'xz utils' Software Backdoor Uncovered in Years-Long Hacking Plot

submitted by Five edited

unicornriot.ninja/2024/xz-utils-software-backdo…

Log in to comment

4 Comments

leanleft

i have heard it suggested that it could be national goverment who did this. so that means it could be israel, america, or china, etc .
i view this as potentially very well funded governments vs ordinary people. we never stood a chance.

4dpuzzle

That suggestion is because the attack took years of ground work, psyops, multiple disciplines and several levels of obfuscations. It needs the kind of effort that only a well paid and dedicated team can pull off. But that need not necessarily be a state actor. It could also be some spying/malware company (like NSO), any of the big corporates or a criminal group with lots of money.

But don't lose hope. All it took to uncover all of that was just one engineer who was annoyed by SSH slowing down from 0.3s to 0.8s. The effort needed to uncover it is only a fraction of what's needed to hide it. This is also a vindication of the FOSS philosophy. Imagine uncovering this if the source wasn't available.

esaru

I wonder if the intention could be purely financial as well: Once the backdoor is in, you can sell it for millions to a company which sells the service of breaking into systems. Or it was such a company itself that pushed the backdoor into the code.

esaru

I guess even QubesOS would have been affected by this?