News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by junon on Friday March 29, 2024 @07:01PM (#39869961)
From what I'm understanding it's trying to patch itself into the symbol resolution step of ld.so specifically for libcrypto under systemd on x86_64. Am I misreading the report?

That's a strong indication it's targeting sshd specifically.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by pdw on Friday March 29, 2024 @07:14PM (#39870087)
Lots of software links both liblzma and libcrypto. As I read Andres Freund's report, there is still a lot of uncertainty:

"There's lots of stuff I have not analyzed and most of what I observed is purely from observation rather than exhaustively analyzing the backdoor code."

"There are other checks I have not fully traced."

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by lostmsu on Sunday March 31, 2024 @03:02AM (#39882077)
As mentioned many times in other places now, this account had control over xz code for 2 years. The discovered CVE might be just a tip of an iceberg.
[ Parent | on HN ]