Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Submission + - xz/liblzma Backdoored, Facilitating ssh Compromise

ewhac writes: A backdoor has been discovered in the liblzma data compression library, whose purpose is to facilitate a compromise of ssh. liblzma versions 5.6.0 and 5.6.1 are known to be affected. Debian's "unstable" and "testing" repos yesterday rolled back the library by pushing version "5.6.1+really5.4.5-1" to mitigate the exposure. RedHat is also recommending all users roll back to a pre-5.6.0 release.

The backdoor is not in the source code, but rather is in the test suite contained in the distribution tarballs. Hostile payloads masquerading as test data are decompressed during the ./configure phase to modify the Makefile and drop modified versions of liblzma_la-crc32_fast.o and liblzma_la-crc64_fast.o. When the compromised library is loaded by client programs (such as ssh), these in turn install an audit hook in the dynamic linker, allowing them to intercept lookups/calls to RSA_public_decrypt@....plt, which it then replaces with its own code. This compromise appears to have only been discovered in the last few days; study of the precise nature and scope of the compromise is ongoing.

Submission + - Malicious code discovered in popular xz utils (arstechnica.com)

Cognitive Dissident writes: Code designed to compromise SSH connections has been discovered in a widely used compression utility
.

The compression utility, known as xz Utils, introduced the malicious code in versions 5.6.0 and 5.6.1, according to Andres Freund, the developer who discovered it. There are no confirmed reports of those versions being incorporated into any production releases for major Linux distributions, but both Red Hat and Debian reported that recently published beta releases used at least one of the backdoored versions—specifically, in Fedora 40 and Fedora Rawhide and Debian testing, unstable and experimental distributions. Because the backdoor was discovered before the malicious versions of xz Utils were added to production versions of Linux, “it's not really affecting anyone in the real world,” Will Dormann, a senior vulnerability analyst at security firm ANALYGENCE, said in an online interview. “BUT that's only because it was discovered early due to bad actor sloppiness. Had it not been discovered, it would have been catastrophic to the world.”

The really worrying part here is that the developer clearly did it on purpose, and he has been on this project for a solid two years. This raises all sorts of questions about the security of Linux in general. How many other 'deep cover' operatives might be planning or actually in the process of inserting malicious code into the Gnu/Linux code base?

Submission + - Red Hat issues urgent alert for Fedora Linux users due to malicious code (betanews.com)

BrianFagioli writes: In a recent security announcement, Red Hat’s Information Risk and Security and Product Security teams have identified a critical vulnerability in the latest versions of the “xz” compression tools and libraries. The affected versions, 5.6.0 and 5.6.1, contain malicious code that could potentially allow unauthorized access to systems. Fedora Linux 40 users and those using Fedora Rawhide, the development distribution for future Fedora builds, are at risk.

Comment If McKinsey Shows Up, Your Company Is Fscked (Score 3, Interesting) 56

John Oliver on Last Week Tonight did a whole show on McKinsey. The service they actually provide, as has been noted earlier in these comments, is a way for management to deflect responsibility for what they were always planning to do, anyway, which is usually budget cuts and layoffs, and/or massive boosts to executive pay packages.

Here's the show.

Comment Re:End Qualified Immunity (Score 2) 164

Sending in SWAT was specious at best, as the "evidence" was not particularly compelling. I get they were searching for a number of violent carjackers, but (as we see): The carjackers were not there, and more importantly, they were at least smart enough to know that when they saw AirPods, they should ditch them.

The qualified immunity angle is simple: Qualified immunity means there's vanishingly small chance of legal recourse for the people whose property has been damaged and lives have been turned upside down because any of a number of dumbassses in the chain of errors couldn't imagine somebody born in the last two decades would know to ditch a homing beacon.

The only reason Chauvin is in prison is because is simple: massive amounts of public unrest. It's easy for some outlets to dismiss unrest in some areas - for example, conservative outlets like to dismiss unrest in more liberal cities like Portland, for example. That leads to the problem you can't ignore: when you've got a riot in deeply conservative, police-supporting, sleepy, and almost entirely white Salt Lake City over a cop killing a black man over a thousand miles away -- that's a different matter entirely.

In nearly every case nationwide, the police can destroy your property and literally end your life with near impunity due to qualified immunity, as long as they have "probable cause." In this case, the "probable cause" was a set of AirPods (wisely?) dumped out the window by the carjackers.

Comment Re:Felony Wire Fraud/RICO? Or NSL Compliance? (Score 1) 75

Not only does the Mac manage disclose the behavior of -cacert, so does the Linux manage, and the manage on man7.org, and curl.se

Additionally, the macOS CA keystores are easily searchable, verifiable, and modifiable. If you want to go to your system, remove all of the CA Certificates and verify that -cacert doesn't verify after deleting keys, you can do that.

You can also clone the source code Apple publishes for their fork of cURL - which they do for every patch of macOS.

I dunno... part of me wonders if it's just a difference of opinion on how much it's worth trusting the system CA store - Apple seems to believe the system CA store should always be trustworthy, and the cURL maintainer doesn't have such faith. The nature of open source software means that forks are allowed, and the maintainer isn't happy about that particular choice, and is bringing attention to it.

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Working...