The XZ Backdoor Almost Compromised Every Linux System

In this video I discuss how advanced persistent threat actors managed to backdoor xz-utils and almost gained system RCE on every Debian Linux system.
gist.github.com/thesamesam/22...
www.openwall.com/lists/oss-se...
My merch is available at
based.win/
Subscribe to me on Odysee.com
odysee.com/@AlphaNerd:8
₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿
Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436
Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV
Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079
Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF

[@MeowtronStar]

>"I'm not a security researcher." >Saves the entire world from a cybersecurity disaster.

[@Wolkebuch99]

Hope he gets a raise for it

[@trollface9223]

kinda like supa hot fire sayin “im not a rapper”

[@DonaldDucksRevenge]

Everyday heroism is why FOSS works and proprietary/state jelly

[@thebiggestmonkey9172]

He's a hero for fun

[@samic]

@@DonaldDucksRevenge Doubt it. It's discovered by chance (by noticing the slowdown, not code review). If FOSS works then it should've been caught much earlier. Heck, we don't even know how many repos out there being compromised like this. This is a wakeup call and everyone shouldn't be complacent.

[@isbestlizard]

I love how this dev fucked up a years long nation-state led effort to backdoor linux because he was curious about why sshd was taking 500ms longer to start XD

[@OhNotThat]

Credit to Microsoft for fixing the bugs of it's competitors.

[@jebril]

I wonder which nation that would be? Hmmmmmm 🤔🤔🤔🤔

[@isbestlizard]

@@jebril Most of Jia's activity was between 1200UTC and 1800UTC so I'm thinking Russia or Israel. Bit early for USA and bit late for China

[@jebril]

@@isbestlizard oh I know which one and its one of the ones you said and not Russia

[@JodyBruchon]

​@@isbestlizard Their IP in one leak starts with 185 which is unambiguously Chinese.

[@Jordan-hz1wr]

Microsoft: SSH is milliseconds slower? Investigate! Microsoft: Teams takes 20 minutes to load? Working as intended.

[@KangMinseok]

😂

[@bren.r]

Microsoft Teams has to be the worst abomination of software in existence. Literally open up dev tools and see how expensive just scrolling is.

[@gagongtarantado]

hahahahahahaha

[@ashvio]

To be fair it takes a while for all the backdoors to send everything to every government in the world

[@abc.52]

😂. Me who literally updated the software with the bug version 3 hours before it was detected and was the first time using linux from Windows

[@xramejin]

There is something beautifully ironic about a Microsoft developer saving Linux.

[@halfsourlizard9319]

Um, Microsoft makes a crapload of money off of Linux because Azure.

[@escapetherace1943]

microsoft heavily uses and makes money from Linux as well as contributes to it mr. smoothbrain

[@user-wg2vw3mz1v]

He's so fired 😂 😂 😂

[@RedSaint83]

Idk, Microsoft not giving a sh1t about Windows anymore because they make more money on the cloud is making me think they care a lot about Linux these days.

[@VallisMansonOfficial]

I specialized in running Linux programs on Windows (no certs, no school) to avoid paying for Fruit Loops/FL Studios. I see nothing ironic here, I learned it for A/V tools on used old office computers.

[@first_among_synthers]

Lesson learned: do not let people heckle you into releasing faster.

[@acters124]

Especially when they are trying to become a new maintainer, we should contact the original maintainer and get his input and maybe give some support

[@pajeetsingh]

Kudos to Jigar Kumar.

[@kindnssmc]

@@acters124He stated himself he was going to look into it however his mental health is not in the best state right now so he should be given some time for himself.

[@ClokworkGremlin]

"Late is temporary. Suck is forever." -Gabe Newell.

[@bahshas]

@@pajeetsingh cousin of the infamous bigar-nigar

[@Syncopia]

I like how this dev ssh'd so many times in his life such that he could detect millisecond level delays. Truly a working class man.

