83
ELI5: The Linux xz backdoor situation
(pawb.social)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 31 Mar 2024
83 points (95.6% liked)
Explain Like I'm Five
14093 readers
23 users here now
Simplifying Complexity, One Answer at a Time!
Rules
- Be respectful and inclusive.
- No harassment, hate speech, or trolling.
- Engage in constructive discussions.
- Share relevant content.
- Follow guidelines and moderators' instructions.
- Use appropriate language and tone.
- Report violations.
- Foster a continuous learning environment.
founded 1 year ago
MODERATORS
Chances are very, very high, that you are not nearly interesting enough to warrant someone utilizing said back door to discover your stash of furry lewds. The primary target for an exploit like this, is either nation state level (industrial/political espionage, tampering with financial markets, etc.) or criminal enterprise level going after high value targets. Trying to dragnet every random whoever to see if they have data worth compromising wouldn’t be much of a money maker.
That said, this is one of the dangers of using a rolling release. I was running endeavourOS and was likely exposed to the back door for a while. I’ve since switched back to Fedora, which was only exposed on its testing branch (rawhide).
From my understanding, Arch based distros don't link ssh with systemd, and so are likely unaffected. That includes EndeavourOS. Since researchers are still analyzing the code, Arch took some steps to patch it anyways, just in case there some other hidden backdoor.
Well that’s good to know. Still feeling pretty cozy on fedora, even got secure boot on for whatever that’s worth. Likely not much.
No need to call me out, even if my home instance makes that obvious.
Sorry I assumed you’d get a laugh out of it, wasn’t trying to do any harm.
I was being silly as well :P
lol. Okay good.
The backdoor's probably not "installed" on anything but Debian & distros that use RPM so Arch would probably have been fine just due to that alone, see eg. this HN comment which summarizes things pretty well.
Maybe initially, when nobody knew about it. I bet it'll be reverse engineered and filtered down to script kiddies soon, if it hasn't already. If your server is affected, you should definitely fix it or even reinstall.