Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Jonathan Schleifer <js () nil im>]

Am 30.03.24 um 16:10 schrieb Rein Fernhout (Levitating):

> The script attached by Andres was from 5.6.0.
> I extracted the script from both versions and I can verify your diff.
> I attached the two versions I extracted.
>
> It definitely does look like the 5.6.1 version looks for 2 extra scripts 
> to execute.
> I don't get any matches on the greps either though.

My main worry is that when I extracted it, I replaced the sed in here:

sed \"r\n\" $gl_am_configmake | eval $gl_path_map | $gl_localedir_prefix 
-d 2>/dev/null

With a simple cat, as I could not make sed work. This worries me as it 
means there is probably some other transformation that I'm missing that 
would have made the sed work. Which means there's transformations I'm 
missing and those could as well mutate some of the test files or 
resulting payloads. So it could either change the grep itself, or create 
files that match the grep.

Which means I'm not sure that actually no files match and it actually 
executes nothing.

> I also want to look more into the object file.

I think it's time to coordinate things.

I created a chat room for this on Matrix, IRC and Discord -- all bridged 
together so it's essentially one chat room. Those interested, please join:

Matrix: #xz-backdoor-reversing:nil.im
IRC: #xz-backdoor-reversing on irc.oftc.net
Discord: https://discord.gg/XqTshWbR5F

--
Jonathan