cross-posted from: https://programming.dev/post/36983916
Freund wasn’t looking for a backdoor when he noticed SSH connections to his Debian testing system taking 500 milliseconds longer than usual. As a database engineer benchmarking PostgreSQL performance, he initially dismissed the anomaly. But the engineer’s curiosity persisted.
The backdoor’s technical sophistication was breathtaking. Hidden across multiple stages, from modified build scripts that only activated under specific conditions to obfuscated binary payloads concealed in test files, the attack hijacked SSH authentication through an intricate chain of library dependencies. When triggered, it would grant the attacker complete remote access to any targeted system, bypassing all authentication and leaving no trace in logs.
The backdoored versions 5.6.0 and 5.6.1 had been released in February and March 2024, infiltrating development versions of Fedora, Debian, openSUSE, and Arch Linux. Ubuntu’s upcoming 24.04 LTS release, which would have deployed to millions of production systems, was mere weeks away.
The technical backdoor was merely the final act of a three-year psychological operation that began not with code, but with studying a vulnerable human being.
The good part of the backdoor to have been found out is that now it’s much harder to pull that again, be it on the same project, or in projects from people that followed through the issue and/or the news - and with how much noise was made, I’d expect quite a lot more of people than the usual to have seen something about.