Re: vsftpd download backdoored

[Matthias Andree <matthias.andree () gmx de>]

Am 05.07.2011 06:39, schrieb Solar Designer:

> More info on what's inside the tarball: user/group "user" (either the
> intruder's username on his/her computer or --owner and --group options
> argument to tar), "GCC: (Ubuntu/Linaro 4.5.2-8ubuntu4) 4.5.2" inside the
> .o files.  This suggests Ubuntu 11.04, right?

That's the tagline of "gcc --version" on my Ubuntu 11.04 system.

> BTW, what if the .o files _don't_ match the source code? ;-)  I think
> they might be used when one builds vsftpd from this tarball, which means
> that the build (or run) will fail on some older systems (yet another
> reason why this would be noticed quickly), but also that the actual
> backdoor might be different (and more sophisticated) from what we see in
> the source code.  No, I don't think this is the case, but the
> possibility is there, and I find it curious.
>
> A trivial way to check for this would be to try compiling the source
> code on Ubuntu 11.04 and see if the .o files match.  If not, the
> differences will need to be analyzed manually.  Not that anyone cares...

And you'd need to know the compiler options, flipping one optimization
manually is sufficient to make the .o files mismatch.

However the backdoored tarball apparently got removed from the listed
server (404 error), but I'm not interested in hunting one down.