• atzanteol@sh.itjust.worksEnglish
    150·
    7 months ago

    They noticed that some ssh sessions took 0.5 seconds too long under certain circumstances. 😲

    Holy hell that’s good QA.

      • krash@lemmy.ml
        25·
        7 months ago

        Don’t see why you’re being downvoted, the person in question who discovered this is a postgres maintainer employed by Microsoft.

        • ijhoo@lemmy.ml
          18·
          7 months ago

          Probably people think this is a troll or something.

          I wrote it because I was surprised, especially since I’m not a fan of microsoft and their policies. Lately, I have the feeling Microsoft is better than Google (relative terms) when it comes to oss.

          What is additionally surprising is the breaches of Microsoft services in the last year. There is one every few weeks or so… And then they pick up a backdoor because login took 0.5 instead of 0.1s.

          Anyway, his findings are amazing.

          • Wes_Dev@lemmy.ml
            92·
            7 months ago

            This isn’t the same thing, but I’m reminded of Minecraft.

            Minecraft is a massively popular game. Notch once said he planned to make it open source when its popularity died down. But now Microsoft owns it.

            Not only that, but Mojang accounts don’t work anymore. You have to have a Microsoft account to play it now. Even trying to download and play an older version of the game offline requires Microsoft to approve it. Microsoft is actively tightening the leash on the game because it makes them money. Open sourcing the game will likely never happen now. The best we can hope for it for versions to fall into public domain after 70-ish years.

            That’s how I see Microsoft. They only care about what its beneficial for them to drive profits. Working on open source projects, and open sourcing a few of their tools to get the benefits of community adoption and code review is great, sure. But they’d sooner try to incorporate Linux into Windows to keep people in their surveillance ecosystem, than to open source Windows.

            Remember when Windows 10 was the last version, until they changed their minds? Remember when they floated the idea of charging a recurring subscription to use Windows, before they silently dropped the idea? Remember when there was credible talk about the next version of Windows being cloud-based where they controlled all your data and you had no privacy? Hell, you have basically no privacy on Windows 10. Trying to reclaim some involves registry edits, special third party tools, and a constant battle with automatic updates reverting your changes.

            I’ll say it again. Microsoft doesn’t care about OSS. It’s just currently beneficial for them to pretend they do.

            Goggle seemed to care a lot about OSS, then started making everything in Android depend on their proprietary ecosystem to function. Now Google is using the dominant position they got by taking advantage of OSS adoption, and have been pushing privacy-invading standards and trying to get rid of ad blockers online, among many other things.

            For these huge companies, OSS is just a tool to get more control and power. The moment it’s no longer useful, they’ll find ways to work around the license and enshitify everything again.

            It keeps happening. I refuse to keep trusting bad actors every time they dangle a shiny trinket over our heads.

            I do appreciate the work this person did in finding the bug. It’s not all doom and gloom.

            • ijhoo@lemmy.ml
              3·
              7 months ago

              I agree with you sentiment here. That’s why I wrote ‘relative terms’ in my comment.

              Since Nadela took over, Microsoft did some open thing which benefited community. So, Microsoft opened somewhat.

              During the same time, under Pichai, google went the other way: they focus more on monetization and try to control stuff the apple way. Manifest v3? Google also didn’t do anything really worth mentioning in the last 10y in terms of products. Well, except ‘attention’ article. And even this they didn’t believe in and they cannot deliver a decent product. I just tried google advanced Gemini and it’s, to put it politely, shit. Google also had some positive actions like mainlining a lot of stuff in Linux Kernel to more easily upgrade android.

              So, while google is closing down and making mistakes, Microsoft is opening a bit up.

              If you look the state from the last year and the state now. Microsoft improved. Google went the other way.

              Microsoft doesn’t care about open source, they care about the money Cloud Services using open source bring them. I don’t think google cares as well. For reason read this: https://www.joelonsoftware.com/2002/06/12/strategy-letter-v/

    • 30p87@feddit.de
      18·
      7 months ago

      Well half a second delay is pretty noticeable when you ssh into a machine sitting right next to you. It should be instant. And if it isn’t something’s off.

  • capt_kafei@lemmy.caEnglish
    97·
    7 months ago

    Damn, it is actually scary that they managed to pull this off. The backdoor came from the second-largest contributor to xz too, not some random drive-by.

