Monday, April 1st 2024

Researcher's Curiosity Uncovers Backdoor in Popular Linux Utility, Compromising SSH Connections

In a interesting discovery that sent a series of shockwaves through the Linux community, Andres Freund, Principal Software Engineer at Microsoft, located a malicious backdoor in the widely used compression tool called "xz Utils." The backdoor, introduced in versions 5.6.0 and 5.6.1 of the utility, can break the robust encryption provided by the Secure Shell (SSH) protocol, allowing unauthorized access to affected systems. What Andres Freund found is that the latest version of xz Utils is taking 0.5 seconds in SSH on his system, while the older system with the older version took 0.1 seconds for simple processing, prompting the user to investigate and later send a widespread act for caution. While there are no confirmed reports of the backdoored versions being incorporated into production releases of major Linux distributions, the incident has raised serious concerns among users and developers alike.

Red Hat and Debian, two of the most well-known Linux distribution developers, have reported that their recently published beta releases, including Fedora 40, Fedora Rawhide, and Debian testing, unstable, and experimental distributions, used at least one of the affected versions of xz Utils. According to Red Hat officials, the first signs of the backdoor were introduced in a February 23 update, which added obfuscated (unreadable) code to xz Utils. A subsequent update the following day introduced functions for deobfuscating the code and injecting it into code libraries during the utility's update process. The malicious code has been cleverly hidden only in the tarballs, which target upstream releases of Linux distributions.
The backdoor is specifically designed to interfere with the authentication process performed by SSH, a critical protocol used for secure remote connections to systems. By breaking the encryption provided by SSH, the backdoor allows malicious actors to gain unauthorized access to the entire system, potentially compromising sensitive data and resources. Users of affected distributions are advised to exercise caution and apply any available patches or updates as soon as possible to mitigate the risk of exploitation. As the investigation into this security breach continues, the incident is a stark reminder of the importance of vigilance and regular security audits, even in the open-source software ecosystem. The Linux community is and must remain proactive in identifying and addressing such threats to ensure the integrity and security of Linux-based systems that power today's entire modern infrastructure.
Sources: OpenWall Post by Andres Freund, via Ars Technica
Add your own comment

14 Comments on Researcher's Curiosity Uncovers Backdoor in Popular Linux Utility, Compromising SSH Connections

#1
AleksandarK
News Editor
Not an April Fool's joke. Also, don't try to trick engineers; they will always find out. :)
Posted on Reply
#2
Ferrum Master
Pretty lazy made article.

Basically the bad actor was active for this repo for a year... he has hundreds of contributions... including for Microsoft Visual Studio... The impact could be grand.
Posted on Reply
#3
Chaitanya
Red Hat themselves had posted about this on 29th March along mitigations:
www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
Updated March 30, 2024: We have determined that Fedora Linux 40 beta does contain two affected versions of xz libraries - xz-libs-5.6.0-1.fc40.x86_64.rpm and xz-libs-5.6.0-2.fc40.x86_64.rpm. At this time, Fedora 40 Linux does not appear to be affected by the actual malware exploit, but we encourage all Fedora 40 Linux beta users to revert to 5.4.x versions.
Edit: interesting addition seems like even the downgrade is compromised.
tukaani.org/xz-backdoor/
Ferrum MasterPretty lazy made article.

Basically the bad actor was active for this repo for a year... he has hundreds of contributions... including for Microsoft Visual Studio... The impact could be grand.
Also atleast 3 days late.
Posted on Reply
#4
Ferrum Master
ChaitanyaAlso atleast 3 days late.
Indeed.

Here's a good write up in understandable language about how the malicious codes operates. There are even speculation about him acting in in multiple names... a whole drama with popcorn.

gynvael.coldwind.pl/?lang=en&id=782

And a pic... don't make jokes about the font the dude used.

Posted on Reply
#5
Chaitanya
Ferrum MasterIndeed.

Here's a good write up in understandable language about how the malicious codes operates. There are even speculation about him acting in in multiple names... a whole drama with popcorn.

gynvael.coldwind.pl/?lang=en&id=782

And a pic... don't make jokes about the font the dude used.

So overall a mess and going to be quite a headache to cleanup.
Posted on Reply
#6
JasBC
Please stop using LLM-generated imagery.
Posted on Reply
#7
Ferrum Master
ChaitanyaSo overall a mess and going to be quite a headache to cleanup.
It can be so bad, that guys will dig up backups on tape drives to compare old versions, if some are not compromised. It will be a heck of a job for the community.

Well that's a shame anyone still uses xz instead of superior zstd.
Posted on Reply
#8
ScaLibBDP
Ferrum MasterIt can be so bad, that guys will dig up backups on tape drives to compare old versions, if some are not compromised. It will be a heck of a job for the community.

