Email or username:

Password:

Forgot your password?
Top-level
Kevin Beaumont

The person/account on XZ repo also altered the security disclosure policy on that and other repos they author in months prior.

14 comments
jbaggs

@GossiTheDog That's interesting. So basically removed all of the requests for specific information, and left reporting as: "send us an email or something"?

Kevin Beaumont

@jbaggs yeah. So they changed one to β€œIf you discover a security vulnerability in this project please report it privately. Do not disclose it as a public issue.” as an example. Looks like a long game attack.

jbaggs

@GossiTheDog I had just looked at the one on xz. That's definitely worse.

jaark

@GossiTheDog

How long before the numpties begin combining this with their Baltimore bridge cyber conspiracy theories?

Kevin Beaumont

Interesting find by @fuomag9 - the XZ repo person tried getting Ubuntu to update yesterday by filing a bug report bugs.launchpad.net/bugs/205941

Kevin Beaumont

The Twilight zone time - a bug from 2015 comes back around in XZ incident, it appears github.com/google/sanitizers/i

uoxc

@GossiTheDog wait, are we at "implementing features to get plausible deniability for evading vuln scanning?"

Because if so this feels quite novel. At the very least I can't remember a comparable supply chain attack of this sophistication from the top of my head

Tony Hoyle

@uoxc @GossiTheDog Doesn't need to be that sophisticated..

Either (a) developer continues submitting other work whilst compromising at least one project. or (b) the account is in use by two people - the real developer and a hacker.

So the question becomes compromised account or compromised developer.

In the first case it's not that unbelievable that someone who was up to no good would try to cover their tracks by doing other unrelated things.

Bill

@GossiTheDog @fuomag9 @gabrlelle says "THIS IS WHY I HAVE TRUST ISSUES."

πŸ³οΈβ€πŸŒˆπŸŽƒπŸ‡§πŸ‡·LuanaπŸ‡§πŸ‡·πŸŽƒπŸ³οΈβ€πŸŒˆ :verified:

@GossiTheDog @fuomag9 Interesting that Debian and other distros already knew about the issue (on embargo) and were already reverting, but Ubuntu didn’t seem to know about it yet from these comments

Also, reading these comments apparently 5.6.0 was already on ubuntu?

Go Up