Detection of new utility backdoor leaves many Linux distributions vulnerable to attacks

Are you a Linux user? If so, you'll want to be aware of a security issue affecting many of the most popular Linux distributions, like Arch, Debian, Fedora, etc.

Backdoor XZ Utils is a serious problem affecting millions of Linux systems, and here's how you can keep your hardware safe.

What is Backdoor XZ Utils?

Detection of new utility backdoor leaves many Linux distributions vulnerable to attacks Picture 1

XZ Utils is an open source file compression and decompression utility suite widely deployed on Linux systems, similar to ZIP. Before the discovery of the backdoor, this utility had a good reputation for effectiveness in the Linux community.

The backdoor in XZ has attracted a lot of attention because of the popularity of the tool and the way attackers penetrate the open source ecosystem.

The backdoor attack appears to be a long-term battle, with attackers taking years to execute. The attacker, using the name "Jia Tan" but whose real identity is unknown, approached XZ's original developer, Lasse Collin, who was behind on software updates. According to Rob Mensching, Collin, for health reasons, eventually gave up maintenance to the attacker.

The suspected attacker then inserted a backdoor to connect to SSH, which is widely used on Linux systems for remote access. This may have gone unnoticed until Microsoft developer Andres Freund noticed that SSH was performing worse than it should. The problem originates from versions 5.6.0 and 5.6.1.

Backdoors allow attackers to remotely take control of systems, and with the popularity of XZ and SSH, this could lead to a large-scale attack. After discovering the XZ backdoor, GitHub terminated the main developer's account and the project's homepage also disappeared.

The attacker's apparent success in covering his tracks and the sophistication of his take on the role of an open source developer has led to speculation by security researchers that the backdoor may have been created by a nation-state. as caused by Russia or China, although according to Wired, there is still no definitive evidence.

Which Linux distributions are affected by the XZ Utils backdoor?

Backdoor XZ is primarily aimed at Red Hat and Debian/Ubuntu distributions, as these are the most widely deployed distributions in enterprises. However, distributions that include newer software, such as Arch Linux, Gentoo, Fedora, and the Testing and Unstable variants of Debian, are most affected because they are more likely to include corrupted versions. XZ influence.

Detection of new utility backdoor leaves many Linux distributions vulnerable to attacks Picture 2

Since enterprise Linux deployments tend to favor stable distributions, they appear to be unaffected for now. Debian said the Stable version, available for download from its website by default, is not affected. Red Hat Enterprise Linux and Ubuntu also appear to be unaffected.

How to protect Linux computers from XZ Utils backdoor

The best way to protect yourself in the short term, regardless of which distribution you use, is to keep it updated through your package manager's update utility. Upon discovering the XZ backdoor, Linux distributions quickly took action, releasing system updates to downgrade the version of XZ Utils installed on the system if necessary. Advanced distributions like Arch also urge users to update as soon as possible.

The attack raises worrying questions about the governance of open source projects. Like many other open source projects, XX Utils is a widely used software, maintained by a non-profit developer. A similar issue led to the Heartbleed bug affecting OpenSSH in 2014.

Detection of new utility backdoor leaves many Linux distributions vulnerable to attacks Picture 3

Projects like these are a component of most Linux distributions, and such open source projects are also common in commercial software. If you check the "About" section of many popular software programs, like Spotify or Google Chrome, you'll see that they also use many open source components internally. XZ Utils is included in Chrome.

Developers use these tools because they make their work much easier (they don't have to write every part of the program from scratch).

Going forward, users and companies will have to reassess their relationship with the open source software they rely on. This could range from closer scrutiny of open source developers as well as finding ways to compensate developers, as Rob Mensching suggests.

It's almost certain that there will be more scrutiny of open source development in the wake of this attack.

backdoor

Marvin Fry

Update 04 April 2024

You should read it

May be interested

Compare the most popular Linux distributions today
it can be said that linux is not a complete operating system, it is just a kernel operating system, which is the foundation for developing other operating systems.
Top 12 most dangerous backdoor in computer history
below is a list of 12 backdoors with the most subtle way of operating in computer history. many of the best experts also know what these 'backdoor' malware codes do on the victim's computer and who is the controller.
Warning of new dangerous malware attack campaign targeting Linux
experts from security firm eset recently discovered a new linux backdoor called wolfsbane, which is being used by the china-linked gelsemium apt hacker group to deploy malicious activities.
5 best Linux distributions for Windows users
in this article, tipsmake.com will introduce you to the best linux distributions for those who have just converted from the windows environment.
17 lightweight Linux distributions bring new life to old computers
older computers are often slow and upgrading components such as ram, cpu and hard drive can alleviate performance problems. however, the best solution to bring new life to your old computer is to install a compact linux distribution.
7 Enterprise Linux Server Distributions
the newest entrants to the linux team are businesses looking for stable and secure distributions to enhance their production cycles.
How to Take Screenshots on Linux
taking screenshots on linux is not as simple as on windows or os are not. luckily, most linux distributions include at least one program that allows taking screenshots, and there are many other software that can be used if you don't have this utility installed.
Learn about SpeakUp - New Malware targets Linux servers
a recent malware chain called speakup is using backdoor attacks to exploit on linux-based servers.
How to get fallen leaves in Minecraft
fallen leaves are a decorative block that spawns naturally in the minecraft world. unlike regular leaves, fallen leaves cannot be respawned after you destroy them.
Network communication utilities in Unix / Linux
when you work in a distribution environment then you need to communicate with remote users and you also need access to remote unix devices.