Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by cbolton on Saturday March 30, 2024 @08:15AM (#39874115)

In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offering to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by maerF0x0 on Saturday March 30, 2024 @12:05PM (#39876116)

or > Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see.

Is actually Jia Tan has him tied up in a basement and is posing as him. State actors can do that kind of thing.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @09:21AM (#39917113)

In that case why bother with the Jia Tan persona at all instead of just pushing the malware as Lasse Collin.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by deanresin on Saturday March 30, 2024 @01:24PM (#39876731)

In a movie, he was killed by foreign state actors, and his identity assumed by the foreign state hacker. Actually, someone should check on him.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Wednesday April 03, 2024 @09:20AM (#39917097)

> what looks like a tangential attack

Does it? I expect that finding someone vulnerable was the more likely approach rather than messing with the life of a stable maintainer, but it does seem very much like the attacker was acting with malicious intent from the start of his interaction with the xz project.

[ Parent | on HN ]