I think a lot of memes are missing the main point of how it was caught, the exploit caused a spike in CPU usage for a network call. That made no sense to the ~~guy~~ Messiah who found/reported it. FOSS software's strength is the number of critical eyes looking over each line of code you put out!

[–] XEAL@lemm.ee 1 points 7 months ago* (last edited 7 months ago) (1 children)

What was the full story again? I'm googling but I can't find it.

[–] kryllic@programming.dev 1 points 7 months ago* (last edited 7 months ago) (1 children)

In a nutshell, a backdoor was intentionally planted by a malicious actor in xz Utils, an open-source data compression utility widely used in Linux and other Unix-like operating systems. This discovery was made by Andres Freund, a developer and engineer working on Microsoft’s PostgreSQL offerings. He was troubleshooting performance problems on a Debian system. Specifically, SSH logins were consuming excessive CPU cycles and generating errors with Valgrind, a memory debugging tool. Through sheer luck and Freund’s careful eye, he eventually discovered that these issues were the result of updates made to xz Utils. Upon closer inspection, he found that updates to xz Utils were the result of a maliciously inserted backdoor. The backdoor, present in xz Utils versions 5.6.0 and 5.6.1, manipulated the sshd executable, allowing anyone with a predetermined encryption key to upload and execute arbitrary code on affected devices.

[–] XEAL@lemm.ee 1 points 7 months ago (1 children)

I expected a link to a source, but this is even better (matches with the little I remember)

Thanks!

[–] kryllic@programming.dev 1 points 7 months ago

No prob! I think Ars Technica had the best writeup imo: https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/

[–] GBU_28@lemm.ee 1 points 7 months ago

Right but the joke is that most developers aren't of that quality, and are now going to put leredditor super sleuth eyes on every application they build

[–] Kowowow@lemmy.ca 1 points 7 months ago

It would be more of a fair trade if bad actors at least needed to make sure their code was way better than most

[–] justcoding_de@programming.dev 1 points 7 months ago

Me, after the latest iOS update slows my aging iPad by another 20%: 🤷‍♂️

[–] alexdeathway@programming.dev 1 points 7 months ago* (last edited 7 months ago)

My Firefox package updates are usually slow, limiting downloads to <500kb. So, whenever the download speed used to drop, I knew Firefox released an update.

So when the XZ articles started popping up, the first thing I did was verify all sources.

https://programming.dev/post/12370824