Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by zb3 on Friday March 29, 2024 @01:33PM
(#39866765)
Why do you exclude the possibility that this person was forced to add this at gunpoint?
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by encoderer on Friday March 29, 2024 @01:40PM
(#39866863)
Yes exactly this. How do people think state actors have all those 0 day exploits. Excellent research? No! They are adding them themselves!
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by rjzzleep on Friday March 29, 2024 @02:03PM
(#39867114)
The back door is in the upstream GitHub tarball. The most obvious way to get stuff there is by compromising an old style GitHub token.
The new style GitHub tokens are much better but it’s somewhat intransparent what options you need. Most people also don’t use expiring tokens.
The authors seems to have a lot of oss contributions, so probably an easy target to choose.
Re:Backdoor in upstream xz/liblzma leading to SSH server com...
by account42 on Wednesday April 03, 2024 @07:28AM
(#39916031)
I think the letters+numbers naming scheme for both the main account and the sockpuppets used to get him access to xz and the versions into distros is a strong hint at (2). Taking over xz maintainership without any history of open source contributions is also suspicious.
1. His machine was compromised, he wasn't at fault past having less than ideal security (a sin we are all guilty of). His country or origin/residence is of no importance and doxing him isn't fair to him.
2. This account was malicious. There's no reason we should believe that the identity behind wasn't fabricated. The country of origin/residence is likely falsified.
In neither case is trying to investigate who he is on a public forum likely to be productive. In both cases there's risk of aiming an internet mob at some innocent person who was 'set up'.