{"id":114665,"date":"2024-03-30T12:25:45","date_gmt":"2024-03-30T10:25:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retrospektiva-prodvizheniya-bekdora-v-paket-xz"},"modified":"2024-03-30T12:25:45","modified_gmt":"2024-03-30T10:25:45","slug":"retrospektiva-prodvizheniya-bekdora-v-paket-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","title":{"rendered":"Retrospective on the promotion of the backdoor in the xz package","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A backdoor is believed to have been introduced in the xz package by developer Jia Tan, who became a maintainer in 2022 and started releasing versions from 5.4.2 onwards. In addition to the xz project, the alleged author of the backdoor also contributed to the development of the xz-java and xz-embedded packages and was included among the maintainers of the XZ Embedded project used in the Linux kernel. <\/p>\n
Two additional participants have been noted in the organization promoting the backdoor \u2014 Jigar Kumar and Hans Jansen, who seem to be virtual personas. In April 2022, Jigar Kumar assisted in the adoption of early patches from Jia Tan at xz that implemented support for string filters and exerted moral pressure on Lasse Collin, the then-maintainer, criticizing him for being unable to fulfill his duties and for not accepting useful patches. In June, Lasse Collin agreed that the project needed a new maintainer, lamented burnout and mental health issues, and passed the maintainer rights to Jia Tan. After this, user Jigar Kumar did not appear in the mailing list again. <\/p>\n
After receiving maintainer rights, Jia Tan actively began adding changes to the project and statistically ranked second among developers for the number of changes over two years. In March 2023, the person responsible for testing the xz package in the oss-fuzz service was replaced from Lasse Collin to Jia Tan, and in June, changes were accepted into xz that added support for the IFUNC mechanism in liblzma (the crc64_fast constructor was replaced with ifunc), which was later used to organize function interception in the backdoor. The change was proposed by Hans Jansen, and Jia Tan accepted it into xz. The Hans Jansen account was created just before the pull request was submitted. <\/p>\n
In July 2023, Jia Tan sent a request to the oss-fuzz developers to disable the ifunc check due to its incompatibility with the '-fsanitize=address' mode. In early February 2024, the link to the project on oss-fuzz and on the main page of tukaani.org was changed from 'tukaani.org\/xz\/' to 'xz.tukaani.org', where the subdomain 'xz.tukaani.org' was hosted on GitHub Pages and personally controlled by Jia Tan. On February 23, archives for testing the decoder\u2019s functionality were placed in the xz repository, among which were files bad-3-corrupt_lzma2.xz and good-large_compressed.lzma with a hidden backdoor. M4 macros for activating the backdoor were included only in the tar archive with release 5.6.0 and were excluded from the Git repository, but were revealed in the .gitignore file. <\/p>\n
On March 17, Hans Jansen, who previously developed patches with IFUNC support, was registered as a participant in the Debian project, and on March 25, he submitted a request to update the xz-utils package version in the Debian repository. Update requests were also sent to the Fedora and Ubuntu developers (in Ubuntu, the repository was in a freeze state and the change was rejected). <\/p>\n
Some users also joined the requests to update the xz version, claiming that the new version fixed interfering crashes detected during debugging in valgrind (the issues arose from incorrect stack layout detection in the backdoor handler, and the backdoor developers attempted to address these problems in xz version 5.6.1). The crash also caught the attention of Andres Freund, a Microsoft employee involved in PostgreSQL development, who discovered the presence of the backdoor and notified the community. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"