Both https://github.com/tukaani-project members accounts have been suspended.
(to see that, you can list the followers of each account).
Backdoor in upstream xz/liblzma leading to SSH server compromise
431–440 of 1001 posts
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#432Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…
Github accounts of both xz maintainers have been suspended.
Not true, the original author wasn't suspended: https://github.com/Larhzu
https://github.com/JiaT75 was suspended for a moment, but isn't anymore?
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#433Yikes! Do you have any info on the individual's background or possible motivations?
I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it co…
Given the details from another comment [1], it sounds like both maintainers are suspicious. Lasse's behavior has changed recently, and he's been pushing to get Jia Tan's changes into the Linux kernel. It's possible both accounts aren't even run by the original Lasse Collin and Jia Tan anymore.
Edit: Also, Github has suspended both accounts. Perhaps they know something we don't.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#434Earlier quoted context omitted.
Github accounts of both xz maintainers have been suspended.
Not true, the original author wasn't suspended: https://github.com/Larhzu https://github.com/JiaT75 was suspended for a moment, but isn't anymore?
Both are suspended for me. Check followers on both accounts, both have a suspended pill right next to their names.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#435Another interesting data point: about 2 years ago there was a clear pressure campaign to name a new maintainer: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... At the time I thought it was just rude, but maybe this is when it all started.
Wow, people suck. I almost hope it's fake profiles urging the maintainer to take on a new member as a long con. Because I sincerely hope Jigar Kumar is not a real person behaving like that towards volunteers working for free.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#436Earlier quoted context omitted.
I've analysed the backdoor myself and it's very sophisticated, not poorly made at all. The performance problem is surprising in this context, but I think next time they won't make that mistake.
I guess it seems like the operational parts are a bit poorly done. Valgrind issues, adding a new version with symbols removed, the aforementioned performance issues. Like i would assume the type of person who would do this sort of thing, over a 2 year period no less, would test extensively and be sure all their i's are dotted. Its all kind of surprising given how audacious the attack is.
But they almost got away with it. We could have found ourselves 5 years later with this code in all stable distribution versions, IoT devices etc.
Also, we only catch the ones that we ... catch. The ones that do everything perfectly, unless they come out and confess eventually, we don't get to "praise" them for their impeccable work.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#437> openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma. The systemd notification protocol could have been as simple as just writing a newline to a pipe, but instead you have to link to the libsystemd C library, so now security-critical daemons like openssh have additional dependencies like liblzma loaded…
One of the objections that many people do not understand, is that systemd adds complexity. Unnecessary complexity. Boats full, loads full, mountains full of complexity. Yes, there are things delivered with that complexity. However, as an example, sysvinit is maybe, oh, 20k lines of code including binaries, heck including all core init scripts. What's systemd? 2M lines? It was >1M lines 4+ years ago. For an init syste…
> One of the objections that many people do not understand, is that systemd adds complexity. Unnecessary complexity. Boats full, loads full, mountains full of complexity.
Complexity that would otherwise be distributed to a sea of ad-hoc shell scripts? systemd is a win
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#438Another interesting data point: about 2 years ago there was a clear pressure campaign to name a new maintainer: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... At the time I thought it was just rude, but maybe this is when it all started.
[deleted]
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#439Wait, I'm on mobile. Did this partially slip by because of the ABSURD PRACTICE of publishing release.tarballs that do not 1:1 correspond with source? Let me guess, autotools? I want to rage shit post but I guess I'll wait for confirmation first. EDIT: YUP, AT LEAST PARTIALLY. Fucking god damn autotools.
[deleted]
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#440Earlier quoted context omitted.
So many malicious actors have been caught because they accidentally created a mild annoyance for someone that went on to bird-dog the problem.
Which is why a really good backdoor is a one line logic bug somewhere which is fiendishly difficult to trigger.
Like the 2003 Linux kernel attempt https://lwn.net/Articles/57135/