Re: Malware find in the news: xz related.

In comp.os.linux.misc, pH  <wNOSPAMp@gmail.org> wrote:

I just saw this while looking through a news feed.
 
https://www.helpnetsecurity.com/2024/03/29/cve-2024-3094-linux-backdoor/
 
I have not read the entire article yet, but it has been said
to have been
found accidentally.

The initial report is quite readable:

https://www.openwall.com/lists/oss-security/2024/03/29/4

Found because someone was trying to benchmark something else and ssh was
using noticable cpu. An exploit hidden by a multi-year contributor who
got promoted to maintainer. The exploit is hidden in a "bad" xz
compessed "test" file, a simple use of `tr` repairing the file. Today's
exploit specifically targets sshd on Debian, but there's no reason to
think that this was a final target instead of a first target.

Elijah
------
Easter weekend security scamble