[@MutleeIsTheAntiGod]

This is the power of unrestrained autism

[@rylan76]

Wasn't he running some kind of timed testbench script where he was doing thousands of connects and noticed it in there...?

[@throwaway6380]

He sits at a computer desk all day, so pretty much the opposite of being working class

[@_________________404]

@@throwaway6380 Fr. Bro is like a mage in his tower looking down at the peasants walking by.

[@Wierdcrap]

Well he said he also saw cpu usage going up and some other little things but man he’s observant I’ll tell you that

[@user-ex6xc5ox3k]

I feel so bad for the poor maintainer. He's been thanklessly working on this thing that the entire modern world depends on, almost completely alone and now he has to deal with this shit.

[@andrewharrison8436]

... and all the shade cast on his release schedule during the social engineering.

[@SXZ-dev]

The entire world doesn't depend on XZ tbh, it's one of many compression libraries in Linux, there's multiple alternatives to XZ, but yes that OS maintainers don't get paid a cent for their work is a major crime, that companies make billions off the backs of people like Lasse who get nothing out of it is a felony

[@otm646]

I disagree, with this spotlight he's likely to get all the help he could ever want and all the scrutiny to make sure something like this never happens again.

[@Quaker763]

​@@andrewharrison8436This, in my mind, is the biggest gap here. This would never have happened with an attitude that Torvalds has where he would have called this guy a sanctimonious twat. The maintainer should've told the people on the mailing list to shove it.

[@axelwickm]

​@@SXZ-devwell, the entire world definelty depends on ssh tho

[@m4rt_]

fun fact, "freund" is German for "friend". So a guy named friend, who is not a security researcher, saved us all from a huge security threat.

[@NuclearToaster98]

I commented this earlier as well, but it was deleted for some reason. Anyway, it's funny how prophetic names can be sometimes.

[@qlippoth13]

@@NuclearToaster98 Right? Achan for example.

[@therealcouchpotato9560]

He’s not even a security researcher either, he was just doing some testing on the unstable build of Debian and noticed that SSH was being slightly too slow and taking up slightly too much CPU. Think of all the people who never even notice crypto miners stealing all of their recourses and just think their computer is old.

[@Doctom91]

@@NuclearToaster98 Nomen Omen

[@user-tb8se1gq2l]

red pill, blue pill, both pills. hehe

[@kefpull6676]

Imagine if this was a closed-source software. Undetected for years, if not decades. Infiltrating every "xxx" OS pc.

[@Splarkszter]

Just imagine how many are out there

[@user-wg2vw3mz1v]

Right now I'm debating inside my head whether this proves or disproves ESR's ---------- if CodeBase.Eyes == "Many" then CodeBase.Bugs("ALL") = "Shallow"; ---------- argument.

[@hovnocuc4551]

because decades old backdoors and severe bugs are unheard of in open-source /s

[@0x00a]

To be fair, if it was closed source, they likely wouldn't have been able to get access to the source code in the first place without social engineering, instead of just submitting a merge request to the github repo

[@user-wg2vw3mz1v]

​@@hovnocuc4551 heartbleed LOL

[@m4sterred853]

The amount of time and effort that was spent on social engineering and obscuring of the backdoor for this plan is insane and not in a fun way. We were so close to having Darth Sidus say “execute Order 66.”

[@azahid1aza751]

I'm worried there may be other backdoors like this... guess we never know until someone finds it.

[@AshNonokPlays]

Well we can just reverse that with order 65!😂

[@i-never-look-at-replies-lol]

you can only think in manufactured pop culture references. how far gone is your mind?

[@avinadadmendez4019]

​@@i-never-look-at-replies-lolthese tiktok babies probably didn't even watch the damn movie and are just quoting some scene highlights they binge watched on tiktok

[@cygil1]

@@azahid1aza751 There's a big panic in the open source community right now. I just saw a post about 20+ year old buffer overruns in the Regina Rexx package, a language used by about 7 people.

[@nothingtoseehere449]

this is why software being open source will always be a better option for privacy then closed source proprietary software.

