XZ Backdoor: Timeline and Overview

Sources:

===============================================
===============================================

[dxsop]

This is especially sad for the original maintainer since they literally abused his mental health problems to get their malicious code added. Can’t imagine how Lasse is feeling right now.

[sodaftw]

imagine you create a masterplan and slowly take over a repo in 4 years to literally do one of the biggest backdoors ever created, and one guy, just testing his ssh asking himself why his auth took 500ms longer, destroys everything

[CuriousPiti]

I feel so bad for Lasse :(
Lasse if you happen to read this: we love you and highly appreciate the time and effort you put into xz, stay strong mate!

[repatch]

The bigger question: how many other projects have been targeted and are actively being attacked at this very moment? No chance it was just xz

[DJ-Daz]

The only people prepared to go to such extremes are nation states, possibly ransomware groups, but that's a bit of a stretch. The fact that this was picked up so soon and by pure curiousity is nothing short of a miracle.

Note to self. Don't forget to disable UPnP on your router.

[jimcabezola]

This is by far the clearest explanation of this hack I've ever heard. Thank you for making sense of this!

[CardinalHijack]

imagine how pissed Jia Tan and his pals are. 4 years in the making, busted before the finish line.

[agsystems]

I think you should have said "hack the maintainer's computer", because they absolutely did "hack the maintainer".

[yuri]

All those companies making trilions of dolars over the original maintaner's work and they won't even pay the guy a minimum wage

[arduinoguru]

I live on 3rd world country, I'm using Linux and open source projects for long time, honesty I was thinking donation for open source projects maintainer for long time now, and I did some, but honesty I notice the majority of Linux and open source users don't care about it maintainers at all, there is almost no reliable mechanism to support them, how to put the blame on guy ding all he could for long time and for free, and many time when they ask for support either got none or got negative feedback from some dump useless people.

[KarlRock]

I always wondered who's double checking new commits to open-source projects.... seems to be no one in this case. It sounds like we got lucky with the Microsoft engineer finding this. Pretty scary.

[IsYitzach]

8:54 They almost had enough patience. They started to pressure OS maintainers to include the latest XZ stable build in their next stable release. I think the deadline just barely past them by.

[mathewphoria]

bro Lassie needs to get some MASSIVE donations to a patreon or something considering he has been maintaining the whole internets compression for more than a decade without any compensation. im sure some money might help his mental health. Lassie you are a god damn super hero and you are appreciated!

[akshaj]

This was really well explained, thank you!

[TornTech]

Whenever somthing happens in the CyberSec world. I always look forward to your video to pull all the information together! I like to think i "keep my ear to the ground" but i didn't realize how complex the social engineering part was with many personas on the mailing list! Very much looking forward to a follow up video if the identity of Jia Tan is ever found (State Actor?!) Keep the videos coming!!

[yeet]

Absolutely utterly insane what kind of scale this attack has and what kind of effort is behind all of this. Thanks for the great video! ❤

[Draggie]

This is a great explanatory video! I showed this to someone with absolutely no knowledge about tech and they understood perfectly! Thank you :)

[Sprinkles-ry]

Great to see this video out so quickly but still so accurate and informative. Cannot begin to imagine the follow on effect if this was not discovered! People who are rude to Devs have no place on the internet, ban them all!

[pogdressing]

I completely forgot about the editing being outsourced when i watched this, the video feels a lot more authentic and similar to the original style - amazing bro

[kipchickensout]

You may not go into the exploit details but it's the best video I've seen about this topic so far! nice