      • Alex@lemmy.ml
        601·
        7 months ago

        It’s looking more like a long game to compromise an upstream.

        • cjk@feddit.de
          18·
          7 months ago

          Either that or the attacker was very good at choosing their puppet…

          • Alex@lemmy.ml
            36·
            7 months ago

            Well the account is focused on one particular project which makes sense if you expect to get burned at some point and don’t want all your other exploits to be detected. It looks like there was a second sock puppet account involved in the original attack vector support code.

            We should certainly audit other projects for similar changes from other psudoanonymous accounts.

    • Alex@lemmy.ml
      34·
      7 months ago

      Time to audit all their contributions although it looks like they mostly contribute to xz. I guess we’ll have to wait for comments from the rest of the team or if the whole org needs to be considered comprimised.

      • sim642@lemm.ee
        2·
        7 months ago

        Assuming that it’s just that person, that it’s their actual name and that they’re in the US…

      • ugjka@lemmy.worldEnglish
        24·
        7 months ago

        there will be federal investigation just speculation if the culprit is a foreign actor

    • mumblerfish@lemmy.world
      13·
      7 months ago

      Gentoo just reverted back to the last tar signed by another author than the one seeming responsible for the backdoor. The person has been on the project for years, so one should keep up to date and possibly revert even further back than just from 5.6.*. Gentoo just reverted to 5.4.2.

    • flying_sheep@lemmy.ml
      912·
      7 months ago

      Backdoor only gets inserted when building RPM or DEB. So while updating frequently is a good idea, it won’t change anything for Arch users today.

        • flying_sheep@lemmy.ml
          13·
          7 months ago

          No, read the link you posted:

          Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command:

          ldd "$(command -v sshd)"

          However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way.

        • progandy@feddit.de
          3·
          7 months ago

          Those getting the most recent software versions, so nothing that should be running in a server.

        • Laser@feddit.de
          2·
          7 months ago

          Fedora 41, Fedora Rawhide, Debian Sid are the currently known affected ones AFAIK.

        • flying_sheep@lemmy.ml
          1·
          7 months ago

          I think it needs to be

          • rolling release (because it was caught so quickly that it hasn’t made its way into any cadence based distro yet)
          • using the upstream Makefile task to build a RPM or DEB (because the compromised build script directly checks for that and therefore doesn’t trigger for a destdir build like Gentoo’s or Arch’s)
          • using the upstream provided tarball as opposed to the one GitHub provides, or a git clone (because only that contains the compromised Makefile, running autotools yourself is safe)

          Points 1 and 2 mean that only rolling release RPM and DEB distros like Debian Sid and Fedora are candidates. I didn’t check if they use the Makefile and the compromised tarballs.

    • Daniel Quinn@lemmy.caEnglish
      3·
      7 months ago

      Why didn’t this become a thing? Surely in 2024, we should be able to build packages from source and sign releases with a private key.

      • Natanael@slrpnk.net
        5·
        7 months ago

        It’s becoming more of a thing but a lot of projects are so old that they haven’t been able to fix their entire build process yet

  • Doombot1@lemmy.one
    27·
    7 months ago

    ELI5 what does this mean for the average Linux user? I run a few Ubuntu 22.04 systems (yeah yeah, I know, canonical schmanonical) - but they aren’t bleeding edge, so they shouldn’t exhibit this vulnerability, right?

  • lemmyreader@lemmy.mlEnglish
    191·
    7 months ago

    t y for sharing.

    #showerthoughts The problem is in upstream and has only entered Debian Sid/unstable. Does this mean that for example bleeding edge Arch (btw) sshd users are compromised already ?

  • Wes_Dev@lemmy.ml
    12·
    7 months ago

    Damn fine work all around.

    I know this is an issue fraught with potential legal and political BS, and it’s impossible to check everything without automation these days, but is there an organization that trains and pays people to work as security researchers or QA for open source projects?

    Basically, a watchdog group that finds exploitable security vulnerabilities, and works with individuals or vendors to patch them? Maybe make it a publicly owned and operated group with mandatory reporting of some kind. An international project funded by multiple governments, where it’s harder for a single point of influence to hide exploits, abuse secrets, or interfere with the researchers? They don’t own or control any code, just find security issues and advise.

    I don’t know.

    Just thinking that modern security is getting pretty complicated, with so many moving parts and all.