[@KaiBannon]

Its very rare that a code commit will be made with a malicious string of code attached to it.

[@oniimaxxxx6479]

It has nothing to do with open source

[@oggilein1]

@oniimaxxxx6479 if a malicious actor such idk, an employee whos pc has been compromised, or who has been paid off were to implement a backdoor in a closed source project, it would with any luck take quite a while for it to be detected and have made it to production in the mean time, exactly because random pepple can't audit the code like how the exploit was discovered here

[@mgord9518]

​@@oniimaxxxx6479Yes it does. It is much easier to find malicious code in an open source project than a closed source one.

[@JacobJake7]

100%

[@gyrgamer8936]

Never updated so fast after it was found

[@mnemonix1315]

you were on a rolling release or sid ?

[@NeverTrust298]

​@@mnemonix1315 he uses arch btw

[@bocchitherock-ob2bl]

if you are on arch, fear not. chances you've been affected are slim because openssh on arch doesn't depend on liblzma.

[@imorvit]

​@@bocchitherock-ob2bl reverse engineerers haven't dug fully into it, this could be one of hundreds of backdoors for all we know

[@bocchitherock-ob2bl]

@@imorvit that's why i said chances are SLIM (for this specific backdoor, if it was too difficult to infer from context). i would still recommend everyone to update, i did myself.

[@jonahhekmatyar]

NSA is about to have some stern words with Microsoft.

[@davewxc]

They already have the baked in backdoors in the CPU's. No need for this.

[@nojuanatall3281]

3 words to be exact. WE OWN YOU.

[@gairisiuil]

​@@davewxc not in the cpus, but certainly in other chips, mostly on the motherboard

[@CrackHeadDaddy]

​@@davewxcThat is why Linux laptops and coreboot exist .

[@Dragzilla66]

This developer that works for Microsoft just saved our computers. 👀

[@the_expidition427]

A developer which works for Microsoft

[@Dragzilla66]

@@the_expidition427 Yep.

[@AQDuck]

@@the_expidition427 A developer who works for Microsoft

[@theloststarbounder]

Translation: Microsoft paid someone to infiltrate their competitors then bring it to the news. EU and USA did the same but kept failing, maybe the 🐑 believes it this way

[@notuxnobux]

It only affected debian and redhat (servers). Good thing that my server runs arch linux.

[@ashutoshchar940]

All intelligence agency: Don't worry guys there are still many backdoors available

[@Syncopia]

Read up a bit on snowden. This is exactly right.

[@azahid1aza751]

There's probably many others in linux, right?

[@ghoulbuster1]

Backdoors but obviously not at OS level. They are at hardware level.

[@anotherrogue8371]

​@@ghoulbuster1 Fucking Intel management engine

[@UnLancheroMuyPenudo]

Those guys are bussy stimulating their prostates.

[@SuperGamingAli]

TempleOS never has backdoors!

[@The_Ballo]

Or a network stack

[@baumkuchen6543]

or users

[@micahlindley7515]

Or haters.

[@oz_jones]

Only to God.

[@qlippoth13]

Thereby proving In a mad world, only the mad are sane

[@trappedcat3615]

Makes me wonder what is not discovered.

[@fal1026]

This is modern day wizardry.

[@oraz.]

Check out the recent M3 hardware exploit. It's wizardry.

[@terminalvelocity4858]

This had very little to no affect unless running a very recent version of unstable Debian or Fedora without a proper firewall on the attached network. Rolling release distros were patched immediately. Arch Linux was completely unaffected since they do not directly link openssh to liblzma, and thus this attack vector is not possible. Regardless of distro, it would need to be specifically targeted. Chances are the attack was never launched, the state actor or criminal organization behind it was very likely waiting on some scheduled release to go out, and then wait for some specific target or target machines to update to that release. This could have been worse, but it wasn't.

[@eustab.anas-mann9510]

This is why I use Qubes. So I don't have to worry about this stuff.

