Backdoor in ssh in Fedora and Debian testing \ stacker news ~Linux

Backdoor in ssh in Fedora and Debian testing twitter.com/TheBlueMatt/status/1773766955251495311

526 sats \ 9 comments \ @Scoresby 29 Mar Linux

OpenSuse is even recommending reinstalling everything instead of just updating xz. https://news.opensuse.org/2024/03/29/xz-backdoor/

User recommendation For our openSUSE Tumbleweed users where SSH is exposed to the internet we recommend installing fresh, as it’s unknown if the backdoor has been exploited. Due to the sophisticated nature of the backdoor an on-system detection of a breach is likely not possible. Also rotation of any credentials that could have been fetched from the system is highly recommended. Otherwise, simply update to openSUSE Tumbleweed 20240328 or later and reboot the system.

17 sats \ 0 replies \ @fiksn 29 Mar

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

17 sats \ 0 replies \ @Bell_curve 29 Mar

https://www.nobsbitcoin.com/backdoor-in-xz-tools-used-by-most-linux-distros/

17 sats \ 0 replies \ @fiksn 29 Mar

Have to admit hidding the backdoor in obfuscated compressed test data was a genius move

17 sats \ 1 reply \ @kepford 29 Mar

More info: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

17 sats \ 0 replies \ @kepford 29 Mar

Most important parts

PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or personal activity. Fedora Rawhide will be reverted to xz-5.4.x shortly, and once that is done, Fedora Rawhide instances can safely be redeployed. Note that Fedora Rawhide is the development distribution of Fedora Linux, and serves as the basis for future Fedora Linux builds (in this case, the yet-to-be-released Fedora Linux 41).

At this time the Fedora Linux 40 builds have not been shown to be compromised. We believe the malicious code injection did not take effect in these builds. However, Fedora Linux 40 users should still downgrade to a 5.4 build to be safe. An update that reverts xz to 5.4.x has recently been published and is becoming available to Fedora Linux 40 users through the normal update system. Concerned users can force the update by following the instructions at https://bodhi.fedoraproject.org/updates/FEDORA-2024-d02c7bb266.

Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.

33 sats \ 1 reply \ @Scoresby OP 29 Mar

More info:

https://twitter.com/fedora/status/1773775266625499384

100 sats \ 0 replies \ @Scoresby OP 29 Mar

If you're running Ubuntu, seems like you may not be affected:

https://twitter.com/benthecarman/status/1773801544846065688

0 sats \ 0 replies \ @fiksn 29 Mar

Just a few days ago I've installed xz from nixpkgs-unstable on a machine (luckily not my node). How screwed am I? It came from binary cache tho, so configure was never invoked, well at least not on my machine