Podle v\u0161eho byl backdoor zasazen do bal\u00ed\u010dku xz jeho tv\u016frcem Jiou Tanem, kter\u00fd v roce 2022 z\u00edskal status udr\u017eovatele a za\u010dal vyd\u00e1vat verze od 5.4.2. Krom\u011b projektu xz se p\u0159edpokl\u00e1dan\u00fd autor backdooru tak\u00e9 pod\u00edlel na v\u00fdvoji bal\u00ed\u010dk\u016f xz-java a xz-embedded a byl za\u0159azen mezi udr\u017eovatele projektu XZ Embedded, kter\u00fd se pou\u017e\u00edv\u00e1 v j\u00e1dru Linuxu. <\/p>\n
V r\u00e1mci propagace backdooru byli zaznamen\u00e1ni tak\u00e9 dva dal\u0161\u00ed \u00fa\u010dastn\u00edci \u2014 Jigar Kumar a Hans Jansen, kte\u0159\u00ed se zdaj\u00ed b\u00fdt virtu\u00e1ln\u00edmi postavami. Jigar Kumar v dubnu 2022 p\u0159isp\u011bl k p\u0159ijet\u00ed ran\u00fdch patch\u016f Jia Tan do xz s implementac\u00ed podpory pro \u0159et\u011bzcov\u00e9 filtry a vyv\u00edjel mor\u00e1ln\u00ed tlak na Lasse Collina, tehdej\u0161\u00edho spr\u00e1vce, kritizuj\u00edc\u00ed, \u017ee nen\u00ed schopen plnit sv\u00e9 povinnosti a nep\u0159ij\u00edm\u00e1 u\u017eite\u010dn\u00e9 patche. V \u010dervnu Lasse Collin souhlasil, \u017ee projekt pot\u0159ebuje nov\u00e9ho spr\u00e1vce, post\u011b\u017eoval si na vyho\u0159en\u00ed a probl\u00e9my s du\u0161evn\u00edm zdrav\u00edm, a p\u0159edal pr\u00e1vo na spr\u00e1vu Jia Tan. Pot\u00e9 se u\u017eivatel Jigar Kumar v mailing listu v\u00edce neobjevil. <\/p>\n
Jakmile z\u00edskal pr\u00e1va udr\u017eovatele, Jiou Tan za\u010dal aktivn\u011b p\u0159id\u00e1vat zm\u011bny do projektu a podle statistik za dva roky obsadil druh\u00e9 m\u00edsto mezi v\u00fdvoj\u00e1\u0159i z hlediska po\u010dtu zm\u011bn. V b\u0159eznu 2023 byl odpov\u011bdn\u00fd za testov\u00e1n\u00ed bal\u00ed\u010dku xz na slu\u017eb\u011b oss-fuzz nahrazen Jiou Tanem z Lasse Collina a v \u010dervnu byly do xz p\u0159ijaty zm\u011bny, kter\u00e9 do liblzma p\u0159idaly podporu mechanismu IFUNC (konstruktor crc64_fast byl nahrazen ifunc), kter\u00fd byl pozd\u011bji pou\u017eit k zaji\u0161t\u011bn\u00ed zachycen\u00ed funkc\u00ed v backdooru. Zm\u011bnu navrhl Hans Jansen, a Jiou Tan ji p\u0159ijal do xz. \u00da\u010det Hanse Jansena byl vytvo\u0159en p\u0159\u00edmo p\u0159ed odesl\u00e1n\u00edm pull requestu. <\/p>\n
V \u010dervenci 2023 Jia Tan zaslal v\u00fdvoj\u00e1\u0159\u016fm oss-fuzz \u017e\u00e1dost o deaktivaci kontroly ifunc kv\u016fli jej\u00ed nekompatibilit\u011b s re\u017eimem \u201e-fsanitize=address\u201c. Na za\u010d\u00e1tku \u00fanora 2024 byla zm\u011bn\u011bna odkaz na web projektu v oss-fuzz a na hlavn\u00ed str\u00e1nce tukaani.org z \u201etukaani.org\/xz\/\u201c na \u201exz.tukaani.org\u201c, kde byl subdom\u00e9na \u201exz.tukaani.org\u201c um\u00edst\u011bna na slu\u017eb\u011b GitHub Pages a byla osobn\u011b kontrolov\u00e1na Jiou Tanem. Dne 23. \u00fanora byly v repozit\u00e1\u0159i xz zve\u0159ejn\u011bny archivy pro testov\u00e1n\u00ed funkce dekod\u00e9ru, mezi kter\u00fdmi byly soubory bad-3-corrupt_lzma2.xz a good-large_compressed.lzma se skryt\u00fdm backdoorem. M4 makra pro aktivaci backdooru byla zahrnuta pouze v tar archivu s vyd\u00e1n\u00edm 5.6.0 a byla vylou\u010dena z Git repozit\u00e1\u0159e, ale objevila se v souboru .gitignore. <\/p>\n
