Hacker News Reader

Comment by influx | Hacker News Reader

This is the second time Devin changes to ssh have led to vulnerabilities.

Never trust Devin. Should have been clear from the first Debian-specific "improvement", which brought us the first ssh mess. systemd notifications are much easier to get than linking to it, and thus enabling such a backdoor. Amateurs shouldnt mess with critical security infra, esp. Debian's

What does Devin have to do with xz?

Not much. He just applied the debian-specfic systemd-notify patch to ssh to enable this xz backdoor. As he did with the previous debian ssh desaster, breaking it the last time.

CVE-2008-0166

It was really bad.

https://github.com/g0tmi1k/debian-ssh

Yes I know that one. But I don’t really see a conection still. The xz backdoor was not introduced by Debian, it was introduced by a bad faith actor via the xz project (aka liblzma). Not only Debian was affected, Fedora was too.

AFAIK there is no evidence that CVE-2008-0166 was done deliberately, whereas with the xz backdoor, there seems to be lots of signs of deliberate intent.

The backdoor was possible because Debian introduced a dependency into sshd, libsystemd, which in turn linked to liblzma. Official sshd does not have a systemd dependency in the same way that official sshd back in 2008 did not suffer from a predictable PRNG.

Debian is also 100% at fault here and I hope this slap in the face makes them reconsider their poor security practices. Amateur package maintainers should not be overstepping their job (packaging) and enabling disastrous vulnerabilities in security-critical software.

You have a point there. For the record, Fedora was affected too.

That's ridiculous. Adding the dependency to libsystemd in no way created any vulnerability. Even the indirect dependency on liblzma didn't add any vulnerability. It took a separate malicious maintainer doing a later change to liblzma so that it ran code when the library was loaded to create the vulnerability.

I wrote 'was possible' and 'enabled', not 'created'. By paying more attention to what others write you'll avoid superficial dismissals that prevent you from improving your understanding of complex issues.

The creation of this backdoor did not take place in a vacuum. Can you imagine the same person trying to introduce build changes and binary test cases into openssh? This backdoor was crafted in this particular way _specifically_ to exploit the fact that sshd in distributions such as Debian is being indirectly linked with lzma.

> Amateur package maintainers should no [...]

At least there is no lack of amateur enthusiasts telling people how they are wrong. :)

Reply on news.ycombinator.com