{"id":72393,"date":"2024-04-05T00:12:43","date_gmt":"2024-04-05T04:12:43","guid":{"rendered":"https:\/\/world.edu\/?p=72393"},"modified":"2024-04-05T00:12:43","modified_gmt":"2024-04-05T04:12:43","slug":"an-anonymous-coder-nearly-hacked-a-big-chunk-of-the-internet-how-worried-should-we-be","status":"publish","type":"post","link":"https:\/\/world.edu\/an-anonymous-coder-nearly-hacked-a-big-chunk-of-the-internet-how-worried-should-we-be\/","title":{"rendered":"An anonymous coder nearly hacked a big chunk of the internet. How worried should we be?"},"content":{"rendered":"

\"\"<\/p>\n

Outside the world of open-source software, it\u2019s likely few people would have heard about XZ Utils, a small but widely used tool for data compression in Linux systems. But\u00a0late last week<\/a>, security experts uncovered a serious and deliberate flaw that could leave networked Linux computers susceptible to malicious attacks.<\/p>\n

The flaw has since been confirmed as a critical issue that could allow a knowledgeable hacker to gain control over vulnerable Linux systems. Because Linux is used throughout the world in email and web servers and application platforms, this vulnerability could have given the attacker silent access to vital information held on computers throughout the world \u2013 potentially including the device you\u2019re using right now to read this.<\/p>\n

Major software vulnerabilities, such as\u00a0the SolarWinds hack<\/a>\u00a0and\u00a0the Heartbleed bug<\/a>, are nothing new \u2013 but this one is very different.<\/p>\n

The XZ Utils hack attempt took advantage of the way open-source software development often works. Like many open-source projects, XZ Utils is a crucial and widely used tool \u2013 and it is maintained largely by a single volunteer, working in their spare time. This system has created huge benefits for the world in the form of free software, but it also carries unique risks.<\/p>\n

Open source and XZ Utils<\/strong><\/h4>\n

First of all, a brief refresher on open-source software. Most commercial software, such as the Windows operating system or the Instagram app, is \u201cclosed-source\u201d \u2013 which means nobody except its creators can read or modify the source code. By contrast, with \u201copen-source\u201d software, the source code is openly available and people are free to do what they like with it.<\/p>\n

Open-source software is very common, particularly in the \u201cnuts and bolts\u201d of software which consumers don\u2019t see, and hugely valuable. One\u00a0recent study<\/a>\u00a0estimated the total value of open source software in use today at US$8.8 trillion.<\/p>\n

Until around two years ago, the XZ Utils project was maintained by a developer called Lasse Collin.\u00a0Around that time<\/a>, an account using the name Jia Tan submitted an improvement to the software.<\/p>\n

Not long after, some previously unknown accounts popped up to report bugs and submit feature requests to Collin, putting pressure on him to take on a helper in maintaining the project. Jia Tan was the logical candidate.<\/p>\n

Over the next two years<\/a>, Jia Tan become more and more involved and, we now know, introduced a carefully hidden weapon into the software\u2019s source code.<\/p>\n

The revised code secretly alters another piece of software, a ubiquitous network security tool called OpenSSH, so that it passes malicious code to a target system. As a result, a specific intruder will be able to run any code they like on the target machine.
\nThis is not a drill. Linux users must check their xz installations<\/p>\n

A remote SSH-based backdoor has been found in the widely used data compression library and tool, and has made its way into public distributions, including recent Fedora and Kali Linux https:\/\/t.co\/ymiy8GxLG5<\/a><\/p>\n

\n

\u2014 The Register (@TheRegister) March 29, 2024<\/a>