Hacker News new | ask | show | jobs
by ghostpepper 817 days ago
How would this be possible? This backdoor works because lzma is loaded into sshd (by a roundabout method involving systemd). I don't think gcc or clang links lzma.
5 comments

When the backdoor is loaded by sshd it could modify the gcc/clang install, or some system header file.
dpkg-deb is linked with liblzma
To be fair neither does sshd. But I'm sure someone somewhere has a good reason for gcc to write status via journald or something like that? There's however no reason to limit yourself to gcc for a supply chain attack like this.

In any non trivial build system, there's going to be lots of third party things involved. Especially when you include tests in the build. Is Python invoked somewhere along the build chain? That's like a dozen libraries loaded already.

Nothing is gained from protecting against an exact replica of this attack, but from this family of attacks.

the installation process itself executes xz scripts which can make any (?) modifications to the system
servers hosting gcc binaries are accessed using ssh