Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by concordDance on Friday March 29, 2024 @04:17PM (#39868553)

Some of those commits might fix genuine vulnerabilities. So you might trade a new backdoor for an old vulnerability that thousands of criminal orgs have bots for exploiting.

Damage wise, most orgs aren't going to be hurt much by NSA or the Chinese equivalent getting access, but a Nigerian criminal gang? They're far more likely to encrypt all your files and demand a ransom.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mysidia on Friday March 29, 2024 @05:49PM (#39869386)

Still.. At this point the default assumption should be every commit is a vulnerability or facilitating a potential vulnerability.

For example, change from safe_fprintf to fprintf. It would be appropriate that every commit should be reviewed and either tweaked or re-written to ensure the task is being done in the safest way and doesn't have anything that is "off" or introducing a deviation from the way that codebase standardly goes about tasks within functions.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by KeplerBoy on Friday March 29, 2024 @06:53PM (#39869897)

Surely this is happening right now.

A lot of eyes are on the code. From all sides. Folks trying to find old unpatched backdoors to exploit or patch.

[ Parent | on HN ]