@AndresFreundTec@mastodon.social
Post #2096818
2024-03-29 18:32 UTC
Replies (37)
-
@tomasv@fosstodon.org 2024-03-29 18:48
@AndresFreundTec OMG, I read that report earlier today and completely missed it's from you. Something tells me this is not the only backdoor that person injected into seemingly boring packages ... fun fun fun.
-
@hikhvar@norden.social 2024-03-29 19:23
@AndresFreundTec https://norden.social/@hikhvar/112180483133159589
-
@ieure@retro.social 2024-03-29 19:28
@AndresFreundTec Sure glad you did. This would have been unimaginably worse if it'd gone undetected for another six months.
-
@clark@hachyderm.io 2024-03-29 19:30
@AndresFreundTec - Thank you Andres! Stay awesome.
-
@erickgu@mastodon.social 2024-03-29 19:37
@AndresFreundTec Kudos.
-
@glyph@mastodon.social 2024-03-29 19:38
@AndresFreundTec I feel both confident and also kind of queasy when saying this: it seems extremely likely that this is not the first time something like this has happened, it's just the first time we have been lucky enough to notice.
-
@Sylvhem@eldritch.cafe 2024-03-29 19:49
@AndresFreundTec I think we are all glad you decided to investigate this. Thank you!
-
@abartlet@mastodon.nzoss.nz 2024-03-29 19:51
@AndresFreundTec I truly admire your skill, willingness to trust your gut and appreciate your doggedness and tenacity chasing this down. The internet is a little safer because of you. Thanks,
-
@acfoltzer@toot.cat 2024-03-29 20:21
@AndresFreundTec outstanding work 🙏🏻 and a great example of the value of following up on "that's weird"s
-
@ian@hachyderm.io 2024-03-29 20:22
@AndresFreundTec Thank you.
-
@SamantazFox@infosec.exchange 2024-03-29 20:33
@AndresFreundTec thank you 🙏
-
@tim@cloudisland.nz 2024-03-29 20:42
@AndresFreundTec Coincidence, but also curiosity and expertise! Very nicely done. Thank you!
-
@phryk@mastodon.social 2024-03-29 20:44
@AndresFreundTec Thanks a whole bunch, excellent work and just in the nick of time to avert the worst consequences. <3
-
@TTimo@mastodon.social 2024-03-29 20:54
@AndresFreundTec jesus, I hope you like beer cuz we owe you a free lifetime supply.
-
@Zabuzzman@mastodon.social 2024-03-29 21:09
@AndresFreundTec thanks!
-
@nea89@kitty.social 2024-03-29 21:15
@AndresFreundTec@mastodon.social Moral of the story: if you write malware, write performant malware!
-
@marshray@infosec.exchange 2024-03-29 21:25
@AndresFreundTec Way to go man. Thank you for digging deeper until you found it.
-
@Doomed_Daniel@mastodon.gamedev.place 2024-03-29 21:33
@AndresFreundTec Awesome work! Shows that stubbornly debugging weird issues (that many would probably just ignore as "oh, it's slower now, whatever, it still works well enough..") can pay out big time! :) (Well, metaphorically at least, though I guess this also increases your worth on the job market)
-
@eb@social.coop 2024-03-30 00:19
@AndresFreundTec Oh, I didn't know you're on the fediverse! I embedded your post in my article @ https://boehs.org/node/everything-i-know-about-the-xz-backdoor Please let me know if there's anything you'd like me to add to it or clarify!
-
@deweyritten@infosec.exchange 2024-03-30 00:45
@AndresFreundTec this is wild
-
@sweet@tech.lgbt 2024-03-30 01:20
@AndresFreundTec its kind of sad reading the mailing list for the old maintainer to xz-utils / liblzma. Dude was single-handedly maintaining it after creating it as a hobby project, he got driven into the ground and he passed the project off to the culprit after being urged to (rudely) to give it up. This should be a wake up call tbh this shouldn't happen to projects that have on maintainer and that literally hold the entire tech industry and linux ecosystem on their shoulders
-
@eichin@mastodon.mit.edu 2024-03-30 02:01
@AndresFreundTec And a lot of persistence! Reminds me of one of the classics of the industry, Cliff Stoll's Cuckoo's Egg - "Stoll traced the error to an unauthorized user who had apparently used nine seconds of computer time and not paid for it" leading to a german hacker selling content to the KGB - 38 years ago. It is impressive (but uncommon) to see someone paying that level of attention to anomalies these days, with how thick tech stacks have gotten...
-
@thomasc@infosec.exchange 2024-03-30 03:43
@AndresFreundTec Absolutely stellar job tracking this down! Many thanks!
-
@maradydd@mastodon.social 2024-03-30 06:52
@AndresFreundTec well done mate, thanks for flipping the switches what needed flipped
-
@cking@mastodon.world 2024-03-30 06:54
@AndresFreundTec JiaT75: "And I Would Have Gotten Away With It Too, If It Weren't For You Meddling Andres Freund"
-
@ljs@social.kernel.org 2024-03-30 07:32
@AndresFreundTec you sir, are a legend among men.
-
@0xabad1dea@infosec.exchange 2024-03-30 08:28
@AndresFreundTec we were very, very lucky to have you on the case!
-
@sizious@mastodon.social 2024-03-30 08:38
@AndresFreundTec Kudos!
-
@pure@infosec.exchange 2024-03-30 09:32
@AndresFreundTec curious in how many appliances is this also hidden, I guess we are going to see a lot of updates the next weeks.
-
@haploc@fedi.cr-net.be 2024-03-30 15:33
@AndresFreundTec amazing find, thank you
-
@supergarv@phpc.social 2024-03-30 17:25
@AndresFreundTec Gotta add to the noise, many thanks for digging into this. If it wasn't for you, who knows what could've been done here. You're a hero, and I mean it.
-
@jimw@mefi.social 2024-03-30 17:33
@AndresFreundTec Am I understanding correctly that these were sshd processes fending off the deluge of bogus logins that any publicly accessible sshd has to contend with? If so, good thing you weren’t testing on a more isolated machine.
-
@satai@mathstodon.xyz 2024-03-30 17:39
@AndresFreundTec many thanks... The "coincidences" would not help unless you had abilities and cared.
-
@AndresFreundTec@mastodon.social 2024-03-30 22:26
One more aspect that I think emphasizes the number of coincidences that had to come together to find this: I run a number "buildfarm" instances for automatic testing of postgres. Among them with valgrind. For some other test instance I had used -fno-omit-frame-pointer for some reason I do not remember. A year or so ago I moved all the test instances to a common base configuration, instead of duplicate configurations. I chose to make all of them use -fno-omit-frame-pointer.
-
@mmap@techhub.social 2024-03-30 19:13
@AndresFreundTec@mastodon.social The open source community really owes you a huge debt of gratitude. Thank you for exposing this security issue and bringing it to the light of day.
-
@imbaczek@mastodon.xyz 2024-03-30 20:50
@AndresFreundTec@mastodon.social 🫡
-
@railmeat@fosstodon.org 2024-03-30 21:07
@AndresFreundTec@mastodon.social Thanks for your work on this. Everyone should follow your example.