The xz backdoor is naturally still the top story of the week. If you need a refresher, see our previous coverage. As expected, some very talented reverse engineers have gone to work on the code, and we have a much better idea of what the injected payload does.
One of the first findings to note is that the backdoor doesn’t allow a user to log in over SSH. Instead, when an SSH request is signed with the right authentication key, one of the certificate fields is decoded and executed via a system() call. And this makes perfect sense. An SSH login leaves an audit trail, while this backdoor is obviously intended to be silent and secret.
It’s interesting to note that this code made use of both autotools macros, and the GNU ifunc, or Indirect FUNCtions. That’s the nifty feature where a binary can include different versions of a function, each optimized for a different processor instruction set. The right version of the function gets called at runtime. Or in this case, the malicious version of that function gets hooked in to execution by a malicious library. Continue reading “This Week In Security: XZ, ATT, And Letters Of Marque”
Underneath its icy surface, Europa appears to have a sea that contains twice as much water as we have here on Earth. Launching later this year and arriving in 2030, NASA’s Europa Clipper will provide us with our most up-close-and-personal look at the Jovian Moon yet. In conjunction with observations from the ESA’s Jupiter Icy Moons Explorer (JUICE), scientists hope to gain enough new data to see if the conditions are right for life.
