• fireshell@lemmy.worldEnglish
    2·
    3 months ago

    Some no-name came and without any problems asked to become a maintainer in a project used in almost any distro, took it over, put a backdoor in there and no one had any questions? In this case, everything turned out thanks to pure chance. Noname screwed up his backdoor, which attracted the attention of a guy from Microsoft, and out of boredom, he dug up what was what. And if I hadn’t messed up, or that guy from Microsoft decided to go drink beer instead of poking around in the xz code, then no one would have discovered anything. It’s scary to imagine how many of these nonames are sitting in all these thousands of open source projects, waiting in the wings to roll out a malicious patch.

  • Wes_Dev@lemmy.ml
    2·
    3 months ago

    Damn fine work all around.

    I know this is an issue fraught with potential legal and political BS, and it’s impossible to check everything without automation these days, but is there an organization that trains and pays people to work as security researchers or QA for open source projects?

    Basically, a watchdog group that finds exploitable security vulnerabilities, and works with individuals or vendors to patch them? Maybe make it a publicly owned and operated group with mandatory reporting of some kind. An international project funded by multiple governments, where it’s harder for a single point of influence to hide exploits, abuse secrets, or interfere with the researchers? They don’t own or control any code, just find security issues and advise.

    I don’t know.

    Just thinking that modern security is getting pretty complicated, with so many moving parts and all.

    • mumblerfish@lemmy.world
      1·
      3 months ago

      Gentoo just reverted back to the last tar signed by another author than the one seeming responsible for the backdoor. The person has been on the project for years, so one should keep up to date and possibly revert even further back than just from 5.6.*. Gentoo just reverted to 5.4.2.

    • flying_sheep@lemmy.ml
      0·
      3 months ago

      Backdoor only gets inserted when building RPM or DEB. So while updating frequently is a good idea, it won’t change anything for Arch users today.

  • capt_kafei@lemmy.caEnglish
    1·
    3 months ago

    Damn, it is actually scary that they managed to pull this off. The backdoor came from the second-largest contributor to xz too, not some random drive-by.

  • Doombot1@lemmy.one
    0·
    3 months ago

    ELI5 what does this mean for the average Linux user? I run a few Ubuntu 22.04 systems (yeah yeah, I know, canonical schmanonical) - but they aren’t bleeding edge, so they shouldn’t exhibit this vulnerability, right?

    • kbal@fedia.io
      0·
      3 months ago

      The average user? Nothing. Mostly it just affects those who get the newest versions of everything.

      • flying_sheep@lemmy.ml
        0·
        3 months ago

        In this case I think that’s just Fedora and Debian Sid users or so.

        The backdoor only activates during DEB or RPM builds, and was quickly discovered so only rolling release distros using either package format were affected.

    • rotopenguin@infosec.pubEnglish
      0·
      3 months ago

      apt info xz-utils

      Your version is old as balls. Even if you were on Mantic, it would still be old as balls.

  • atzanteol@sh.itjust.worksEnglish
    0·
    3 months ago

    They noticed that some ssh sessions took 0.5 seconds too long under certain circumstances. 😲

    Holy hell that’s good QA.

      • krash@lemmy.ml
        0·
        3 months ago

        Don’t see why you’re being downvoted, the person in question who discovered this is a postgres maintainer employed by Microsoft.

        • ijhoo@lemmy.ml
          0·
          3 months ago

          Probably people think this is a troll or something.

          I wrote it because I was surprised, especially since I’m not a fan of microsoft and their policies. Lately, I have the feeling Microsoft is better than Google (relative terms) when it comes to oss.

          What is additionally surprising is the breaches of Microsoft services in the last year. There is one every few weeks or so… And then they pick up a backdoor because login took 0.5 instead of 0.1s.

          Anyway, his findings are amazing.

          • Wes_Dev@lemmy.ml
            2·
            3 months ago

            This isn’t the same thing, but I’m reminded of Minecraft.

            Minecraft is a massively popular game. Notch once said he planned to make it open source when its popularity died down. But now Microsoft owns it.

            Not only that, but Mojang accounts don’t work anymore. You have to have a Microsoft account to play it now. Even trying to download and play an older version of the game offline requires Microsoft to approve it. Microsoft is actively tightening the leash on the game because it makes them money. Open sourcing the game will likely never happen now. The best we can hope for it for versions to fall into public domain after 70-ish years.

            That’s how I see Microsoft. They only care about what its beneficial for them to drive profits. Working on open source projects, and open sourcing a few of their tools to get the benefits of community adoption and code review is great, sure. But they’d sooner try to incorporate Linux into Windows to keep people in their surveillance ecosystem, than to open source Windows.

            Remember when Windows 10 was the last version, until they changed their minds? Remember when they floated the idea of charging a recurring subscription to use Windows, before they silently dropped the idea? Remember when there was credible talk about the next version of Windows being cloud-based where they controlled all your data and you had no privacy? Hell, you have basically no privacy on Windows 10. Trying to reclaim some involves registry edits, special third party tools, and a constant battle with automatic updates reverting your changes.

            I’ll say it again. Microsoft doesn’t care about OSS. It’s just currently beneficial for them to pretend they do.

            Goggle seemed to care a lot about OSS, then started making everything in Android depend on their proprietary ecosystem to function. Now Google is using the dominant position they got by taking advantage of OSS adoption, and have been pushing privacy-invading standards and trying to get rid of ad blockers online, among many other things.

            For these huge companies, OSS is just a tool to get more control and power. The moment it’s no longer useful, they’ll find ways to work around the license and enshitify everything again.

            It keeps happening. I refuse to keep trusting bad actors every time they dangle a shiny trinket over our heads.

            I do appreciate the work this person did in finding the bug. It’s not all doom and gloom.