• capt_kafei@lemmy.ca
    link
    fedilink
    English
    arrow-up
    97
    ·
    7 months ago

    Damn, it is actually scary that they managed to pull this off. The backdoor came from the second-largest contributor to xz too, not some random drive-by.

      • Alex@lemmy.ml
        link
        fedilink
        arrow-up
        61
        arrow-down
        1
        ·
        7 months ago

        It’s looking more like a long game to compromise an upstream.

        • cjk@feddit.de
          link
          fedilink
          arrow-up
          18
          ·
          7 months ago

          Either that or the attacker was very good at choosing their puppet…

          • Alex@lemmy.ml
            link
            fedilink
            arrow-up
            36
            ·
            7 months ago

            Well the account is focused on one particular project which makes sense if you expect to get burned at some point and don’t want all your other exploits to be detected. It looks like there was a second sock puppet account involved in the original attack vector support code.

            We should certainly audit other projects for similar changes from other psudoanonymous accounts.

    • Alex@lemmy.ml
      link
      fedilink
      arrow-up
      34
      ·
      edit-2
      7 months ago

      Time to audit all their contributions although it looks like they mostly contribute to xz. I guess we’ll have to wait for comments from the rest of the team or if the whole org needs to be considered comprimised.

      • sim642@lemm.ee
        link
        fedilink
        arrow-up
        2
        ·
        7 months ago

        Assuming that it’s just that person, that it’s their actual name and that they’re in the US…

      • ugjka@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        4
        ·
        edit-2
        7 months ago

        there will be federal investigation just speculation if the culprit is a foreign actor