{"id":114665,"date":"2024-03-30T12:25:45","date_gmt":"2024-03-30T10:25:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retrospektiva-prodvizheniya-bekdora-v-paket-xz"},"modified":"2024-03-30T12:25:45","modified_gmt":"2024-03-30T10:25:45","slug":"retrospektiva-prodvizheniya-bekdora-v-paket-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","title":{"rendered":"Povijest unosa backdoora u xz paket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Navodno je backdoor u paketu xz ugradio developer Jia Tan, koji je 2022. godine stekao status odr\u017eavatelja i izdavao verzije od 5.4.2. Osim projekta xz, navodni autor backdoora tako\u0111er je sudjelovao u razvoju paketa xz-java i xz-embedded te je bio uklju\u010den u tim odr\u017eavatelja projekta XZ Embedded, koji se koristi u Linux kernelu. <\/p>\n

U organizaciji promocije backdoora tako\u0111er su primije\u0107ena jo\u0161 dva sudionika \u2014 Jigar Kumar i Hans Jansen, koji o\u010digledno predstavljaju virtualne likove. Jigar Kumar je u travnju 2022. godine doprinio prihva\u0107anju ranih zakrpa Jia Tana u xz sa implementacijom podr\u0161ke za filtriranje nizova i vr\u0161io moralni pritisak na Lassea Collina, tada\u0161njeg odr\u017eavatelja, kritiziraju\u0107i ga \u0161to nije sposoban izvr\u0161avati svoje du\u017enosti i ne prihva\u0107a korisne zakrpe. U lipnju je Lasse Collin priznao da projektu treba novi odr\u017eavatelj, po\u017ealio se na izgaranje i probleme sa mentalnim zdravljem, te je prenio pravo odr\u017eavatelja na Jia Tana. Nakon toga, korisnik Jigar Kumar vi\u0161e se nije pojavljivao na mailing listi. <\/p>\n

Nakon \u0161to je dobio prava odr\u017eavatelja, Jia Tan aktivno je po\u010deo dodavati promjene u projekt i prema statistikama za dvije godine zauzeo je drugo mjesto me\u0111u developerima po broju promjena. U o\u017eujku 2023. godine, odgovorna osoba za testiranje paketa xz u servisu oss-fuzz zamijenjena je s Lasseom Collinom na Jia Tana, a u lipnju su u sastav xz prihva\u0107ene promjene koje su dodale u liblzma podr\u0161ku za mehanizam IFUNC (konstruktor crc64_fast zamijenjen je ifunc), koji je kasnije kori\u0161ten za organizaciju presretanja funkcija u backdooru. Promjenu je predlo\u017eio Hans Jansen, a Jia Tan ju je prihvatio u sastav xz. Ra\u010dun Hans Jansen je stvoren neposredno prije slanja pull-requesta. <\/p>\n

U srpnju 2023. godine, Jia Tan je poslao programerima oss-fuzz zahtjev za isklju\u010divanje provjere ifunc zbog njegove nespojivosti s na\u010dinom \u2018-fsanitize=address\u2019. Po\u010detkom velja\u010de 2024. godine, veza na stranicu projekta u oss-fuzz i na glavnoj stranici tukaani.org promijenjena je sa \u2018tukaani.org\/xz\/\u2019 na \u2018xz.tukaani.org\u2019, gdje je poddomena \u2018xz.tukaani.org\u2019 bila smje\u0161tena na GitHub Pages i kontrolirana osobno od strane Jia Tana. 23. velja\u010de u repozitoriju xz objavljeni su arhivi za testiranje rada dekodera, me\u0111u kojima su bili datoteke bad-3-corrupt_lzma2.xz i good-large_compressed.lzma sa skrivenim backdoorom. M4 makroi za aktivaciju backdoora bili su uklju\u010deni samo u tar-arhiv s izdanjem 5.6.0 i isklju\u010deni su iz Git repozitorija, ali su se pojavili u datoteci .gitignore. <\/p>\n

17. o\u017eujka, Hans Jansen, koji je ranije razvio zakrpe s podr\u0161kom za IFUNC, registriran je kao sudionik projekta Debian, a 25. o\u017eujka poslao je zahtjev za a\u017euriranje verzije paketa xz-utils u Debian repozitoriju. Zahtjevi za a\u017euriranje verzije tako\u0111er su stigli od programera Fedora i Ubuntu (u Ubuntu repozitoriju je bio u fazi zamrzavanja i promjena je odbijena). <\/p>\n

Zamolbama za a\u017euriranje verzije xz pridru\u017eili su se i neki korisnici, tvrde\u0107i da su u novoj verziji ispravljeni komplikacije u radu, otkrivene prilikom debagiranja u valgrind-u (problemi su nastali zbog neispravnog definiranja rasporeda stoga u obradi le\u0111a, a ovi problemi poku\u0161ali su ispraviti programeri le\u0111a u verziji xz 5.6.1). Tako\u0111er se pojavio interes za kvar od strane Andresa Freund, zaposlenika Microsofta koji sudjeluje u razvoju PostgreSQL-a, koji je otkrio postojanje le\u0111a i obavijestio o tome zajednicu.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 xz \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 xz-java \u0438 xz-embedded, \u0438 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0447\u0438\u0441\u043b\u043e \u043c\u044d\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 XZ Embedded, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Retrospektiva promocije le\u0111a u paket xz | ProHoster","description":"Pretpostavlja se da je le\u0111a u paket xz umetnuo programer Jia Tan, koji je 2022. godine dobio status odr\u017eavatelja i izdavao izdanja po\u010dev\u0161i od verzije 5.4.2.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442 xz | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-30T10:25:45+00:00","article:modified_time":"2024-03-30T10:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=114665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/114665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=114665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=114665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=114665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}