• underisk@lemmy.ml
    link
    fedilink
    arrow-up
    28
    arrow-down
    1
    ·
    7 months ago

    I think ideas about prevention should be more concerned with the social engineering aspect of this attack. The code itself is certainly cleverly hidden, but any bad actor who gains the kind of access as Jia did could likely pull off something similar without duplicating their specific method or technique.

    • whereisk@lemmy.world
      link
      fedilink
      arrow-up
      13
      ·
      7 months ago

      Ideally you need a double-blind checking mechanism definitionally impervious to social engineering.

      That may be possible in larger projects but I doubt you can do much in where you have very few maintainers.

      I bet the lesson here for future attackers is: do not affect start-up time.

      • underisk@lemmy.ml
        link
        fedilink
        arrow-up
        9
        ·
        7 months ago

        I imagine if this attacker wasn’t in a rush to get the backdoor into the upcoming Debian and Fedora stable releases he would have been able to notice and correct the increased CPU usage tell and remain undetected.