now I wonder which browsers link liblzma?
Backdoor in upstream xz/liblzma leading to SSH server compromise
731–740 of 1001 posts
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#732I wonder which browsers link liblzma and can this lead to https eavesdropping?
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#733The terrifying part is that this was primarily found because the backdoor was poorly made and causing performance problems. Makes you wonder what more competent actors can do.
You must mean, "Makes you wonder what more competent actors are doing"
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#734Funny how Lasse Collin started to ccing himself and Jia Tan from 2024-03-20 (that was a day of tons of xz kernel patches), he never did that before. :) https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co...
"started to cc himself" seems to be simply "contributing to a new project and not having git-send-email fully set up". By default git-send-email Cc the sender, though in practice it's one of the first options one changes.
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#735I've long since said that if you want to hide something nefarious you'd do that in the GNU autoconf soup (and not in "curl | sh" scripts). Would be interesting to see what's going on here; the person who did the releases has done previous releases too (are they affected?) And has commits going back to 2022 – relatively recent, but not that recent. Many are real commits with real changes, and they have commits on some…
Pure speculation but my guess is a specific state actor ahem is looking for developers innocently working with open source to then strongarm them into doing stuff like this.
many people are patriots of their countries. if state agency would approach them proposing to have paid OSS work and help their country to fight terrorism/dictatorships/capitalists/whatever-they-believe, they will feel like killing two birds with one job
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#736It was caught out of luck due to performance degradation. So nobody reads the code - not even once- prior to merging into upstream supply chain?
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#737It was caught out of luck due to performance degradation. So nobody reads the code - not even once- prior to merging into upstream supply chain?
https://x.com/bl4sty/status/1773780531143925959?s=20
So nobody reads releases notes either.
But I’m sure this was a one off and were safe now
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#738A mirror of the offending repository created by someone else is available at [1]. GitHub should be keeping the evidence in the open (even if just renamed or archived in a safer format) instead of deleting it/hiding it away.
The offending tarball for v5.6.1 is easier to find, an example being.[2]
m4/.gitignore was updated 2 weeks ago to hide build-to-host.m4 that is only present in the release tarball and is used to inject the backdoor at build time.[3]
[1] https://git.phial.org/d6/xz-analysis-mirror
[2] https://mirrors.xtom.ee/gentoo/distfiles/9f/xz-5.6.1.tar.gz
[3] https://git.phial.org/d6/xz-analysis-mirror/commit/4323bc3e0...
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#739I am *not* a security researcher, nor a reverse engineer. There's lots of stuff I have not analyzed and most of what I observed is purely from observation rather than exhaustively analyzing the backdoor code. I love this sort of technical writing from contributors outside the mainstream debugging world who might be averse to sharing. What an excellently summarized report of his findings that should be seen as a templ…
FWIW, it felt intimidating as hell. And I'm fairly established professionally. Not sure what I'd have done earlier in my career (although I'd probably not have found it in the first place).
I hope you've hired a PR person for all the interviews :)
Re: Backdoor in upstream xz/liblzma leading to SSH server compromise
#740There's good discussion of the timeline here: https://boehs.org/node/everything-i-know-about-the-xz-backdo...