[@baumkuchen6543]

This comment should have been on top and pinned. Probably replaced the entire video content as it gives more relevant information.

[@ImARichard]

This video has the only honest title out of everything Ive seen on this topic. That man deserves a beer for how much he saved our asses from an inadvertent backdoor.

[@Br1ckInTh3W4LL]

i appreciate Lawrence Systems take on the matter.

[@PeakKissShot]

This is an incredibly inaccurate title

[@JohnSmith-lc1ml]

The title is awful and demonstrates a lack of understanding

[@baumkuchen6543]

Title is quite bad actually. So far the disaster would happen for systems that use distro with SSH linked to compromised library *AND* SSH open to the wild internet.

[@pajeetsingh]

Luke Smith could do as much if he drops his Aristotle larp.

[@mhelmreich1]

It shows weaknesses of open source, and it also shows strengths of open source. A well organised and long term infiltration was nonetheless thwarted by an open set of eyes. Well done Mr Freund!

[@aeebeecee3737]

Meanwhile a thousands of pre installed bloat backdoor hide so well in Apple macOS that never be reported

[@thecon_quererarbitraryname6286]

Because it's the right kind of glowies who are using them LOL 😂

[@ScarfaceLittlebee-mj2ch]

Vault seven

[@surfingbilly9654]

wrong my macos is safe, tim apple said he cares about my privacy!

[@raumfahreturschutze]

@@surfingbilly9654 well shit son, glad I can feel safe now! Thanks for the peace of mind!

[@aeebeecee3737]

@@surfingbilly9654 nice joke

[@iamfinancesensei]

Pro tip: can’t get hacked on linux if you only use proprietary software backdoored by Microsoft and apple

[@gabeclark8050]

Amen brother. Glad I use macOS.

[@Rudolfucius]

@@gabeclark8050 Even better on Mac its the hardware that got unpatchable bugs

[@hybiridtux1237]

You do realise the US government can just pay them to inject backdoors? Lmao. I don't know if they even have to pay them since they are US-based. And if this really was done by the US or something, it would be the same as your current windows installation, backdoored to the government.

[@CalgarGTX]

@@Rudolfucius Real men use unpatched Windows on unpatchable apple hardware

[@leogama3422]

​@@CalgarGTXwhy would *anyone* do that?

[@vasq]

in freund we trust

[@musicalneptunian]

Paul Andy: IT'S IN GOD WE TRUST! THAT IS THE CORRECT TEST QUESTION AND ANSWER! OGUN GONNA SQUASH YOU. [p.s it's a scambaiter inside joke]

[@KuleGuy27]

Most evil Linux hack ever

[@Razzbow]

Nah. Mossad or FSB ​@Octaviu5

[@VallisMansonOfficial]

​@Octaviu5blaming RedHat's bosses? Press X to doubt. They probably paid for those tools, or did the same thing free via BlueHat alts for truly free. You're onto something, it has those markers.

[@VallisMansonOfficial]

**laughs in classified custom Unix Operating Systems** Most evil that The Public knows about

[@NuclearToaster98]

An evil hack discovered and reported by a man who is literally named "friend" in German.

[@Handlebrake2]

Not really a hack.

[@Batwam0]

After the initial angry reaction, I’m starting to feel bad for poor Jia who wasted 2+ years infiltrating and contributing to open source, only to get busted a few weeks after having finally implemented it and the backdoor removed in a few hours. Sorry Jia but you suck at your job 😅

[@zawhernos2541]

These aren't new India has a massive issue of tons of fake account Heavy moderation And pushing these kinda backdoor Don't wanna sound racist but avarage Indians don't even know what others are doing I won't be surprised if the govt was involved in it either

[@sykoteddy]

I wouldn't say he suck at his job, it was pretty mush a fluke that this Microsoft dude was curious and investigated. This will only advance Jia's probable future attempts. Also, I didn't hear he was busted as in getting arrested, maybe I didn't listen close enough. But that alone is a win for him.

