Irssi configure script backdoored

In March 2002, irssi.org was cracked and irssi-0.8.4.tar.gz was altered through its configure script. Only that one file was hit: the project's advisory records that the .tar.bz2 of the same release, CVS, the nightly snapshots, the Debian sources and every binary were clean, which is why the FreeBSD port escaped by fetching the bzip2 archive. For roughly two months, users building from the official source archive could execute attacker-added C code before they ever ran the IRC client. GLib sources fetched from irssi.org during the build carried the same block, so the reach was not limited to Irssi's own code. The project disclosed the compromise on May 25.

The delivery point was the build system. The archive still looked like Irssi source, but configure carried the hostile logic. That made the user's normal compile step the execution point, before package install, service startup, or IRC traffic.

The injected code looked like a small autoconf test, but it forked, opened a TCP connection to 204.120.36.206 on port 6667, and duped standard input, output, and error to that socket. The practical detection advice was equally direct: grep the source tree for SOCK_STREAM in configure, replace the source, and verify future releases with the author's GPG key.

The cleanup question was therefore about provenance, not configuration. Anyone who built Irssi 0.8.4 from the affected source window had to treat the build host as exposed, even if the installed IRC client itself looked normal or had never connected to a server.