Sources
Loading...
Additional media
Loading...
DeepNewz, mobile.
People-sourced. AI-powered. Unbiased News.
A malicious open source developer attempted to insert a backdoor into the xz compression library, posing a serious security threat to Linux systems. The attack was discovered by a vigilant software engineer at Microsoft who noticed a suspicious lag in system performance. The incident highlights the risks associated with maintaining widely used software by a single individual and raises concerns about the security of other projects. The attacker's sophisticated tactics, including pressuring the original maintainer and inserting their own RSA key, underscore the need for heightened vigilance in the open-source community.
In case people missed it, a engineer who happened to notice a 500ms latency and had free time + skill to investigate, just disrupted an intelligence campaign running for at least a year that would have created a backdoor into most Linux systems in the world. We got really, really… https://t.co/Epm0uupb18
Saw some variations of this xz backdoor meme: "it happened in open source", "it was found by Microsoft employee, aha" aiming to put the open sourcness nature of this as part of the issue... I think this example actually show the exact opposite - why it is so important to have… https://t.co/iyF9Aecx7T
The xz utils backdoor story is absolutely wild and the fact that no major news outlet has so far reported on it shows how limited the public's understanding of digital security issues is. https://t.co/Lcz4lRvUSx