[@Bvic3]

@@sykoteddy I hope for him that he's working for his country's spy agency and won't risk anything.

[@lukalicina8230]

​@@sykoteddy I mean whos gonna arrest the NSA? 😂

[@UnLancheroMuyPenudo]

​@@lukalicina8230George Floyd, their lord and savior.

[@2.Plus.2.Equals.5]

Don't worry. NSA is glad no one found the other ones.

[@peessinitro1395]

u mean the hardware level exploits? ye

[@14Anon2]

More likely to be one of the many Israeli cyber warfare or intelligence teams, tbh. NSA is a meme.

[@bluephreakr]

I normally hate Microsoft with every fibre of my being, but the man who discovered this *_MUST_* be protected, *_AT ALL COSTS._* No telling what's gonna end up happening to him because he tore the veil on this backdoor wide open. Do not permit him and his livelihood to fall into obscurity!

[@purpleey]

Whats this gotta do with microsoft. And why are u talking like this guy is gonna be a target for assasination or something 😂

[@oggilein1]

@purpleey if you actually watch the video youll notice the part where the dude who discovered it is a microsoft employee. as for why people would want him gone for discovering their exploit...

[@tcbobb1613]

@@purpleey He worked for microsoft So maybe safe to say that it was not an used US backdoor. Or he didn't know

[@berrywin]

So you hate MS with every fibre. How old are you? 12?

[@Xioverze]

@@purpleey he fucked with state actors

[@cocogus]

Was just talking about waiting for your video on it 10 minutes before you uploaded this. You're glowing kinda bright

[@leandrolaporta2196]

outstanding video, explain in excellent detail!, i saw that there was a few youtubers already talking about this but i wanted to wait for yours, you don't dissapoint! thank you!,

[@djstacktrace]

Excellent analysis. Thank you for taking the time to explain this so well.

[@1____-____1]

The Linux Foundation should bring this project in-house. It's that important...

[@FineWine-v4.0]

You know who funds TLF ?

[@1____-____1]

@@FineWine-v4.0Sure they publish reports yearly, the tone of your comment implies this is a bad thing. How?

[@kurenai5000]

Thankyou for the technical analysis. This is what I came for.

[@IMBlakeley]

Given the effort some group is putting in here makes you wonder that this is almost certainly not the only hustle they're running, just the one they got caught doing.

[@dannyl6507]

Excellent detailed coverage! Thank you!

[@awecwec3720]

really great videos, Thanks!!

[@kulled]

This is why you don't trust commits from FMC

[@user-wg2vw3mz1v]

FMC?

[@methe7738]

@@user-wg2vw3mz1vwondering the same thing

[@youtub-fj8mu]

@@user-wg2vw3mz1v Fit MC

[@omnitone]

@@user-wg2vw3mz1vi second this.

[@HazyHuesOfficial]

@@user-wg2vw3mz1v I'm not a lawyer, but I think it means Ford Motor Company

[@deadshxll]

To summarize, the maintainer of xz utils was carefully social engineered by an APT who wanted to conduct a supply chain attack on that utility.

[@bottlewisp]

linux neckbeards went awfully quiet lately...

[@destroyonload3444]

NSA just can't catch a break lately

[@PoposteriousExe-ph5em]

Rip

[@Fractal_32]

I was waiting for Kenny to make a video on this.

[@thunderbolt_blitz]

So no head ?

[@theman3198]

He's got a point

[@qlippoth13]

Is there a smashed smart phone and broken skateboard to go with this comment?

[@hiralpatel3863]

Very well explained. Great job I’m glad use found this and reported

[@nickmalone3143]

Really good breakdown of issue

[@iamfinancesensei]

Sayin “im not a security researcher”. while casually saving the entire world from a hacker.. im sure his Batman on weekends

[@psihozefir]

After a system is compromised, it can call home and install extra stuff immediately, so even if you clean up the intial attack vector, the system remains compromised, so you need to reinstall it clean.

