453

XZ Hack - "If this timeline is correct, it’s not the modus operandi of a hobbyist. [...] It wouldn’t be surprising if it was paid for by a state actor." (lcamtuf.substack.com)

submitted 7 months ago by Jennykichu@lemmy.dbzer0.com to c/opensource@lemmy.ml

69 comments fedilink hide all child comments

Thought this was a good read exploring some how the "how and why" including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

you are viewing a single comment's thread
view the rest of the comments

[-] KarnaSubarna@lemmy.ml 139 points 7 months ago

Source: https://infosec.exchange/@fr0gger/112189232773640259

[-] Kindness@lemmy.ml 95 points 7 months ago

Imagine finding a backdoor within 45 day of it's release into a supply chain instead of months after infection. This is a most astoundingly rapid discovery.

Fedora 41 and rawhide, Arch, a few testing and unstable debian distributions and some apps like HomeBrew were affected. Not including Microsoft and other corporations who don't disclose their stack.

What a time to be alive.