A Malicious Backdoor Discovered in Homebrew Linux

Recently, a malicious backdoor was discovered in the xz Utils package manager for macOS, which relies on the compression utility known as xz Utils. The malicious code was introduced in versions 5.6.0 and 5.6.1 of xz Utils and was present in archived releases-known as tarballs-which are released upstream.

According to officials from Red Hat, the backdoor was discovered when a developer noticed that the obfuscated code introduced on February 23 had been added to the GIT version of the project. The backdoor allows for the injection of malicious code during the build time and can operate even in the absence of the obfuscated code.

The malicious install script that injected itself into functions used by sshd, the binary file that makes SSH work, was also discovered on February 24. Officials from Red Hat stated that the first signs of the backdoor were introduced in a February 23 update that added obfuscated code.

HomeBrew has now rolled back the utility to version 5.4.6, and several people have reported that multiple apps included in the HomeBrew package manager for macOS rely on the backdoored 5.6.1 version of xz Utils. However, it's worth noting that the distribution is not used in production systems.

Will Dormann, a senior vulnerability analyst at security firm Analygence, stated that because the backdoor was discovered before the malicious versions of xz Utils were added to production versions of Linux, 'it's not really affecting anyone in the real world.'

A stable release of Arch Linux is also affected. Although there are no known reports of those versions being incorporated into any production releases for major Linux distributions, both Red Hat and Debian reported that recently published beta releases used at least one of the backdoored versions-specifically, in Fedora Rawhide and Debian testing, unstable, and experimental distributions.

Andres Freund, the developer who discovered the malicious code, stated that it was introduced by JiaT75, one of the two main xz Utils developers with years of contributions to the project. The discovery of the backdoor is a significant reminder of the importance of security and vigilance in the world of open-source software.

In conclusion, the discovery of a malicious backdoor in the xz Utils package manager for macOS highlights the importance of regular updates and checks for vulnerabilities in open-source software. It also serves as a reminder that even the most trusted software can contain hidden dangers, and it's essential to stay vigilant and proactive in protecting against these threats.

Homebrew linux