The xz-utils backdoor has been removed

Re:The xz-utils backdoor has been removed by rgovostes on Tuesday April 09, 2024 @11:43PM (#39986740)

This commit message is gold: https://github.com/tukaani-project/xz/commit/e93e13c8b3bec92...

    While the backdoor was inactive (and thus harmless) without inserting
    a small trigger code into the build system when the source package was
    created, it's good to remove this anyway:

      - The executable payloads were embedded as binary blobs in
        the test files. This was a blatant violation of the
        Debian Free Software Guidelines.

      - On machines that see lots bots poking at the SSH port, the backdoor
        noticeably increased CPU load, resulting in degraded user experience
        and thus overwhelmingly negative user feedback.

      - The maintainer who added the backdoor has disappeared.

      - Backdoors are bad for security.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by syntheticcdo on Wednesday April 10, 2024 @12:15AM (#39986897)

https://github.com/tukaani-project/xz/commit/780cbf29d5a88db... to update the NEWS file is equally honest:

    5.6.1 (2024-03-09)

    IMPORTANT: This fixed bugs in the backdoor (CVE-2024-3094) (someone
    had forgot to run Valgrind).

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by glandium on Wednesday April 10, 2024 @01:02AM (#39987126)

https://github.com/tukaani-project/xz/commit/77a294d98a9d2d4...

    Special author: Jia Tan was a co-maintainer in 2022-2024. He and
    the team behind him inserted a backdoor (CVE-2024-3094) into
    XZ Utils 5.6.0 and 5.6.1 releases. He suddenly disappeared when
    this was discovered.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by usr1106 on Wednesday April 10, 2024 @01:18AM (#39987205)

Violation of the Debian Free Software guidelines? Is that a problem?

The owner of github became a money making machine using a business model violating the same guidelines.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by jwilk on Wednesday April 10, 2024 @02:29AM (#39987559)

It was a joke.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by red_admiral on Wednesday April 10, 2024 @03:46AM (#39988075)

This has to go on the list of "best understatements ever", along with that famous captain's announcement when an ash cloud knocked out all four engines.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by nextaccountic on Wednesday April 10, 2024 @04:15AM (#39988242)

I would really really really like to see all commits by Jia Tan reverted, not only those currently found to be malicious.

Debian and NixOS (and other distros) are already downgrading or discussing to downgrade to versions without those commits.

I think that making a 5.4 or 5.6 release without any of those commits (with stuff reimplemented as needed) would assuage most concerns

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by icameron on Wednesday April 10, 2024 @05:40AM (#39988772)

Who would do that? The project lacking active contributors is what enabled Jai Tan to get away with it in the first place.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by Affric on Wednesday April 10, 2024 @07:11AM (#39989360)

Can’t we migrate to other libraries?

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by eigenlicht on Wednesday April 10, 2024 @07:40AM (#39989559)

At least in Debian there's already the inevitable discussion about a supposed opportunity for "finally" moving to zstd. Which to me, frankly, feels a bit like getting out of the frying pan and into the fire, or what I think Arch (yuck) did years ago. That's not because I'm so much into xz. It's kind of funny there's a possible Debian connection, of all things, considering that quite a lot authorities and services in areas like China, Russia or Iran are recently migrating, for obvious reasons, from Windows/Mac to more or less home-made (~styled) Linux distributions, that just often happen to be based on Debian. I don't think this is too popular in English speaking countries in particular, but then I really didn't want to chime in on the speculations. ;P

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by jwilk on Wednesday April 10, 2024 @08:28AM (#39989934)

Where is this discussion happening?

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by cqqxo4zV46cp on Wednesday April 10, 2024 @08:25AM (#39989922)

None of these suggestions actually cover the part where someone or someones do a bunch of bloody work.

Again, this is the problem in the first place.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by nextaccountic on Thursday April 11, 2024 @01:25AM (#39998660)

There is a reimplementation of xz here at least https://github.com/gendx/lzma-rs

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by TacticalCoder on Wednesday April 10, 2024 @04:52AM (#39988454)

> This commit message is gold

It's really sad to see commit messages like this, downplaying the issue. It's also concerning to see libsystemd get a free pass.

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by cowsandmilk on Wednesday April 10, 2024 @07:58AM (#39989695)

How did they get a free pass?

[ Parent | on HN ]

Re:The xz-utils backdoor has been removed by bbarnett on Wednesday April 10, 2024 @08:11AM (#39989812)

Systemd's ridiculous inability to manage daemons correctly, like every other init system on the planet, necessitated debian, redhat, and others patching ssh, just so systemd could reliably start ssh.

Which is what enabled this vulnerability to be viable.

[ Parent | on HN ]