Get the latest tech news
Xz sshd backdoor collecting usernames from logs
The amazingly scary xz sshd backdoor, Author: Bojan Zdrnja
Unless you took the whole weekend off, you must have seen by now that Andres Freund published an amazing discovery on Friday on the Openwall mailing list ( https://www.openwall.com/lists/oss-security/2024/03/29/4). The image above shows start of the function (originally called Lsimple_coder_update_0) where I also expanded one of the radix tree tables (_Llzip_decode_1). The final function we’ll take a look at is also interesting – it will parse every log created by the sshd service and will try to extract valid usernames and IP addresses.
Or read this on Hacker News