17. b\u0159ezna byl Hans Jansen, kter\u00fd p\u0159edt\u00edm vyvinul patche s podporou IFUNC, zaregistrov\u00e1n jako \u00fa\u010dastn\u00edk projektu Debian, a 25. b\u0159ezna mu byla zasl\u00e1na \u017e\u00e1dost o aktualizaci verze bal\u00ed\u010dku xz-utils v repozit\u00e1\u0159i Debian. \u017d\u00e1dosti o aktualizaci verze byly tak\u00e9 zasl\u00e1ny v\u00fdvoj\u00e1\u0159\u016fm Fedora a Ubuntu (v repozit\u00e1\u0159i Ubuntu byla f\u00e1ze mra\u017een\u00ed a zm\u011bna byla odm\u00edtnuta). <\/p>\n
K \u017e\u00e1dostem o aktualizaci verze xz se tak\u00e9 p\u0159ipojili n\u011bkte\u0159\u00ed u\u017eivatel\u00e9, kte\u0159\u00ed tvrdili, \u017ee nov\u00e1 verze odstranila z\u00e1vady, kter\u00e9 br\u00e1nily spr\u00e1vn\u00e9 funkci, zji\u0161\u0165ovan\u00e9 p\u0159i lad\u011bn\u00ed ve valgrind (probl\u00e9my vznikaly kv\u016fli nespr\u00e1vn\u00e9mu zji\u0161t\u011bn\u00ed rozlo\u017een\u00ed z\u00e1sobn\u00edku v obslu\u017en\u00e9 rutin\u011b backdooru a tyto probl\u00e9my se v\u00fdvoj\u00e1\u0159i backdooru sna\u017eili vy\u0159e\u0161it ve verzi xz 5.6.1). Z\u00e1vadou se tak\u00e9 zab\u00fdval Andres Freund, zam\u011bstnanec Microsoftu, kter\u00fd se pod\u00edl\u00ed na v\u00fdvoji PostgreSQL, kter\u00fd odhalil p\u0159\u00edtomnost backdooru a informoval o tom komunitu. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 xz \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 xz-java \u0438 xz-embedded, \u0438 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0447\u0438\u0441\u043b\u043e \u043c\u044d\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 XZ Embedded, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Retrospektiva postupu backdooru v bal\u00ed\u010dku xz | ProHoster","description":"P\u0159edpokl\u00e1d\u00e1 se, \u017ee backdoor v bal\u00ed\u010dku xz byl zaveden v\u00fdvoj\u00e1\u0159em Jia Tanem, kter\u00fd v roce 2022 z\u00edskal status \u00fadr\u017eb\u00e1\u0159e a vyd\u00e1val verze od verze 5.4.2.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442 xz | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-30T10:25:45+00:00","article:modified_time":"2024-03-30T10:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=114665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=114665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=114665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=114665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"