Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://social.coop/users/eb/statuses/112180449849400086">Evan B🥥ehs (eb@social.coop)'s status on Saturday, 30-Mar-2024 04:50:43 JST</a><a href="https://social.coop/@eb" title="eb@social.coop"><img src="https://gnusocial.jp/avatar/89186-48-20240321232508.webp" width="48" height="48" alt="Evan B🥥ehs" style="position: absolute; left: 0; top: 0;">Evan B🥥ehs</a></section><article><p>Unfolding now: <a href="https://news.ycombinator.com/item?id=39865810" rel="nofollow noreferrer">https://news.ycombinator.com/item?id=39865810</a></p><p>- <a href="https://www.openwall.com/lists/oss-security/2024/03/29/4" rel="nofollow noreferrer">https://www.openwall.com/lists/oss-security/2024/03/29/4</a><br>- <a href="https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0" rel="nofollow noreferrer">https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0</a></p><p>An incredibly technically complex <a href="https://social.coop/tags/backdoor" rel="tag">#backdoor</a> in xz (potentially also in libarchive and elsewhere) was just discovered. This backdoor has been quietly implemented over years, with the assistance of a wide array of subtly interconnected accounts:</p><p>- <a href="https://github.com/tukaani-project/xz/commit/ee44863ae88e377a5df10db007ba9bfadde3d314" rel="nofollow noreferrer">https://github.com/tukaani-project/xz/commit/ee44863ae88e377a5df10db007ba9bfadde3d314</a><br>- <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708" rel="nofollow noreferrer">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708</a><br>- <a href="https://github.com/jamespfennell/xz/pull/2" rel="nofollow noreferrer">https://github.com/jamespfennell/xz/pull/2</a></p><p>The timeline on this is going to take so long to unravel</p><p><a href="https://social.coop/tags/security" rel="tag">#security</a> <a href="https://social.coop/tags/linux" rel="tag">#linux</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2879228#notice-5720565">In conversation</a><time datetime="2024-03-30T04:50:43+09:00" title="Saturday, 30-Mar-2024 04:50:43 JST">Saturday, 30-Mar-2024 04:50:43 JST</time> <span>from <span><a href="https://social.coop/@eb/112180449849400086" rel="external" title="Sent from social.coop via ActivityPub">social.coop</a></span></span><a href="https://social.coop/@eb/112180449849400086">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: www.openwall.com</div><h5><a href="https://www.openwall.com/lists/oss-security/2024/03/29/4">oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise</a></h5><div></div></header><div></div><footer></footer></article></li><li><article><header><div>No result found on File_thumbnail lookup.</div><h5><a href="https://news.ycombinator.com/item?id=39865810-">https://news.ycombinator.com/item?id=39865810-</a></h5><div></div></header><div></div><footer></footer></article></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/2436349">Untitled attachment</a></label><br></li><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/tukaani-project/xz/commit/ee44863ae88e377a5df10db007ba9bfadde3d314">liblzma: Add ifunc implementation to crc64_fast.c. · tukaani-project/xz@ee44863</a></h5><div></div></header><div>The ifunc method avoids indirection via the function pointer
crc64_func. This works on GNU/Linux and probably on FreeBSD too.
The previous __attribute((__constructor__)) method is kept for
compatib...</div><footer></footer></article></li><li><article><header><div>Domain not in remote thumbnail source whitelist: bugs.debian.org</div><h5><a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708">#1067708 - xz-utils: New upstream version available - Debian Bug report logs</a></h5><div></div></header><div></div><footer></footer></article></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/2436352">Untitled attachment</a></label><br></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Evan B🥥ehs (eb@social.coop)'s status on Saturday, 30-Mar-2024 04:50:43 JST Evan B🥥ehs
Unfolding now: https://news.ycombinator.com/item?id=39865810
- https://www.openwall.com/lists/oss-security/2024/03/29/4
- https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0
An incredibly technically complex #backdoor in xz (potentially also in libarchive and elsewhere) was just discovered. This backdoor has been quietly implemented over years, with the assistance of a wide array of subtly interconnected accounts:
- https://github.com/tukaani-project/xz/commit/ee44863ae88e377a5df10db007ba9bfadde3d314
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708
- https://github.com/jamespfennell/xz/pull/2
The timeline on this is going to take so long to unravel
#security #linux
In conversationSaturday, 30-Mar-2024 04:50:43 JST from social.cooppermalink
Attachments
1. Domain not in remote thumbnail source whitelist: www.openwall.com
  oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise
2. No result found on File_thumbnail lookup.
  https://news.ycombinator.com/item?id=39865810-
3. Untitled attachment
4. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  liblzma: Add ifunc implementation to crc64_fast.c. · tukaani-project/xz@ee44863
  The ifunc method avoids indirection via the function pointer crc64_func. This works on GNU/Linux and probably on FreeBSD too. The previous __attribute((__constructor__)) method is kept for compatib...
5. Domain not in remote thumbnail source whitelist: bugs.debian.org
  #1067708 - xz-utils: New upstream version available - Debian Bug report logs
6. Untitled attachment

Public

Embed Notice

HTML Code

Corresponding Notice