Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 31 Mar 2024 22:33:47 +0200
From: Solar Designer <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

On Sat, Mar 30, 2024 at 11:00:09PM +0100, Solar Designer wrote:
> On Fri, Mar 29, 2024 at 08:51:26AM -0700, Andres Freund wrote:
> > This injects an obfuscated script to be executed at the end of configure. This
> > script is fairly obfuscated and data from "test" .xz files in the repository.
> Gynvael Coldwind @gynvael performed what's probably the most elaborate
> analysis of the bash obfuscation so far.  I'm posting it in here on his
> behalf.  The original blog post is at:

Much of the scripted part of the backdoor is now also illustrated by 
Thomas Roccia @fr0gger_ in:

I'm attaching a scaled down and color-reduced (but legible) version of
the image ("convert -strip -quality 100 -resize 50% -colors 12").


Download attachment "fr0gger-xz-backdoor.png" of type "image/png" (173677 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.