[@columpaget5167]

great breakdown of this. Thanks.

[@EFXTVe]

Quite a compelling narrative indeed! The intricate complexities of cybersecurity are starkly unveiled in this exposé. It's a stark reminder of the perpetual vigilance required to safeguard against such surreptitious incursions. Kudos to the elucidative presentation!

[@AkarshanBiswas]

Jia Tan, Jigar Kumar and Jansen Hans all start with Js so its the same person's different alts I think.

[@harshwardhansingh6433]

its the same government agent

[@maybachvito]

Agent John from CIA

[@szuperrosszarcu]

@@maybachvito More like Agent Jurij from FSB.

[@robw6954]

@@szuperrosszarcu or Jair from M@ssad

[@adrunkenloner]

Never been happier to be running xz 5.4

[@bingusbongus1656]

Same here, just checked my version and it makes me feel good being on Debian 12.

[@typingcat]

Ha. I'm 5.6.1-3 build date yesterday. Arch.

[@clashking3739]

Arch isn't affected anyways​@@typingcat

[@SumNumber]

What a great breakdown ! :O)

[@shavebunny]

Been waiting for this

[@S.H.A.N.D.E.R]

Just read a article about this and was hyped waiting for this vid

[@baddudecornpop7328]

The very honest sounding jigar kumar😂

[@zacharyoswald4264]

Good content, thanks 👌

[@Fudmottin]

This video digests the xz attack down to something I can manage to get my head around since I'm not a security researcher either. It's an interesting case because clearly it is both a technical attack *and* a social engineering attack on the xz-utils package. BTW, Homebrew has it for MacOS too. They did the downgrade option.

[@unicornpoo7441]

didnt target macos + it only targeted x86

[@Fudmottin]

@@unicornpoo7441 Yes but Homebrew downgraded anyway. Obviously the binaries wouldn't work on M series MacOS. I'm less sure about Darwin because LLVM and GCC do have a lot of compatibility when you get down to C level code. x86-64 MacOS still is maintained.

[@raul0ca]

Now think about all the other backdoors...

[@Lua64]

He could be you, he could be me.

[@user-jq6ro5rt6s]

totally! it really is unsafe using an operating system that can be changed by anybody. thats why i keep myself safe by using a licensed copy of Microsoft™ Windows 11 Home! perfect for gaming and productivity, buy yours today!

[@karmatic_cutie]

@@user-jq6ro5rt6s Ah, but you see, that is exactly what makes Linux so much more secure. Windows vulnerabilities get discovered when a new attack is launched and is already dealing damage. Linux vulnerabilities get discovered by inspection, patched, and then blogged about to share expertise.

[@karmatic_cutie]

@@user-jq6ro5rt6s That's actually what makes Linux so much more secure. Windows vulnerabilities aren't fixed until the attack has been launched and is already doing damage. Linux vulnerabilities are discovered through inspection, patched, and then blogged about for expertise.

[@CrackHeadDaddy]

The NSA has access to them all. Glowies everywhere.

[@derdeolifant]

So this is the "tests" backdoor method - I wonder how many more projects have extra "tests"

[@Swineflu-jm7wx]

Thank you for the info

[@OiTzLeetie]

Love this channel

[@MisakaMikotoDesu]

This is why you don't run bleeding edge

[@ckm5528]

Autism saved the internet

[@qlippoth13]

Unit 9900

[@Pre-op8ut]

Hardly. Far from it.

[@interstellarsurfer]

Thanks NSA. 👍

[@OhNotThat]

Arch bros, we just can't stop winning.

[@glass6582]

i use arch btw

[@terminalvelocity4858]

Facts. When I read the arch-anounce "Arch does not directly link openssh to liblzma, and thus this attack vector is not possible." 😎🚬

[@a.b-Clay]

My next goal is Arch. I've been slowly and surely learning how to use different distros. I think I'll be ready for Arch soon

[@LC-mq8iq]

Yeah, Arch only has a bajillion malicious packages on the AUR

[@Lua64]

@@LC-mq8iq name one

[@zoidberg444]

A guy who works for Micro$loth yet never the less did a good deed. We salute you sir.

