Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bennyhill on Friday March 29, 2024 @01:30PM (#39866731)

> so now security-critical daemons like openssh have additional dependencies like liblzma

Systemd itself seems security-critical to me. Would removing other dependencies on libsystemd really make a secure system where systemd was compromised through its library?

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by agwa on Friday March 29, 2024 @01:35PM (#39866797)

1. systemd (at least the PID 1 part) does not talk to the network, so a remotely-accessible backdoor would need to be more complex (and thus more likely to be detected) than a backdoor that can be loaded into a listening daemon like openssh.

2. You can run Debian systems without systemd as PID 1, but you're still stuck with libsystemd because so many daemons now link with it.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by chasil on Friday March 29, 2024 @02:23PM (#39867344)

> systemd... does not talk to the network...

Socket activation and the NFS automounter appear to.

If I run "netstat -ap" I see pid 1 listening on enabled units.

Edit: tinysshd is specifically launched this way.

Edit2: there is also substantial criticism of xz on technical grounds.

https://www.nongnu.org/lzip/xz_inadequate.html

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by capitainenemo on Friday March 29, 2024 @01:56PM (#39867035)

.. well, you can use a shim package as devuan did.

[ Parent | on HN ]