Backdoor found in widely used Linux utility

Ice Tea · 30 Mar 2024 at 09:32

Backdoor found in widely used Linux utility breaks encrypted SSH connections

Malicious code planted in xz Utils has been circulating for more than a month.

arstechnica.com

Malicious backdoor spotted in Linux compression library xz

Red Hat in all caps says STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES

www.theregister.com

Ice Tea · 2 Apr 2024 at 09:42

Malicious xz backdoor reveals fragility of open source

This time, we got lucky. It mostly affected bleeding-edge distros. But that's not a defense strategy

www.theregister.com

More info, i've not had time to read through it yet.

Ice Tea · 17 Apr 2024 at 12:04

Open source groups fear xz repeat as suspicious messages fly

Social engineering patterns spotted across range of popular projects

www.theregister.com

Sigh!

Ice Tea · 30 May 2024 at 10:14

XZ 5.6.2 Released With The Frightening Backdoor Removed - Phoronix

www.phoronix.com

also dropping the GNU Indirect Function (IFUNC) support. The IFUNC support was used by the XZ backdoor but the removal of this code is coming because the performance benefits of using it were too small while adding much complexity.

Ice Tea · 22 Jul 2024 at 12:17

XZ Patches For The Linux Kernel Updated, Drops "Jia Tan" As A Maintainer - Phoronix

www.phoronix.com

I wonder why it took so long to remove him?