{"id":114657,"date":"2024-03-30T00:25:55","date_gmt":"2024-03-29T22:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor"},"modified":"2024-03-30T00:25:55","modified_gmt":"2024-03-29T22:25:55","slug":"v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","title":{"rendered":"En bakd\u00f6rr har uppt\u00e4ckts i koden f\u00f6r xz versionerna 5.6.0 och 5.6.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Debian-utvecklaren och s\u00e4kerhetsforskaren Andres Freund rapporterar om uppt\u00e4ckten av en sannolik bakd\u00f6rr i k\u00e4llkoden f\u00f6r xz versionerna 5.6.0 och 5.6.1.<\/p>\n

<\/p>\n

Bakd\u00f6rren \u00e4r en rad i ett av m4-skripten<\/a>, som skriver in obfuskerad skadlig kod i slutet av configure-skriptet. Denna kod modifierar sedan en av de genererade Makefile-filerna f\u00f6r projektet, vilket i slut\u00e4ndan leder till att skadlig kod (maskerad som testarkivet bad-3-corrupt_lzma2.xz) hamnar i bin\u00e4rfilen liblzma.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Det som \u00e4r s\u00e4rskilt med h\u00e4ndelsen \u00e4r att den skadliga koden finns bara<\/em> i de distribuerade tar-arkiven med k\u00e4llkoden och inte finns i projektets git-repository.<\/p>\n

Det rapporteras att personen under vars namn den skadliga koden lades till i projektets repository antingen \u00e4r direkt inblandad i h\u00e4ndelsen eller har blivit offer f\u00f6r en allvarlig kompromiss av sina personliga konton (men forskaren lutar \u00e5t den f\u00f6rsta optionen, eftersom denna person personligen har deltagit i flera diskussioner relaterade till de skadliga f\u00f6r\u00e4ndringarna).<\/p>\n

I sin l\u00e4nk p\u00e5pekar forskaren att syftet med bakd\u00f6rren troligtvis \u00e4r att injicera kod i sshd-processen och manipulera RSA-nyckelverifieringskoden, och ger flera s\u00e4tt att indirekt kontrollera huruvida den skadliga koden k\u00f6rs p\u00e5 ditt system just nu.<\/p>\n

<\/p>\n

Enligt en nyhetsartikel fr\u00e5n openSUSE-projektet<\/a>, p\u00e5 grund av bakd\u00f6rens komplexitet och den f\u00f6rmodade mekanismen f\u00f6r dess utnyttjande \u00e4r det sv\u00e5rt att avg\u00f6ra om det ens har «aktiverats» en enda g\u00e5ng p\u00e5 denna maskin. Det rekommenderas att g\u00f6ra en fullst\u00e4ndig ominstallation av operativsystemet och rotera alla relevanta nycklar p\u00e5 alla maskiner d\u00e4r det minst en g\u00e5ng har funnits infekterade versioner av xz.<\/p>\n

<\/noindex><\/p>\n

K\u00e4lla: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Andres Freund \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0442\u0440\u043e\u0447\u043a\u0443 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 m4-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0435\u0446 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 configure. \u042d\u0442\u043e\u0442 \u043a\u043e\u0434 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 Makefile \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0447\u0442\u043e \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114657","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bakd\u00f6rr uppt\u00e4cktes i koden f\u00f6r xz versionerna 5.6.0 och 5.6.1 | ProHoster","description":"Debian-utvecklaren och s\u00e4kerhetsforskaren Andres Freund rapporterar om uppt\u00e4ckten av en sannolik bakd\u00f6rr i k\u00e4llkoden f\u00f6r xz versionerna 5.6.0 och 5.6.1. Bakd\u00f6rren \u00e4r.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Andres Freund \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-29T22:25:55+00:00","article:modified_time":"2024-03-29T22:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114657","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=114657"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114657\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=114657"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=114657"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=114657"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}