[@dkosmari]

Microsoft makes a lot of money from contracts with governments, universities, banks, etc. Sometimes these contracts requires them to support systems running all sorts of non-Microsoft products. If I were to guess, that's the reason they hired this PostgreSQL developer; PostgreSQL is a direct competitor to Microsoft's SQL Server. So let's not give MS too much credit here.

[@lv1543]

He did the needful

[@o_glethorpe]

Does not matter if the source is open if there is nobody looking

[@halfsourlizard9319]

The point is that people are looking ... otherwise this wouldn't have been found.

[@o_glethorpe]

@@halfsourlizard9319 no, it was found by accident, nobody was looking

[@synapse0]

And blackbox systems aren't being looked at at all.

[@johnmishell234]

@@halfsourlizard9319They didn't look when the email address was changed

[@esentries]

The fact that this got discovered before catastrophic consequences shows you that there is someone looking.

[@willo7734]

All of this makes me wonder how many more of these backdoors are out there that nobody has found yet.

[@allwell8324]

Good summary

[@junfour]

Makes me wonder if we've missed any

[@SCH4LK]

NSA: "Oh no, one of our thousand back doors is now closed"

[@vlogulsibian]

we can instruct the PowerShell in windows to not execute sny code except is signed . or we can also midify command prompt, terminat, powershell....and convert any code from unknown source into unexecutable code

[@rajvinder89]

I wonder how many other commonly used utilities have been backdoored this way, I imagine a lot of people are going to do a line by line code audit at some point (if not already) of these distros.

[@kailashkatheth1871]

important tools like these should be marked as feature complete

[@andremitreuter5397]

Really scary how this could happen with opensource software, especially such commonly used one. Always thought that enough teustworthy eyes are upon it to prevent actions like this.

[@TabunLaced]

this is why i use windows still

[@g9w]

​@@TabunLacedless people watch/review the code for proprietary software. compromising a single employee or just forcing the company to implement a backdoor is also easier than what they tried here (which took multiple years and still got them caught).

[@jub8891]

Its a blessing that its open.. if this had been closed source nobody would be able to scrutinize the code.. there would be no trails in mailing lists.. we would just be onblivious to its existence

[@alexkt3400]

@@TabunLaced Nope, that's not why.

[@the-answer-is-42]

In a way I am glad this happened the way it did because we were really lucky and it could have been so much worse. We can also learn a lot from how this was done to reduce the risk of future successful backdoors like this, if we take the right lessons to heart.

[@user-cl5wn9fz7f]

I love this channel

[@isbestlizard]

The scary thing is AI is going to make sockpuppets much harder to detect when the AI can spend years building up their legends automatically :/

[@timewave02012]

No, the scary thing is that the scenario you're describing is probably well underway.

[@natsariat430]

F*k!

[@notarealperson9709]

Freund = prounounced froind in english = friend in german

[@qlippoth13]

Jia, just your average Zhou in CCP

[@likemy]

makes you wonder how many other packages in popular open source software (perhaps even linux distros) have state-actor backdoors in them that are to date unnoticed

[@opusdei1151]

4:34 I started with Gentoo, I know what it is like to work with. Especially, if you compile the kernel yourself. And this is pretty accurate xD

[@jirayahatake]

I hope this puts eyes on other widely used open source projects, its naive to think this is the only instance of a long con compromise. Especially if it is a state sponsored attack.

[@DeclanDSI]

The green reddit has been spazzing out about this lol. Kinda useful in a sense so that I could check which ver of xz I had, but luckily it seems I am maybe safe.

[@user-wg2vw3mz1v]

Never have I been so happy to be a master procrastinator... xz-utils v5.2 😂 😂 😂

[@propahchels]

Oy vey, shut it down

[@anycolouryoulike9160]

makes me wonder how many of these attacks went unnoticed.

