ngasemva XZ
Kwiintsuku ezidlulileyo sabelana apha kwiblogi iindaba malunga netyala i-backdoor efunyenwe kusetyenziso lwe-XZ, esetyenziswa kwinani elikhulu lonikezelo lweLinux kwaye ke ichaphazela zonke. Into enomdla malunga netyala labaninzi, kubandakanywa nam, yindlela ukufakwa kwe-backdoor kunye nendlela isini esilungiselelwe ngayo, okanye iimeko zanikezelwa ukuba zithande ukuqaliswa kwekhowudi kwaye yayingahoywa.
Kulo iposti yebhlog nguEvan Boehs (umdwelisi wenkqubo kunye ne-hacker), wabelane ngohlalutyo oluncinane lokulandelelana kwemeko ye-backdoor kwi-XZ. Kupapasho ikhankanya ukuba Umphuhlisi uJia Tan wayenoxanduva lokwazisa i-backdoor kwiphakheji XZ, ukususela Jia Tan ifumene iwonga lomlondolozi ngo-2022 kwaye yaqala ukukhupha iinguqulelo ukususela ngo-5.4.2 weprojekthi ye-XZ. Ukongeza ekusebenzeni XZ, Jia Tan Ukwafake isandla kwi-xz-java kunye ne-xz-embedded packages, kwaye yamkelwa njengomlondolozi weprojekthi eHlaziyo ye-XZ esetyenziswa kwi-Linux kernel.
Ukongeza Jia Tan, i Ukuthatha inxaxheba kwabanye abasebenzisi ababini, uJigar Kumar noHans Jansen, abaninzi abacinga ukuba ngokucacileyo bangaba ngabalinganiswa ababonakalayo. UJigar Kumar wayebandakanyekile ekukhuthazeni Jia Tan amabala yokuqala kwi XZ ukucinezela ngoko-umgcini uLasse Collin ukwamkela utshintsho oluluncedo kunye nokuphumeza inkxaso yezihluzi zentambo ngo-Epreli 2022.
NgoJuni 2022, uLasse Collin wayeka indima yomgcini kuJia Tan, evuma ukudinwa kunye nemiba yempilo yengqondo. Emva kwezi ziganeko, uJigar Kumar akaphindanga wavela kuluhlu lokuposa lweprojekthi.
Ngesimo esitsha umgcini, UJia Tan waqala ukwenza utshintsho kwiprojekthi ye-XZ kwaye, ngokwezibalo, ibekwe kwindawo yesibini phakathi kwabaphuhlisi ngokwenani lotshintsho lweminyaka emibini.
Ngo-Matshi 2023, uLasse Collin wathatha indawo yomntu onoxanduva lokuvavanya iphakheji ye-XZ kwinkonzo ye-oss-fuzz kunye noJia Tan, kwaye ngoJuni utshintsho kukwakheka kwe-XZ lwaphunyezwa, kubandakanywa inkxaso ye-IFUNC indlela kwi-liblzma, eyathi ke yasetyenziswa ukuququzelela ukucalulwa kwemisebenzi kwi-backdoor. Isiphakamiso solu tshintsho sivela kuHans Jansen, oye wadalwa i-akhawunti ngaphambi kokuba angenise isicelo sokutsala esinxulumene nolu tshintsho.
En NgoJulayi 2023, uJia Tan ucele abaphuhlisi be-oss-fuzz ukuba bacime ukujonga ifunc ngenxa yokungahambelani kwayo ne "-fsanitize=address«. NgoFebruwari 2024, ikhonkco kwiwebhusayithi yeprojekthi ye-XZ yatshintshwa kwi-oss-fuzz kunye ne-tukaani.org, isuka kwi-domain engundoqo ukuya kwi-subdomain. Le subdomain yokugqibela yabanjwa kwiGitHub Pages kwaye yayilawulwa buqu nguJia Tan.
Ngomhla we-23 kaFebruwari, iifayile zokuvavanya i-decoder, kubandakanywa iifayile ezine-backdoor, zapapashwa kwifayile kodwa zavela kwifayile .gitignore.
NgoMatshi 17, uHans Jansen, ngaphambili ebebandakanyeka kwiipetshi ngenkxaso ye-IFUNC, ibhaliswe njengomxhasi kwiprojekthi yeDebian. Ngomhla wesi-25 kuMatshi, ifumene isicelo sokuhlaziya uguqulelo lwephakheji ye-xz-utils kwindawo yokugcina ukusuka kwiDebian. Kuyafaneleka ukukhankanya ukuba izicelo ezifanayo zivela kubaphuhlisi be-Fedora kunye no-Ubuntu (nangona ku-Ubuntu, utshintsho lwaliwe ngenxa yokugcinwa komkhenkce).
Abasebenzisi abaninzi bajoyine izicelo zohlaziyo lwe-XZ, Ukuxoxa ukuba uguqulelo olutsha iimpazamo ezilungisiweyo zichongiwe ngexesha lokulungisa iimpazamo kwi-valgrind. Le miba yavela ngenxa yokuzimisela okungalunganga kwe-stack layout kwisilawuli se-backdoor, ezama ukuyicombulula kwi-XZ 5.6.1 yokukhululwa.
Malunga noku, ULasse Collin ukhuphe ingxelo eqinisekisa ukuba iifayile eziqulathe iinguqulelo zasemva zenziwe kwaye zasayinwa nguJia Tan Ukongeza, wabhengeza ukususwa kwesizinda se-xz.tukaani.org, ebonisa ukuba indawo ye-xz iya kubuyela kumncedisi oyintloko we-ukaani.org. Kwakhona wakhankanya ukuba i-akhawunti yakhe ye-GitHub ivaliwe. Kubalulekile ukubalula oko ULasse Collin unolawulo kwiwebhusayithi ye-tukaani.org kuphela kunye noovimba be-git.tukaani.org. Kwelinye icala, uJia Tan wayelawula kuphela iprojekthi kwi-GitHub kunye ne-xz.tukaani.org host, kodwa akazange abe nofikelelo kumncedisi we tukaani.org.
Ukuba unomdla wokwazi ngakumbi ngayo, ungajonga iinkcukacha ku eli khonkco lilandelayo.