Re: Malware find in the news: xz related.

Grant Taylor <gtaylor@tnetconsulting.net> wrote:

On 3/31/24 11:13, David W. Hodgins wrote:

sshd supports compression. xz is an option for how things are compressed.

>
I've read multiple reports that OpenSSH upstream does not support xz
compression.
>
Yes, OpenSSH does support multiple forms of compression, but xz is not
one of the form supported by upstream OpenSSH proper.
>
xz support was brought in by things downstream.

As far as I have understood this _very_ sophisticated method, ssh is
patched by various distributions with a path endorsed by the portable
openssh project to support sd_notify. This pulls in libsystemd, which
in turn pulls in the trojaned liblzma, which in turn hooks an RSA
function which is then used by the ssd to autenticate a user who tries
to log in.

For this to work, sshd does not need to use xz.

Greetings
Marc
--
----------------------------------------------------------------------------
Marc Haber         |   " Questions are the         | Mailadresse im Header
Rhein-Neckar, DE   |     Beginning of Wisdom "     |
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 6224 1600402