News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by wpietri on Friday March 29, 2024 @02:33PM (#39867446)
I get why people are focusing on this bad actor. But the question that interests me more: how many other apparent individuals fit the profile that this person presented before caught?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Phenylacetyl on Friday March 29, 2024 @07:52PM (#39870327)
Apparently, many.

It looks like gettext may be containing a part of their attack infrastructure.

https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev...

https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16...

https://github.com/MonicaLiu0311

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by collinfunk on Friday March 29, 2024 @09:16PM (#39870895)
Are you referencing the '-unsafe' suffix in the second link? That is not something to worry about.

This is from Gnulib, which is used by Gettext and other GNU projects. Using 'setlocale (0, NULL)' is not thread-safe on all platforms. Gnulib has modules to work around this, but not all projects want the extra locking. Hence the name '-unsafe'. :)

See: https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg001...

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by everybackdoor on Saturday March 30, 2024 @04:59AM (#39873074)
They may be right: https://git.alpinelinux.org/aports/log/main/gettext

Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by kaathewise on Saturday March 30, 2024 @07:45AM (#39873923)
psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved.

[0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by everybackdoor on Saturday March 30, 2024 @09:31AM (#39874681)
JiaT75 was also a prolific contributor to xz over the past few years, so your assumptions are generally invalid at this point.
[ Parent | on HN ]