Backdoor found in widely used Linux utility breaks encrypted SSH connections

[CloudWatcher]

3. I think this is much worse than most reports would have you believe

I think this is a lot worse than reported. Yes, this attempt was foiled before it got widespread, but the technique they used opens a new front in the war against malware.

(1) This was a years-long effort. Clearly not a random teenage hacker going for kicks (i.e. it was a government group).
(2) It took advantage of the rapidly aging population of open-source package owners & maintainers.

The approach here was to create a useful but fictional volunteer contributor and slowly build up their reputation and credibility until they could be given control of a widely used package. And then to use that power to introduce malware that would be included by large distributions.

This was only discovered because the malware was buggy and affected the performance of the OpenSSH package. If they had been a little bit better at coding the backdoor, it would not have been discovered before being distributed to millions of Linux systems.

But we caught them, why is this so bad? It's bad because there's very little we can do to prevent this style of attack from being used over and over again until we can no longer trust any large open source software system.

If I just stay away from open-source systems like Linux, won't that be enough? No, because every major OS (Windows and Android and Mac and iOS included) include open source software for you. And regardless of how big those companies are, they do not have the people to review and vet every line of source code in the packages they include.

Won't my anti-virus/anti-malware software detect threats like this? Nope. If the malware is done carefully, it'll just look like part of the system.

Aren't you being just a little bit paranoid? Yes. But then I was also around when the Morris Worm took over the net because of a back-door that was introduced by the actual author of the widely used & installed Sendmail program.

"Just because you're paranoid doesn't mean they aren't after you" -- Author Unknown

Some more details:

https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor