I think a lot of memes are missing the main point of how it was caught, the exploit caused a spike in CPU usage for a network call. That made no sense to the ~~guy~~ Messiah who found/reported it. FOSS software's strength is the number of critical eyes looking over each line of code you put out!

[–] GBU_28@lemm.ee 36 points 7 months ago

Right but the joke is that most developers aren't of that quality, and are now going to put leredditor super sleuth eyes on every application they build

[–] XEAL@lemm.ee 4 points 7 months ago* (last edited 7 months ago) (1 children)

What was the full story again? I'm googling but I can't find it.

[–] kryllic@programming.dev 20 points 7 months ago* (last edited 7 months ago) (1 children)

In a nutshell, a backdoor was intentionally planted by a malicious actor in xz Utils, an open-source data compression utility widely used in Linux and other Unix-like operating systems. This discovery was made by Andres Freund, a developer and engineer working on Microsoft’s PostgreSQL offerings. He was troubleshooting performance problems on a Debian system. Specifically, SSH logins were consuming excessive CPU cycles and generating errors with Valgrind, a memory debugging tool. Through sheer luck and Freund’s careful eye, he eventually discovered that these issues were the result of updates made to xz Utils. Upon closer inspection, he found that updates to xz Utils were the result of a maliciously inserted backdoor. The backdoor, present in xz Utils versions 5.6.0 and 5.6.1, manipulated the sshd executable, allowing anyone with a predetermined encryption key to upload and execute arbitrary code on affected devices.

[–] XEAL@lemm.ee 7 points 7 months ago (1 children)

I expected a link to a source, but this is even better (matches with the little I remember)

Thanks!

[–] kryllic@programming.dev 9 points 7 months ago

No prob! I think Ars Technica had the best writeup imo: https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/