerability at the time of detection to be *short".

formerly_proven 3y ago
Most backdoors that are found are really obvious garbage. Like hardcoded credentials or keys in appliances.
- brokenmachine 3y ago
  This also had hardcoded credentials, just quite well obfuscated. So I learned yesterday what a Trie is. https://en.wikipedia.org/wiki/Trie https://en.wikipedia.org/wiki/Trie

hinkley 3y ago

I’m not convinced that if I found a bug that I’d notice all the security implications of fixing it. Occasionally yes, but I wonder how many people have closed back doors just by fixing robustness issues and not appreciated how big of a bug they found.

beeboobaa3 3y ago
Sure, but this xz backdoor is far, far more involved than that.