Malware in xz

[Tolkem]

Hi everyone! Hope you're all having a nice life!
I just bumped into this while checking my feed and thought I'd share here:

'xz utils' Software Backdoor Uncovered in Years-Long Hacking Plot - UNICORN RIOT

A fascinating but ominous software story dropped on Friday: a widely used file compression software package called “xz utils” has a cleverly embedded system for backdooring shell login connections, and it’s unclear how far this dangerous package got into countless internet-enabled devices. It...

unicornriot.ninja

An excerpt:

Machines can be fully compromised; Volunteer developer burnout seen as opportunity for malicious backdoor insertion, after years of careful infiltration and software patches​

 

[dos2unix]

CVE-2024-3094: Urgent alert for Fedora Linux 40 and Rawhide users - Fedora Magazine

Summary: The latest versions of the “xz” tools and libraries contain malicious code that appears to be intended to allow unauthorized access. Specifically, this code is present in versions 5.6.0 and 5.6.1 of the libraries. Fedora Linux 40 users may have received version 5.6.0, depending on the...

fedoramagazine.org

 

[Condobloke]

https://www.linux.org/threads/malware-in-xz.49315/#post-225125

 

[KGIII]

Something interesting that I just learned, this malware was discovered by someone who works for Microsoft. (Yes, they pay Linux developers.)