I am not a security expert, but the scenario they describe sounds exactly like authentication bypass to a layman like me.

According to https://www.youtube.com/watch?v=jqjtNDtbDNI the software installs a malicious library that overwrite the signature verification function of ssh.

I was wondering if the bypass function was designed to be slightly less resource intensive, it probably won't be discovered and will be shipped to production.

Also I have mixed feeling about dynamic linking, on the one hand, it allows projects like harden malloc to easily integrate into the system, on the other hand, it also enables the attacker to hijack the library in a similar fashion.

EDIT: This is a remote code execution exploit, not authentication bypass. The payload is sent as an authentication message and will be executed by the compromised authentication function.

This means:

• the payload will be executed as root, since sshd run as root.
• the payload will leave no trace in login log.

So this is much worse than ssh authentication bypass.