‘xz utils’ Software Backdoor Uncovered in Years-Long Hacking Plot

[dontcryforme]

'xz utils' Software Backdoor Uncovered in Years-Long Hacking Plot - UNICORN RIOT

A fascinating but ominous software story dropped on Friday: a widely used file compression software package called “xz utils” has a cleverly embedded system for backdooring shell login connections, and it’s unclear how far this dangerous package got into countless internet-enabled devices. It...

unicornriot.ninja

Xz-utils versions 5.6.0 and 5.6.1 were found to have the malicious programming added by “Jia Tan” (jiaT75) on GitHub. It got into the widely used Debian testing (pre-release) branch but not the stable branch. It also made it into the widely used OS X third-party package manager homebrew (although maintainers are optimistic it may not actually affect Apple machines). Red Hat also warned that some Fedora Linux 40 systems (as well as Rawhide, the pre-release for Fedora 41) may have gotten the malicious software. Jia Tan’s activities extended beyond just the xz-utils code, which people discovered on Friday.

 

[Clean Green]

Playing the long game. Luckily got caught.

 

[aktiv]