Xz/liblzma: Bash-stage Obfuscation Explained (gynvael.coldwind.pl)

Article summary

A backdoor was discovered in xz/liblzma, affecting OpenSSH server, which was hidden in test files using obfuscation methods. The backdoor was extracted and executed through a series of bash scripts and commands. The article explains the obfuscation methods used, including substitution ciphers and an RC4 variant implemented in AWK. The backdoor was found in versions 5.6.0 and 5.6.1 of xz/liblzma.

Main themes

• xz/liblzma backdoor
• obfuscation methods
• bash script analysis
• security vulnerabilities
• open-source software risks

What commenters say

• The backdoor's sophistication and use of standard command line tools made it difficult to detect.
• The use of a dot to sabotage the sandboxing method was likely a deliberate attempt to reduce security.
• The presence of the backdoor in the release tarball but not in the git repository highlights the importance of verifying code against public repositories.
• The complexity of build tools and scripts can make it challenging to detect malicious code, especially in projects that support multiple platforms.
• Some argue that the use of non-breaking spaces or other characters could have been used to make the backdoor more stealthy, while others think it was a mistake.
• The fact that the backdoor was not detected through code review and testing raises concerns about the effectiveness of these processes.
• There is a need for better frameworks and tools to replace legacy code and improve the security of open-source software.
• The incident highlights the importance of monitoring and verifying the activity of repositories for changes to prevent similar attacks in the future.