News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise.

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by perihelions on Friday March 29, 2024 @01:29PM (#39866721)
Imagine a more competent backdoor attempt on xz(1)—one that wouldn't have been noticed this quickly. xz is everywhere. They could pull off a "reflections on trusting trust": an xz which selectively modifies a tiny subset of the files it sees, like .tar.xz software tarballs underlying certain build processes. Not source code tarballs (someone might notice)—tarballs distributing pre-compiled binaries.

edit to add: Arch Linux' entire package system used to run on .tar.xz binaries (they switched to Zstd a few years ago [0]).

[0] https://news.ycombinator.com/item?id=19478171 ("Arch Linux propose changing compression method from xz to zstd (archlinux.org)")

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by joeyh on Friday March 29, 2024 @02:39PM (#39867508)
A backdoored xz could also run payloads hidden inside other xz files, allowing targeted attacks.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by nolist_policy on Friday March 29, 2024 @01:54PM (#39866996)
deb packages are xz compressed...
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by 1oooqooq on Friday March 29, 2024 @07:09PM (#39870033)
my freaking kernels/initrd are xz or zstd compressed!
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by nolist_policy on Saturday March 30, 2024 @11:56AM (#39876048)
... and Debian is very serious about this: https://fulda.social/@Ganneff/112184975950858403
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Phenylacetyl on Friday March 29, 2024 @02:49PM (#39867585)
The same authors have also contributed to Zstd
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by joeyh on Friday March 29, 2024 @04:46PM (#39868805)
details please? I do not see any such contributions to https://github.com/facebook/zstd
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by delfinom on Saturday March 30, 2024 @11:19AM (#39875663)
They are probably getting confused.

Jia had a zstd fork on github, but when things kicked off, it appears they may have sanitized the fork.

[ Parent | on HN ]