The failed attempt to backdoor SSH globally – that got caught by chance

Re:The failed attempt to backdoor SSH globally – that got ca... by inopinatus on Monday April 01, 2024 @05:26AM (#39892208)

The dependency is attributable, in the largest part, to systemd's neoplastic aggrandizement of userland infrastructure and associated plumbing, making this a distinction without much of a difference.

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by XorNot on Monday April 01, 2024 @05:29AM (#39892236)

"everyone should just reimplement LZMA!"

What could possibly go wrong. I'm sure there's no history of compression tools having serious vulnerabilities due to implementation errors...

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by inopinatus on Monday April 01, 2024 @05:33AM (#39892261)

This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana.

[1] https://seclists.org/oss-sec/2024/q1/268

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by LtWorf on Monday April 01, 2024 @05:42AM (#39892314)

As many have already pointed out, the library can also be linked to sshd via selinux.

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by inopinatus on Monday April 01, 2024 @05:57AM (#39892388)

I've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by usr1106 on Monday April 01, 2024 @08:11AM (#39893266)

That packaging error makes liblzma being pulled in at installation (well, it's probably already there if pid 1 requires it). But it will not make the sshd binary use it. So I think the original claim stands: Without patching sshd for the notification it will not use liblzma.

Disclaimer: I did not search for all possible occurrences of dlopen().

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by himinlomax on Monday April 01, 2024 @10:54AM (#39894765)

https://github.com/proposal-signals/proposal-signals

> libselinux does not link to liblzma. It turns out the confusion was because of an old downstream-only patch in Fedora and a stale dependency in the RPM spec which persisted long-beyond its removal.

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by xxs on Monday April 01, 2024 @06:46AM (#39892654)

I get the sentiment. zstd is just better, though!

Other than that I did try a manual port (of zstd) to Java but I was not pleased with the results.

The other part is that systemd uses plain unix sockets with the most basic of protocols (that part along with docker forwarder was doable)

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by blkhawk on Monday April 01, 2024 @04:47AM (#39891983)

"the car bomb was build into the spare wheel not the car itself...."

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by nottorp on Monday April 01, 2024 @05:36AM (#39892279)

"... and although the spare wheel is included by default, the car is modular and you can always remove it yourself"

[By dismantling the car completely and reassembling it, since you'd have to rebuild from source...]

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by chgs on Monday April 01, 2024 @06:51AM (#39892692)

Most cars no longer come with a spare wheel, certainly by default. Not sure if that’s because cars don’t get punctures any more due to the great state of the roads here in the U.K, or because people just can’t even change a wheel.

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by JonChesterfield on Monday April 01, 2024 @08:09AM (#39893252)

It's to help meet emissions targets according to the garage I bought from. The spare wheel weighs more than not having one.

[ Parent | on HN ]

Re:The failed attempt to backdoor SSH globally – that got ca... by nottorp on Monday April 01, 2024 @07:08AM (#39892819)

Not in most systemd distros though. Those include all kinds of spare wheels that automatically take over your actual wheels.

[ Parent | on HN ]