Poisoned Pipeline / Incidents / AS225

AS225 · 1994-05

ircII source installed account backdoor

Linux distro / packages

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0172 Runtime backdoor
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://stuff.mit.edu/afs/athena.mit.edu/astaff/reference/cert/Advisories/CA-94:14.trojan.horse.in.IRC.client.for.UNIX
• https://www.sei.cmu.edu/documents/2339/1995_001_001_83550.pdf
• https://www.irchelp.org/security/irc-backdoor.txt
• https://www.neperos.com/article/q38ic72d5f3aa2f1
• https://seclists.org/bugtraq/1994/Oct/151
• https://seclists.org/bugtraq/1994/Oct/154