• Welcome to TechPowerUp Forums, Guest! Please check out our forum guidelines for info related to our community.

Backdoor in upstream xz/liblzma leading to ssh server compromise.

Joined
Jan 12, 2023
Messages
190 (0.39/day)
System Name IZALITH (or just "Lith")
Processor AMD Ryzen 7 7800X3D (4.2Ghz base 5.0Ghz boost, -30 PBO offset)
Motherboard Gigabyte X670E Aorus Master Rev 1.0
Cooling Deepcool Gammaxx AG400 Single Tower
Memory Corsair Vengeance 64GB (2x32GB) 6000MHz CL40 DDR5 XMP (XMP enabled)
Video Card(s) PowerColor Radeon RX 7900 XTX Red Devil OC 24GB (3.29Ghz boost -40mV UV)
Storage 2x1TB SSD, 2x2TB SSD, 2x 8TB HDD
Display(s) Samsung Odyssey G51C 27" QHD (1440p 165Hz) + Samsung Odyssey G3 24" FHD (1080p 165Hz)
Case Corsair 7000D Airflow Full Tower
Audio Device(s) Corsair HS55 Surround Wired Headset/LG Z407 Speaker Set
Power Supply Corsair HX1000 Platinum Modular (1000W)
Mouse Corsair RGB Harpoon PRO Wired Mouse
Keyboard Corsair K60 RGB PRO Mechanical Gaming Keyboard
Software Windows 11 Professional

It looks like both Debian Unstable and Fedora 40 onward have had a rogue developer inject malicious code into the xz/liblzma package allowing them to compromise SSH. If you're running either OS and have SSH internet facing, I recommend you have a read of the above link and run the simple detection script included in the link.
 
Joined
Sep 23, 2022
Messages
964 (1.61/day)
System Name Windows
Processor 13900K | 7950X3D
Motherboard Pro Z790-A WiFi | X670 Aorus Elite AX
Cooling Noctua NH-D15s | Noctua NH-D15
Memory 32GB 6600 CL32 | 64GB 6000 CL30
Video Card(s) RTX 4090 | RX 7900 XTX
Display(s) MSI MAG401QR
Case Phanteks P600s | Antec P101s
Power Supply Vertex GX-1000 | Prime TX-850
Software Win 11 Pro
Benchmark Scores They suck.
It also appears to have hit Arch, Open SuSe Tumbleweed and others as well. Debian Stable wasn't affected. Most have released updated packages as well.
 
Top