Backdoor in upstream xz/liblzma leading to SSH server compromise

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by junon on Saturday March 30, 2024 @08:22AM (#39874159)

Good question, though I can imagine they took this action for two reasons:

1. They don't have the ability to freeze repos (i.e. would require some engineering effort to implement it), as I've never seen them do that before.

2. Many distros (and I assume many enterprises) were still linking to the GitHub releases to source the infected tarballs for building. Disabling the repo prevents that.

The infected tarballs and repo are still available elsewhere for researchers to find, too.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by nihilanth on Saturday March 30, 2024 @08:54AM (#39874389)

They could always archive it. Theoretically (and I mean theoretically only), there's another reason for Microsoft to prevent access to repo: if a nation state was involved, and there've been backdoor conversations to obfuscate the trail.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by jarfil on Saturday March 30, 2024 @03:11PM (#39877690)

Archiving the repo doesn't stop the downloads. They would need to rename it in order to prevent distro CI/CD from keeping downloading untrustworthy stuff.

[ Parent | on HN ]

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by account42 on Tuesday April 02, 2024 @07:26AM (#39904508)

Distros downloading directly from GitHub deserve what they get.

[ Parent | on HN ]