transcript
Screenshot of github showing part of the commit message of this commit with this text:
Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094).
While the backdoor was inactive (and thus harmless) without inserting
a small trigger code into the build system when the source package was
created, it's good to remove this anyway:
- The executable payloads were embedded as binary blobs in
the test files. This was a blatant violation of the
Debian Free Software Guidelines.
- On machines that see lots bots poking at the SSH port, the backdoor
noticeably increased CPU load, resulting in degraded user experience
and thus overwhelmingly negative user feedback.
- The maintainer who added the backdoor has disappeared.
- Backdoors are bad for security.
This reverts the following without making any other changes:
The sentence "This was a blatant violation of the Debian Free Software Guidelines" is highlighted.
Below the github screenshot is a frame of the 1998 film The Big Lebowski with the meme caption "What, are you a fucking park ranger now?" from the scene where that line was spoken.
A really good point I heard is: this was likely a state actor attack, so how many others just like this are out there, undiscovered?
Unpopular opinion: what if it was not a state actor and just some bored person somewhere that thought it would be cool to own a bot net?
What if this is just one of many backdoors and it’s just the only one we found?
Nobody is both that bored and that motivated. Unless paid.
You forget that a lot of brilliant open source projects are one man shows from geniuses somewhere around the world. They are usually not paid.
In the other hand, if you get your hands on a powerful botnet, you can rent out its services (like ddos for example) for quite a bit of money.