Ancestors

Toot

Written by mFat on 2024-03-31 at 14:01

Unveiling the xz Utils Backdoor which deliberately opens our SSH connections for RCAs

https://lemdro.id/post/7519386

=> More informations about this toot | More toots from mfat@lemdro.id

Descendants

Written by BOFH666@lemmy.world on 2024-03-31 at 14:39

Thanks for the pointer.

This is really huge, but people don’t quite understand that yet.

If this wasn’t caught, every system -running public sshd- could be hacked or abused/misused.

And I completely agree with the last words, corporate should pay foss projects!

=> More informations about this toot | More toots from BOFH666@lemmy.world

Written by SMillerNL@lemmy.world on 2024-03-31 at 14:48

Even paid it might be hard to find maintainers with knowledge of the code

=> More informations about this toot | More toots from SMillerNL@lemmy.world

Written by P03 Locke on 2024-04-01 at 00:48

imgs.xkcd.com/comics/dependency_2x.png

=> More informations about this toot | More toots from p03locke@lemmy.dbzer0.com

Written by tsonfeir@lemm.ee on 2024-03-31 at 16:09

Anyone got a link for this topic that isn’t a video?

=> More informations about this toot | More toots from tsonfeir@lemm.ee

Written by BOFH666@lemmy.world on 2024-03-31 at 16:15

tukaani.org/xz-backdoor/

Check the links on that page.

=> More informations about this toot | More toots from BOFH666@lemmy.world

Written by perishthethought@lemm.ee on 2024-03-31 at 16:40

Good explainer, if you need to catch up like I did:

en.m.wikipedia.org/wiki/XZ_Utils

Read the supply chain attack section.

Also, from the video…

X is losing its action! We LIKE!

Hell yeah we like.

=> More informations about this toot | More toots from perishthethought@lemm.ee

Written by Goku on 2024-03-31 at 22:00

So if I have been using arch to with infected xz library to connect to a Debian LTS server, am I compromised?

=> More informations about this toot | More toots from youngGoku@lemmy.world

Written by cybersandwich@lemmy.world on 2024-03-31 at 23:12

Assume yes until you can prove otherwise.

=> More informations about this toot | More toots from cybersandwich@lemmy.world

Written by TwiddleTwaddle@lemmy.blahaj.zone on 2024-04-01 at 01:50

From what I’ve read both arch and debian stable aren’t vulnerable to this. It targeted mostly debian-testing.

=> More informations about this toot | More toots from TwiddleTwaddle@lemmy.blahaj.zone

Written by rotopenguin@infosec.pub on 2024-04-01 at 02:29

As I heard it - the (naughty) build tooling looked for rpm and deb, and bailed out if they were absent.

=> More informations about this toot | More toots from rotopenguin@infosec.pub

Written by mosiacmango on 2024-04-01 at 06:01

Arch stable had it apprently, but thats not the commonly used version of arch.

=> More informations about this toot | More toots from mosiacmango@lemm.ee

Written by Irate1013@lemmy.ml on 2024-04-01 at 13:41

Arch put out a statement saying users should update to a non infected binary even though it doesn’t appear to affect Arch archlinux.org/…/the-xz-package-has-been-backdoore…

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way. This is because other yet-to-be discovered methods to exploit the backdoor could exist.

=> More informations about this toot | More toots from Irate1013@lemmy.ml

Written by Possibly linux on 2024-04-01 at 14:00

I would pay attention to the news

=> More informations about this toot | More toots from possiblylinux127@lemmy.zip

Written by Possibly linux on 2024-04-01 at 13:59

That thumbnail is something else

=> More informations about this toot | More toots from possiblylinux127@lemmy.zip

Written by j4yt33 on 2024-04-01 at 15:23

I need the IASIP meme for this thumbnail

=> More informations about this toot | More toots from j4yt33@feddit.de

Written by mudle@lemmy.ml on 2024-04-01 at 15:33

For all those wanting to know what version of the xz package you have, DO NOT use “xz -V” or “xz --version”. Ask your package manager instead; e.g. “apt info xz-utils”. Executing a potentially malicious binary IS NOT a good idea, so ask your package manager instead.

=> More informations about this toot | More toots from mudle@lemmy.ml