Well that's a shame anyone still uses xz instead of superior zstd.
As a matter of fact XZ utility and XZ archives are widely used! Here are examples:

[ Ubuntu RISC-V images ]
cdimage.ubuntu.com/releases/22.04.3/release/ubuntu-22.04.3-preinstalled-server-riscv64+unmatched.img.xz
cdimage.ubuntu.com/releases/22.04.2/release/ubuntu-22.04.2-preinstalled-server-riscv64+unmatched.img.xz

[ Fedora RISC-V images ]
dl.fedoraproject.org/pub/alt/risc-v/repo/virt-builder-images/images/Fedora-Developer-Rawhide-20200108.n.0-sda.raw.xz
dl.fedoraproject.org/pub/alt/risc-v/repo/virt-builder-images/images/Fedora-Minimal-Rawhide-20200108.n.0-sda.raw.xz

[ OpenSBI installs ]
github.com/riscv-software-src/opensbi/releases/download/v1.2/opensbi-1.2-rv-bin.tar.xz
github.com/riscv-software-src/opensbi/releases/download/v1.1/opensbi-1.1-rv-bin.tar.xz
github.com/riscv-software-src/opensbi/releases/download/v1.0/opensbi-1.0-rv-bin.tar.xz

[ Linux aarch64 hosted compilers and tools ]
ampere-9.3.0-20200410-nativetools.tar.xz
ampere-9.3.0-20200410-dynamic-nativetools.tar.xz

[ AMDGPU-Pro Beta Mining Driver version 17.40 for Linux ]
www2.ati.com/drivers/linux/beta/ubuntu/amdgpu-pro-17.40-483984.tar.xz
www2.ati.com/drivers/linux/beta/rhel/amdgpu-pro-17.40-483984.tar.xz
Posted on Reply
#9
xorbe
I read that the bad actor also committed changes to libarchive, which Microsoft has integrated into Win11 as of 2023 Q3.

I would also ask why liblzma can take over an ssh server process ... seems like some kind of hardening is missing here (ideally).
Posted on Reply
#10
Shihab
AleksandarKWhat Andres Freund found is that the latest version of xz Utils is taking 0.5 seconds in SSH on his system, while the older system with the older version took 0.1 seconds for simple processing, prompting the user to investigate and later send a widespread act for caution.
Great. Just as I was getting over the paranoia triggered every time one of my software hang for a millisecond...
Posted on Reply
#12
ScaLibBDP
## Summary of All verifications I've completed on Linux systems around me

## Ubuntu Server 20.04 for RISC-V ( with Desktop UI Manager )

root@ubuntu:~# xz --version
xz (XZ Utils) 5.2.4
liblzma 5.2.4

## Ubuntu Server 20.04 for RISC-V ( without Desktop UI Manager )

root@ubuntu:~# xz --version
xz (XZ Utils) 5.2.4
liblzma 5.2.4

## Debian Server 13.2.0 for RISC-V ( without Desktop UI Manager )

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
!!! Attention
!!! XZ Utility Affected!
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

root@debian:~# xz --version
xz (XZ Utils) 5.6.0
liblzma 5.6.0

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!
!!! Attention
!!! XZ Utility Manually Downgraded
!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

root@debian:~# xz --version
xz (XZ Utils) 5.4.5
liblzma 5.4.5

## Fedora Server 33 for RISC-V ( without Desktop UI Manager )

root@fedora-riscv:~# xz --version
xz (XZ Utils) 5.2.5
liblzma 5.2.5

## Ubuntu Desktop 16.04 LTS for x86 64-bit ( for Xilinx FPGA R&Ds )

ubuntu@ubuntu-vm:~$ xz --version
xz (XZ Utils) 5.1.0alpha
liblzma 5.1.0alpha

## Ubuntu Desktop 18.04 LTS for x86 64-bit

ubuntu@ubuntu-vm:~$ xz --version
xz (XZ Utils) 5.2.2
liblzma 5.2.2

## Ubuntu Desktop 20.04 LTS for x86 64-bit

ubuntu@ubuntu-vm:~$ xz --version
xz (XZ Utils) 5.2.4
liblzma 5.2.4
Posted on Reply
#13
R-T-B
ScaLibBDPAs a matter of fact XZ utility and XZ archives are widely used! Here are examples:

[ Ubuntu RISC-V images ]
cdimage.ubuntu.com/releases/22.04.3/release/ubuntu-22.04.3-preinstalled-server-riscv64+unmatched.img.xz
cdimage.ubuntu.com/releases/22.04.2/release/ubuntu-22.04.2-preinstalled-server-riscv64+unmatched.img.xz

[ Fedora RISC-V images ]
dl.fedoraproject.org/pub/alt/risc-v/repo/virt-builder-images/images/Fedora-Developer-Rawhide-20200108.n.0-sda.raw.xz
dl.fedoraproject.org/pub/alt/risc-v/repo/virt-builder-images/images/Fedora-Minimal-Rawhide-20200108.n.0-sda.raw.xz

[ OpenSBI installs ]
github.com/riscv-software-src/opensbi/releases/download/v1.2/opensbi-1.2-rv-bin.tar.xz
github.com/riscv-software-src/opensbi/releases/download/v1.1/opensbi-1.1-rv-bin.tar.xz
github.com/riscv-software-src/opensbi/releases/download/v1.0/opensbi-1.0-rv-bin.tar.xz

[ Linux aarch64 hosted compilers and tools ]
ampere-9.3.0-20200410-nativetools.tar.xz
ampere-9.3.0-20200410-dynamic-nativetools.tar.xz

[ AMDGPU-Pro Beta Mining Driver version 17.40 for Linux ]
www2.ati.com/drivers/linux/beta/ubuntu/amdgpu-pro-17.40-483984.tar.xz
www2.ati.com/drivers/linux/beta/rhel/amdgpu-pro-17.40-483984.tar.xz
Gentoo is heavily addicted to xz as well.

This is seriously bad. Hopefully the community can filter out all the nefarious versions at the package manager.
xorbeIf I were Andres Freund, I think I might be worried that I've pissed off the wrong people.
That is not how a security researcher thinks.
Posted on Reply
#14
chrcoluk
I agree this is going to be messy.
Posted on Reply
Add your own comment
Oct 11th, 2024 07:33 EDT change timezone

New Forum Posts

Popular Reviews

Controversial News Posts