[@brisk_gift]

Nice video

[@hicham0]

I was waiting for mental outlaw to make a video on this topic and as always he never disappointed

[@MacGuffin1]

Jia Tan totally sounds like the name of an FBI coder coding something they could never use.....

[@Epic_C]

Or Chinese government

[@HCG]

Your first thought is FBI? Lmao ok CCP sympathizer

[@Daniel-Six]

Is it possibly a linguistic conceit? Jia Tan could be pronounced "Shaitan" (Satan). If it had been successful that would have been an appropriately ominous label for it; The Shaitan Exploit. 😮

[@leezhieng]

@@Epic_C Sounds like a made up Chinese name. This name is not using the pinyin naming convention used by mainland Chinese, but a lot of oversea Chinese especially American Chinese or Singaporean Chinese will use a name like this. People who are not familiar with mainland China will not aware about this. Someone probably just used a Chinese name he commonly saw around the place he lives. People who know the difference between mainland chinese and oversea chinese (like me) can spot this shenanigan instantly.

[@reeddeer793]

Probably CCP or NatZeee Russia

[@pentestvegan]

the guy who found it is too based to be merely human, we thank you friend

[@Betruet]

thanks for the quality breakdown

[@Nimta]

Stuff like this is *exactly why* core packages and utils roll out so slowly. Debian stable is still comfortably running 5.4.1, and the testing maintainers are no doubt going to fix the issue before it trickles down to the mainstream userland builds, the servers, etc.

[@alexkt3400]

If you wanna shit some real bricks, consider the possibility that this hack was aimed towards compromising existing developers and contributors to OSS, so they can in turn be used to compromise projects from the inside. Having dirt on a bunch of actual devs is so much better than having a single backdoor propped up by sockpuppet accounts.

[@saldownik]

I wonder how many comparable back doors keep remaining unnoticed.

[@alisterh9593]

I'm trying to get into it starting linux ect ... I've Seen vidéo talk about it and understant bit hère and there (liké 10/15 vid ) but this vid help Me understant thé hole shtick and was the better one 100% so thanks you g

[@swayze_mane]

this is just the shit someone found, imagine everything they haven't found/wont find

[@thedarkenigma3834]

Yeah, this news is pretty crazy.

[@y0n6u]

luckily only the unstable branch of debian was affected. it's funny that slow distros can increase safety by adding some lead time to new commits

[@krellin]

i think the side channel attacks are much more complex and than what this attack was... but the potential damage this could do is arguably bigger. Imagine what kind of blatant malware is installed in closed source systems, they probably dont even need to bother to this extent to obfuscate and hide their malicious code...

[@dkosmari]

We don't need to guess. The Snowden leaks showed, the NSA literally paid RSA to put a backdoor in Dual_EC_DRBG.

[@teambridgebsc691]

Wow, what a story, just like a novel ;-)

[@pxolqopt3597]

Guy spent 2 years cooking this up just for some dude to just so happen to stumble on it before it could do any damage, i'd feel bad if jia tan wasnt so evil

This reminds me of that scene in Alias were Marshall is talking to his new pals at the CIA how he previously detected that SD-6 was breached by the CIA. He explained that he was playing video-games on the agency's servers when he noticed a drop in frames. I've always seen that scene as wholesome but unrealistic, but after this I guess that wasn't too farfetched after all.

[@G11713]

This is the one they found. I wonder how many more exists. Clearly the process is the issue. In particular, this post build rearrangement of the production code through a validation process...

[@tommyaudio]

i love how that silicon valley show had hyper compressed data as part of their storyline, an idea that's actually legit

[@the_expidition427]

Saving this

[@ERROR204.]

The idea that compression exists and some is better than others? Wild

[@magzpayne]

lzma compression is hardly something new since it's been around since 1998. It's the default library for 7z iirc

[@ClokworkGremlin]

​@@magzpayneit's the default library for *everything,* including Windows compressed folders.