Se presupune c\u0103 backdoor-ul din pachetul xz a fost introdus de dezvoltatorul Jia Tan, care \u00een 2022 a ob\u021binut statutul de men\u021bin\u0103tor \u0219i a lansat versiuni \u00eencep\u00e2nd cu 5.4.2. Pe l\u00e2ng\u0103 proiectul xz, autorul presupus al backdoor-ului a participat de asemenea la dezvoltarea pachetelor xz-java \u0219i xz-embedded \u0219i a fost inclus printre men\u021bin\u0103torii proiectului XZ Embedded, utilizat \u00een nucleul Linux. <\/p>\n
\u00cen cadrul organiza\u021biei de promovare a backdoor-ului au fost remarca\u021bi \u00eenc\u0103 doi participan\u021bi \u2014 Jigar Kumar \u0219i Hans Jansen, care, se pare, sunt personaje virtuale. Jigar Kumar a contribuit \u00een aprilie 2022 la acceptarea \u00een xz a unor patch-uri timpurii de c\u0103tre Jia Tan, cu implementarea suportului pentru filtrele de \u0219iruri, \u0219i a exercitat presiune moral\u0103 asupra lui Lasse Collin, curatorul de atunci, critic\u00e2ndu-l c\u0103 nu este capabil s\u0103-\u0219i \u00eendeplineasc\u0103 sarcinile \u0219i c\u0103 nu accept\u0103 patch-uri utile. \u00cen iunie, Lasse Collin a recunoscut c\u0103 proiectul are nevoie de un nou curator, s-a pl\u00e2ns de epuizare \u0219i probleme de s\u0103n\u0103tate mintal\u0103 \u0219i a transferat dreptul de \u00eentre\u021binere c\u0103tre Jia Tan. Dup\u0103 aceasta, utilizatorul Jigar Kumar nu a mai ap\u0103rut \u00een discu\u021bii. <\/p>\n
Ob\u021bin\u00e2nd drepturile de men\u021bin\u0103tor, Jia Tan a \u00eenceput s\u0103 adauge activ modific\u0103ri \u00een proiect \u0219i, conform statisticilor, \u00een doi ani a ocupat locul doi printre dezvoltatori dup\u0103 num\u0103rul de modific\u0103ri. \u00cen martie 2023, responsabilul de testarea pachetului xz \u00een serviciul oss-fuzz a fost \u00eenlocuit de la Lasse Collin la Jia Tan, iar \u00een iunie au fost acceptate modific\u0103ri \u00een xz care au ad\u0103ugat \u00een liblzma suport pentru mecanismul IFUNC (constructorul crc64_fast a fost \u00eenlocuit cu ifunc), care ulterior a fost utilizat pentru interceptarea func\u021biilor \u00een backdoor. Modificarea a fost propus\u0103 de Hans Jansen, iar Jia Tan a acceptat-o \u00een xz. Contul lui Hans Jansen a fost creat chiar \u00eenainte de trimiterea pull request-ului. <\/p>\n
\u00cen iulie 2023, Jia Tan a trimis dezvoltatorilor oss-fuzz o cerere de dezactivare a verific\u0103rii ifunc din cauza incompatibilit\u0103\u021bii sale cu modul '-fsanitize=address'. La \u00eenceputul lunii februarie 2024, linkul c\u0103tre site-ul proiectului \u00een oss-fuzz \u0219i pe pagina principal\u0103 tukaani.org a fost modificat de la 'tukaani.org\/xz\/' la 'xz.tukaani.org', unde subdomeniul 'xz.tukaani.org' era g\u0103zduit pe serviciul GitHub Pages \u0219i era controlat personal de Jia Tan. Pe 23 februarie, \u00een repository-ul xz au fost plasate arhive pentru testarea func\u021bion\u0103rii decodorului, printre care s-au aflat fi\u0219ierele bad-3-corrupt_lzma2.xz \u0219i good-large_compressed.lzma cu un backdoor ascuns. Macrocomenzile M4 pentru activarea backdoor-ului au fost incluse doar \u00een arhiva tar cu versiunea 5.6.0 \u0219i au fost excluse din repository-ul Git, dar au ap\u0103rut \u00een fi\u0219ierul .gitignore. <\/p>\n
Pe 17 martie, Hans Jansen, care a dezvoltat anterior patch-uri cu suport pentru IFUNC, a fost \u00eenregistrat ca participant la proiectul Debian, iar pe 25 martie a trimis o cerere de actualizare a versiunii pachetului xz-utils \u00een depozitul Debian. Cererile de actualizare a versiunii au fost, de asemenea, \u00eenaintate dezvoltatorilor Fedora \u0219i Ubuntu (la Ubuntu, depozitul era \u00een stadiul de \u00eenghe\u021bare \u0219i modificarea a fost respins\u0103). <\/p>\n
La solicit\u0103rile de actualizare a versiunii xz s-au al\u0103turat \u0219i unii utilizatori, care au declarat c\u0103 \u00een noua versiune au fost corectate erorile care interfereaz\u0103 cu func\u021bionarea, eviden\u021biate \u00een timpul depan\u0103rii \u00een valgrind (problemele au ap\u0103rut din cauza unei determin\u0103ri incorecte a aranjamentului stivei \u00een handlerul backdoor-ului \u0219i aceste probleme au fost remediate de dezvoltatorii backdoor-ului \u00een versiunea xz 5.6.1). De asemenea, Andres Freund, un angajat Microsoft implicat \u00een dezvoltarea PostgreSQL, s-a ar\u0103tat interesat de eroare, descoperind existen\u021ba backdoor-ului \u0219i inform\u00e2nd comunitatea despre aceasta. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 xz \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 xz-java \u0438 xz-embedded, \u0438 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0447\u0438\u0441\u043b\u043e \u043c\u044d\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 XZ Embedded, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Retrospectiva promov\u0103rii backdoor-ului \u00een pachetul xz | ProHoster","description":"Se presupune c\u0103 backdoor-ul \u00een pachetul xz a fost introdus de dezvoltatorul Jia Tan, care \u00een 2022 a ob\u021binut statutul de \u00eentre\u021binator \u0219i a lansat versiuni \u00eencep\u00e2nd cu versiunea 5.4.2.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442 xz | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-30T10:25:45+00:00","article:modified_time":"2024-03-30T10:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"