Backdoor found in OpenSSH

ndk.focus 9 months ago

Imagine if all government was open source! What a world that would be.

Thanks for this!

valued-customer 9 months ago

They can't stop the signal as long as we keep each other in the loop.

Thanks!

0.00 VYB

goldgrifin007 9 months ago

Dear @valued-customer !
I assumed you were claiming that Google hacks personal information!
Do you recommend using Linux?

valued-customer 9 months ago

Fakebook does. I bet Goolag does too.

"Do you recommend using Linux?"

Yes.

0.01 VYB

valued-customer 9 months ago

Update: Lietu has taken a closer look at what other things might be affected by the malicious code in the xz package, and it's pretty extensive, so I thought to include it.

Take action as necessary to secure such of these common utilities and features you may be using.

0.00 VYB

harvestmoon299 9 months ago

I hope there will be accountability, similar to if an employee at the bank leaves the back door open. Did he accidentally forget to secure it, or was it intentional? Is there a place for law to get involved? You cannot say, "All is good, we caught it this time." Next time it might not be caught as soon or without damage.

ndk.focus 9 months ago

Seems deliberate

valued-customer 9 months ago

Folks looking have found several more exploits in Jia Tan's commits, and no one is suggesting these are just bugs. I keep editing the post, and I added a reply with more information that turned up, trying to provide comprehensive notice of the threat, as there may have been some pre-release installations people might be compromised by.

0.00 VYB

valued-customer 9 months ago

Injecting exploits into oss code is, I believe, a crime. 'Jia Tan' is likely an alias, and one login as 'Jia Cheong Tan' is suspected to be a diversion. There's been speculation that the h4x0r is unlikely to be a state actor, because they are unlikely to create backdoors like this, since when they're found they raise a foul stench that causes great distrust of the state discovered doing it, so they just buy exploits from the ebil h4x0rs that sell them when they need to achieve a particular goal.

I dunno about any of that. It seems to me to be speculation without much basis. One interesting thing about police investigation is jurisdiction. The internet isn't confined to any one jurisdiction, which make crimes committed online sort of outside all jurisdictions. Since no one seems to have been hit by this attempt, most LEA's don't have much motivation to go after this guy.

The more I read about it, however, the more impactful people that know say it would have been if it had been rolled out. Overall, then, the fact a guy investigating a slowdown looking for a random bug in oss code found this instead is a great advertisement for oss software, and a dire warning about blobs like m$, Apple, and etc. sell. If linux was proprietary, this hack would have potentially very severely compromised possibly millions of systems, people, and commercial and government entities, as many have before.

Hurray for oss!

Thanks!

0.00 VYB

limonta 9 months ago

I only use Linux distributions, mainly in the Ubuntu realm. In my student years in my IT-focused university I worked more with Debian. Thanks for this input.

valued-customer 9 months ago

We are really fortunate to have open source software, and the free speech that makes it possible. I try to keep an ear to the ground, just because I can.

Thanks!

0.09 VYB