transcript

Screenshot of github showing part of the commit message of this commit with this text:

Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094).

While the backdoor was inactive (and thus harmless) without inserting
a small trigger code into the build system when the source package was
created, it's good to remove this anyway:

  - The executable payloads were embedded as binary blobs in
    the test files. This was a blatant violation of the
    Debian Free Software Guidelines.

  - On machines that see lots bots poking at the SSH port, the backdoor
    noticeably increased CPU load, resulting in degraded user experience
    and thus overwhelmingly negative user feedback.

  - The maintainer who added the backdoor has disappeared.

  - Backdoors are bad for security.

This reverts the following without making any other changes:

The sentence “This was a blatant violation of the Debian Free Software Guidelines” is highlighted.

Below the github screenshot is a frame of the 1998 film The Big Lebowski with the meme caption “What, are you a fucking park ranger now?” from the scene where that line was spoken.

  • Jomosoto@discuss.tchncs.de
    link
    fedilink
    arrow-up
    1
    ·
    7 months ago

    Best part to me is “The maintainer who added the backdoor has disappeared.” implying it was removes because there’s nobody left to maintain it

  • RedWeasel@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    7 months ago

    Seriously. If you are going to do it, write in assembly or something else no one understands.

    • Ineocla@lemmy.ml
      link
      fedilink
      arrow-up
      2
      ·
      7 months ago

      Tbh jia tan really wasn’t lucky some mf at Microsoft noticed a 500ms delay in ssh. The backdoor was so incredibely clever and Well hidden and ingenious i almost feel bad for him lmao

      • conditional_soup@lemm.ee
        link
        fedilink
        arrow-up
        1
        ·
        7 months ago

        A really good point I heard is: this was likely a state actor attack, so how many others just like this are out there, undiscovered?

        • B0rax@feddit.de
          link
          fedilink
          arrow-up
          1
          ·
          7 months ago

          Unpopular opinion: what if it was not a state actor and just some bored person somewhere that thought it would be cool to own a bot net?

          What if this is just one of many backdoors and it’s just the only one we found?

          • thisisbutaname@discuss.tchncs.de
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            7 months ago

            I heard that person actively contributed for something like 2 years, providing actually useful contributions, to gain the level of trust needed to plant that backdoor. Feels a bit too much to chalk it up to boredom.

            As for the second part, that’s an interesting question. Are there lots of backdoors and we just happened to notice this one, or are backdoors very rare exactly because we’d have found them out soon like in this case?

            • Appoxo@lemmy.dbzer0.com
              link
              fedilink
              arrow-up
              1
              ·
              edit-2
              7 months ago

              You’d be surprised what I manage with motivation and boredom.
              You’d be surprised what a highly skilled scalled person can manage to achieve.

              Boredom, Skills and Motivation are dangerous things to have if improperly handled.

          • PapstJL4U@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            7 months ago

            The design is Moriarty lvls of complex. State actor might be too specific, but everything but a group of people would be highly unlikely.

            • B0rax@feddit.de
              link
              fedilink
              arrow-up
              2
              ·
              edit-2
              7 months ago

              You forget that a lot of brilliant open source projects are one man shows from geniuses somewhere around the world. They are usually not paid.

              In the other hand, if you get your hands on a powerful botnet, you can rent out its services (like ddos for example) for quite a bit of money.

          • GissaMittJobb@lemmy.ml
            link
            fedilink
            arrow-up
            1
            ·
            7 months ago

            Realistically I think it’s probably easier to acquire a botnet of less secure systems. This was a targeted attack.

        • SzethFriendOfNimi@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          7 months ago

          It’s scary to think about… a lot of people are now thinking about how we can best isolate our build test process so it works as a test suite but doesn’t have any way to interact with the output or environment.

          It’s just blows my mind to think of the levels of obfuscation this process used and how easy it would be to miss it.

      • RedWeasel@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        7 months ago

        Neither does the blob it downloaded. Would you think twice about AVX10 support if it was commented as AVX10 support in a compression library? Some might, but would they be the ones reviewing the code? A lot of programs that can take advantage of “handwritten” optimizations, like video decoders/encoders and compression, have assembly pathways so it will take advantage of the hardware when it is available but run when it isn’t. If the reviewers are not familiar with assembly enough something could be snuck in.

        systemD is using dlopens for libraries now and I am not convinced malware couldn’t modify the core executable memory and stay resident even after the dl is unloaded. Difficult, yes, but not impossible.

    • lefixxx@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      7 months ago

      Its like saying bank robbery is against bank’s gun carrying policy.

      Sure its true, but thats not really the problem being addressed. The massive, notorious security vulnerability is.

    • deltapi@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      7 months ago

      Yep, probably because it’s not funny or clever. My guess is that you look for funny and/or clever in your jokes.

        • computergeek125@lemmy.world
          link
          fedilink
          English
          arrow-up
          0
          ·
          7 months ago

          I’m still lost… I’ve been following the XZ thing since it broke, so I get the context, but I’m not sure how the meme at the bottom is connected?

          • Boomkop3@reddthat.com
            link
            fedilink
            arrow-up
            0
            ·
            7 months ago

            On the photo you see a violation of rules listed as one of the reasons this commit is made. Because it’s at the top the meme creator is presuming that’s their main priority.

            And they disagree with that, so they’re calling them a “park ranger”. I’m guessing they’re alluding to an old but common media presentation of park rangers being childish about rules.

            I get the joke with that it looks a bit odd to put that reason at the top of the list, but their response I find more unkind than funny

            • Arthur Besse@lemmy.mlOP
              link
              fedilink
              English
              arrow-up
              1
              ·
              7 months ago

              As the image transcript in the post body explains, the image at the bottom is a scene from a well-known 1998 film (which, according to Wikipedia, was in 2014 selected for preservation in the United States National Film Registry by the Library of Congress as being “culturally, historically, or aesthetically significant”).

              This meme will not make as much sense to people who have not seen the film. You can watch the referenced scene here. The context is that the main character, The Dude (played by Jeff Bridges) has recently had his private residence invaded by a group of nihilists with a pet marmot (actually portrayed by a ferret) and they have threatened to “cut off his Johnson”. In an attempt to express sympathy, The Dude’s friend Walter (played by John Goodman) points out that, in addition to the home invasion and threats, the nihilists’ exotic pet is also illegal. The Dude’s retort “what, are you a fucking park ranger now” is expressing irritation with that observation, because it is insignificant compared with the threat of the removal of his penis.

              This meme attempts to draw a parallel between this humorous scene and XZ developer Lasse Collin’s observation that the XZ backdoor was also a violation of Debian’s software licensing policies.

              Thank you for reading my artist’s statement.

            • loutr@sh.itjust.works
              link
              fedilink
              arrow-up
              0
              ·
              7 months ago

              It’s a scene from The Big Lebowski, right after The Dude got tortured with a marmot by German nihilists. Walter focuses on the legality of keeping a marmot as a pet, which is obviously not the main issue.