Example of a backdoor submitted to an open source project? [closed]

Question

To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.

I'm researching some source modeling techniques, and we're interested in seeing if exploits or malicious code can be identified. We're using git and subversion histories to examine how a model snapshot captures relationships between the code. There is a question about whether certain types of code appear as outliers in an environment like this.

With that in mind, I'm having a hard time finding instances of a git/cvs/? open source repository with an example of a changelist that contained a backdoor, and was submitted and will show up in the logs.

We were looking at proftpd as an early example, but this exploit wasn't checked in but rather modified other versions of the code.

Are there examples in the revision history of an open source project of attempts to insert backdoor code?

Thanks, Scott

Answer 1

https://freedom-to-tinker.com/blog/felten/linux-backdoor-attempt-thwarted

There was also an attempt to compromise the source repository to inject new code but have the version control system think it had been there for some time (and so was trusted). One of the requirements of Git is that it has strong crypto checking of the repository with each new checkin.