Ginme a minute to finish my Turkey sandwich and I'll explain
Ginme a minute to finish my Turkey sandwich and I'll explain
ZIn my definition of "low level" I don't exactly mean the base linux packages but rather a base package nearly all linux distros have that's not interfaced or used by most "average users"
Jokay so
ZCould've definitely used a better wording but if you have examples and explanations of how the package is used and in what extend I'd love to hear it
Jssh does not use xz
Jbut the xz backdoor only hijacks ssh
Jso how does it do it?
JSome linux distros (such as Fedora and Debian) patch ssh to link against libsystemd-notify to enable it to send systemd notifications and interact with other components
libsystemd-notify then links against xz and other libraries
libsystemd-notify then links against xz and other libraries
ZSo what's actually happening in connection with the xz package and the SSH connection?
JSSH relies on OpenSSH for a lot of things
Jand xz sets up some redirections to hijack the execution path and does its own thing
Jthe full extend of what it does is not yet known, but it does add its own keys to be accepted
ZAh, so xz wasn't actually something in use with SSH at all but rather added code that used the systemd-notify to know when to execute that separate code?
Jno, it was in use with ssh
Jxz relies on ssh linking against systemd-notify to get into the sshd process
Jand then it modifies openssh at runtime to add its own things
Jthe backdoor explicitly only targets
/usr/sbin/sshdJaka the ssh server
ZYes but what does xz and SSH do to work together originally?
Jssh does not use xz
ZRight so no original connection with each other before the malicious update?
Jor after
Jthe connection is made by distros that modify ssh
Jmainly debian and fedora
ZDebian and Fedora modifies SSH?
Jyes
ZWhy and to what extent??
VNothing crazy lmfao
KThe SSH exploit is this very roundabout thing where a dependency of a dependency of a dependency is exploited to eventually attack SSH
JDistros patch software to fix things, add some things, etc. etc.
KVia xz
Jin the case of OpenSSH its uhhh
Juhhhh
VTypically just small opinionated things. Never anything too major.
VBazzite changes things in "opinionated" ways that are seperate from the defaults.
ZInb4 linux distro with patched SSH with "Commercial grade easy access remote support!" with a picture of a dude smiling with a headset that only has one speaker
VWhen is bazzite pro dropping?
ZAAAAHHHH
ZWHY ARE YOU SHOWING ME NIGHTMARES
VI wonder...
Pthe future of Playtron?
VHAHAHA
Jits worth mentioning that distro maintainers are a dying breed leaving it to fewer and fewer people to do
VMy lubuntu 3D printer ^
Jso things are only going downhill
ZIt's so weird, feels like usage of FOSS and Linux is growing but as you say, it feels like software maintenance and programmer availability is shrinking
Kit comes in waves sometimes
Kthings like XZ make people realize how important this work is
ZI feel like there's definitely two sides of that coin
ZOne side will argument "See, FOSS is filled with people who can maliciously add anything they want and ruin things, commercialised software has a reputation to keep so therefore won't ever happen!"
