Backdoor in upstream xz/liblzma leading to SSH server compromise

Post by dpkirchner » Sat, Mar 30, 2024, 1:29 PM UTC

Nathanba wrote: post #516

ikekkdcjkfke wrote: post #288

Github should probably remove the dopamine hits of green checkmarks etc. like in serious stock broker apps

They should also remove the emojis, there is no need to have people feel good about upvotes. I've long felt uncomfortable with emojis on Slack as well. Responding to a coding or infrastructure issue should not be a social activity, I respond because it's my job and if the issue is worth it, not because a human being should feel appreciated (either them or me).

Post by 7ero » Sat, Mar 30, 2024, 1:30 PM UTC

Post by mimop » Sat, Mar 30, 2024, 1:36 PM UTC

frenchman99 wrote: post #728

Rhea_Karty wrote: post #672

TLDR: Some people have been throwing around “China,” but it seems also quite possible that Jia is from somewhere in Eastern Europe pretending to be from China. In addition, Lasse Collin and Hans Jansen are from the same EET time zone. These are my notes on time stamps/zones. There are a few interesting bits that I haven't fully fleshed out. The following analysis was conducted on JiaT75’s ( https://github.com/JiaT75?…

You say yourself that the time data could be tampered. It's trivial to change commit dates in git. So this analysis means nothing by itself, unfortunately.

Post by saagarjha » Sat, Mar 30, 2024, 1:42 PM UTC

jaromilrojo wrote: post #806

This is another proof that systemd is an anti-pattern for security: with its crawling and ever growing web of dependencies, it extends the surface of vulnerability to orders of magnitude, and once embraced not even large distro communities can defend you from that. A malware code injection in upstream xz-tools is a vector for remote exploitation of the ssh daemon due to a dependency on systemd for notifications and d…

Post by someguydave » Sat, Mar 30, 2024, 1:43 PM UTC

mac-chaffee wrote: post #560

wood_spirit wrote: post #124

A lot of eyes will be dissecting this specific exploit, and investigating this specific account, but how can we find the same kind of attack in a general way if it’s being used in other projects and using other contributor names?

Build-related fixes are only treating the symptoms, not the disease. The real fix would be better sandboxing and capability-based security[1] built into major OSes which make backdoors a lot less useful. Why does a compression library have the ability to "install an audit hook into the dynamic linker" or anything else that isn't compressing data? No amount of SBOMs, reproducible builds, code signing, or banning binar…