XZ Utils Backdoor
tukaani.org
XZ Utils Backdoor
1–10 of 20 posts
Re: XZ Utils Backdoor
#2You really have to feel for the author. Stepping aside for personal reasons and having someone else take up the mantle of a project is supposed to be a success story of open source - I myself have been on both sides of that process before.
For it to turn out like this is incredibly disappointing
Re: XZ Utils Backdoor
#3[deleted]
Re: XZ Utils Backdoor
#4Main thread here: https://news.ycombinator.com/item?id=39865810
Re: XZ Utils Backdoor
#5You really have to feel for the author. Stepping aside for personal reasons and having someone else take up the mantle of a project is supposed to be a success story of open source - I myself have been on both sides of that process before. For it to turn out like this is incredibly disappointing
[deleted]
Re: XZ Utils Backdoor
#6What can one do after having this installed? What's the consequences for a machine with this installed but not connected to the WAN?
Re: XZ Utils Backdoor
#7You really have to feel for the author. Stepping aside for personal reasons and having someone else take up the mantle of a project is supposed to be a success story of open source - I myself have been on both sides of that process before. For it to turn out like this is incredibly disappointing
Well, at least it was detected pretty early, and is contained.
Extremely wicked backdoor, but he only lost the main maintainer and github. Github will be reactivated soon for him, so others can take over.
Re: XZ Utils Backdoor
#8[deleted]
Re: XZ Utils Backdoor
#9What can one do after having this installed? What's the consequences for a machine with this installed but not connected to the WAN?
No known consequence, assuming...
(1) changing the RSA decrypt function in OpenSSH is all the code hidden in crc64 does: that's the only known behavior, but we don't know what the changed function does besides letting some authentication through, nor do we know if there are other things it does
(2) there's no malicious machine in your LAN exploiting the RSA decrypt to log onto your sshd: nobody has seen one yet, but it doesn't mean there's no such thing.
If you are not using a distro that does dpkg or rpm, or if your machine is not x86-64, you're free from the "code hidden in crc64", the one that targets sshd, CVE-2024-3094. Are there unknown backdoors? Who knows. Do we count the landlock sabotage as a backdoor?
It's hard to deal with unknowns. Assume the worst, maybe, but what even is the worst?
Re: XZ Utils Backdoor
#10What can one do after having this installed? What's the consequences for a machine with this installed but not connected to the WAN?
Assume that a backdoor was injected and activated, especially if you ever sshd into the machine.
The backdoor is not fully analyzed as of now. As such nothing can be said about the system besides "it is potentially compromised".