Jump to content
  • Software Engineer Stops Attempt to Add Backdoor to Linux Operating Systems

    aum

    • 495 views
    • 3 minutes
     Share


    • 495 views
    • 3 minutes

    Microsoft software engineer Andres Freund discovers a backdoor lurking in the XZ Utils data-compression tools, which are open source and widely used across Linux distributions.

     

    The Linux community narrowly avoided a security disaster after a lone software engineer accidentally uncovered a backdoor that was about to be added to major Linux operating systems. 

     

    Last Friday, Microsoft software engineer Andres Freund noticed the backdoor in XZ Utils, an open-source set of data-compression tools widely used across Linux and Unix-like operating systems. 

     

    Freund said he discovered the backdoor by chance while benchmarking a Linux-based Debian installation. During the tests, he realized that XZ Utils was triggering high CPU consumption with SSH processes, the security protocol for logging into a remote server.

     

    This led him to realize that a component within XZ Utils can inject unauthorized code into a Linux installation to spy on the user’s computer and execute additional malicious code, according to security researchers.  

     

    In response, Linux OS providers Red Hat and Debian have issued security advisories warning users about the threat. But in some good news, the stable versions of Red Hat Linux and Debian never incorporated the malicious XZ Utils components. Instead, the backdoor only made its way to the Red Hat Fedora 40 beta and Fedora Rawhide, along with experimental distributions for Debian. Any affected users should immediately downgrade their XZ Utils version.

     

    "Specifically, this code is present in versions 5.6.0 and 5.6.1 of the (XZ) libraries," Red Hat says.

     

    Meanwhile, US cyber authorities are urging affected users to "downgrade XZ Utils to an uncompromised version—such as XZ Utils 5.4.6 Stable" and hunt for any malicious activity.

     

    The news is once again raising alarm bells about the need to secure open-source software, which is often maintained through volunteer contributors. In this case, the backdoor has been traced to a mysterious user called Jia Tan or JiaT75, who submitted the malicious changes to XZ Utils. Interestingly, Jia Tan seems to have patiently spent the last three years building up his credibility to become a trusted contributor to XZ Utils before adding the malicious code. 

     

    Cryptography expert Filippo Valsorda adds: “This might be the best executed supply chain attack we've seen described in the open, and it's a nightmare scenario: malicious, competent, authorized upstream in a widely used library. Looks like this got caught by chance. Wonder how long it would have taken otherwise."

     

    Source


    User Feedback

    Recommended Comments

    There are no comments to display.



    Join the conversation

    You can post now and register later. If you have an account, sign in now to post with your account.
    Note: Your post will require moderator approval before it will be visible.

    Guest
    Add a comment...

    ×   Pasted as rich text.   Paste as plain text instead

      Only 75 emoji are allowed.

    ×   Your link has been automatically embedded.   Display as a link instead

    ×   Your previous content has been restored.   Clear editor

    ×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...