News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by Hackbraten on Friday March 29, 2024 @08:53PM (#39870740)
You’re not wrong. However, building from source wouldn’t have protected you against this specific backdoor. The upstream source tarball itself was compromised in a cleverly sneaky way.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by ui2RjUen875bfFA on Friday March 29, 2024 @09:16PM (#39870894)
You might read https://www.openwall.com/lists/oss-security/2024/03/29/4

"However, building from source wouldn’t have protected you against this specific backdoor." Depends on how exactly you build from source. A generic build was not the target. Andres Freund showed that the attack was targeted against a specific type of build system.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by zamalek on Saturday March 30, 2024 @08:04AM (#39874052)
Building from git, or the github automatic tarball would have. The larger issue here is authenticating tarballs against the source.
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Friday April 05, 2024 @03:55AM (#39939787)
There is no reason to believe the exploit would have been spotted earlier had the attacker included the final part in git.
[ Parent | on HN ]