Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jnxx on Friday March 29, 2024 @05:18PM (#39869124)

> They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible.

The stuxnet malware, which compromised Siemens industrial controls to attack specific centrifuges in uranium enrichment plants in Iran, is a counterexample to that.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mrb on Friday March 29, 2024 @07:59PM (#39870379)

Stuxnet wasn't similar to this xz backdoor. The Stuxnet creators researched (or acquired) four Windows zero-days, a relatively short-term endeavor. Whereas the xz backdoor was a long-term 2.5 years operation to slowly gain trust from Lasse Collin.

But, anyway, I'm sure we can find other counter-examples.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Repulsion9513 on Saturday March 30, 2024 @01:44AM (#39872155)

If a government wants to cast a wide nest and catch what they can, they'll just throw a tap in some IXP.

If a government went to this much effort to plant this vulnerability, they absolutely have targets in mind - just like they did when they went to the effort of researching (or acquiring) four separate Windows zero-days, combining them, and delivering them...

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jhugo on Monday April 01, 2024 @05:22PM (#39899517)

> a long-term 2.5 years operation to slowly gain trust from Lasse Collin

Couldn't the account that committed the backdoor have been compromised recently?

[ Parent | on HN ]