On: Backdoor in upstream xz/liblzma leading to SSH server compromise

[elintknower]

Candidly how would someone protect against a vulnerability like this?

[devttyeu → elintknower]

Build from source AND run an Ai agent that reviews every single line of code you compile (while hoping that the any potential exploit doesn’t also fool / exploit your AI agent)

[anononaut → elintknower]

Compile all your packages from source would be a start.

[Hackbraten → anononaut]

You’re not wrong. However, building from source wouldn’t have protected you against this specific backdoor. The upstream source tarball itself was compromised in a cleverly sneaky way.

[ui2RjUen875bfFA → Hackbraten]

You might read https://www.openwall.com/lists/oss-security/2024/03/29/4

"However, building from source wouldn’t have protected you against this specific backdoor." Depends on how exactly you build from source. A generic build was not the target. Andres Freund showed that the attack was targeted against a specific type of build system.

[zamalek → Hackbraten]

Building from git, or the github automatic tarball would have. The larger issue here is authenticating tarballs against the source.

[account42 → zamalek]

There is no reason to believe the exploit would have been spotted earlier had the attacker included the final part in git.