{"id":276809,"date":"2024-04-01T02:07:04","date_gmt":"2024-04-01T09:07:04","guid":{"rendered":"https:\/\/sftarticles.wpenginepowered.com\/es\/?p=329184"},"modified":"2025-07-01T16:49:30","modified_gmt":"2025-07-01T23:49:30","slug":"this-backdoor-has-been-on-the-verge-of-collapsing-the-world-of-free-software","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/this-backdoor-has-been-on-the-verge-of-collapsing-the-world-of-free-software\/","title":{"rendered":"This backdoor has been on the verge of collapsing the world of free software"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Three days ago, researchers revealed <strong>the discovery of an intentionally placed backdoor in xz Utils<\/strong>, an open-source data compression utility available in almost all <a href=\"https:\/\/en.softonic.com\/downloads\/linux\" target=\"_blank\" rel=\"noopener\" title=\"Linux installations\">Linux installations<\/a> and other Unix-like operating systems.<\/p>\n\n<div class=\"sc-card-program\">\r\n  <div class=\"sc-card-program__body\">\r\n    <div class=\"sc-card-program__row clearfix\">\r\n      <div class=\"sc-card-program__col-logo\">\r\n        <img decoding=\"async\" class=\"sc-card-program__img\" alt=\"Windows 11\" src=\"https:\/\/images.sftcdn.net\/images\/t_app-icon-s\/p\/3a83edc2-8bcb-4baa-8fbe-3ddcf458c1a4\/1709716978\/windows-11-win11icon.png\" width=\"100px\" height=\"100px\">\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-title\">\r\n        <span class=\"sc-card-program__title\">Windows 11<\/span>\r\n        <a class=\"sc-card-program__button sc-card-program-internal\" href=\"https:\/\/windows-11.en.softonic.com\/\" target=\"_self\" rel=\"noopener noreferrer\">DOWNLOAD<\/a>\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-rating\">\r\n        <svg class=\"rating-score__content\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\" x=\"0\" y=\"0\" viewbox=\"0 0 50 50\" enable-background=\"new 0 0 50 50\" xml:space=\"preserve\"><path class=\"rating-score__background rating-score--good\" fill=\"none\" stroke-width=\"6\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><path class=\"rating-score__value rating-score__value--0\" fill=\"none\" stroke-width=\"6\" stroke-dashoffset=\"0\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><text class=\"rating-score__number\" content=\"\" text-anchor=\"middle\" transform=\"matrix(1 0 0 1 25 31.0837)\" data-auto=\"app-user-score\"><\/text><\/svg>\r\n      <\/div>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <span class=\"sc-card-program__description\"><\/span>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <img decoding=\"async\" class=\"sc-card-program__bigpic\" src=\"\" onerror=\"this.style.display='none'\">\r\n    <\/div>\r\n    <a class=\"sc-card-program__link track-link sc-card-program-internal\" href=\"https:\/\/windows-11.en.softonic.com\/\" target=\"_self\" rel=\"noopener noreferrer\"><\/a>\r\n  <\/div>\r\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">It is likely that the person or people behind this project have invested years in it. <strong>And it is likely that they were about to incorporate the backdoor update into Debian and Red Hat<\/strong>, the two largest Linux distributions, when a sharp-eyed software developer discovered something suspicious.<\/p>\n\n\n<p class=\"wp-block-paragraph\">Researchers have spent the weekend gathering clues and <a href=\"https:\/\/arstechnica.com\/security\/2024\/04\/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world\/\" target=\"_blank\" rel=\"noopener nofollow\" title=\"Ars Technica\">Ars Technica<\/a> has masterfully summarized it. This is what is known so far.<\/p>\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">? URGENT SECURITY ALERT!<br><br>Secret backdoor found in XZ Utils compression library used by major <a href=\"https:\/\/twitter.com\/hashtag\/Linux?src=hash&amp;ref_src=twsrc%5Etfw\">#Linux<\/a> distros, like Fedora, Kali Linux, and openSUSE. Attackers could breach SSH and take control of systems.<a href=\"https:\/\/t.co\/lnZC90oC2k\">https:\/\/t.co\/lnZC90oC2k<\/a><br><br>Update and review your systems immediately.<\/p>&mdash; The Hacker News (@TheHackersNews) <a href=\"https:\/\/twitter.com\/TheHackersNews\/status\/1773944259718037791?ref_src=twsrc%5Etfw\">March 30, 2024<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n<h2 class=\"wp-block-heading\">What is xz Utils?<\/h2>\n\n\n<p class=\"wp-block-paragraph\">xz Utils is almost ubiquitous in Linux. <strong>It provides lossless data compression on virtually all Unix-like operating systems, including Linux<\/strong>.<\/p>\n\n\n<p class=\"wp-block-paragraph\">xz Utils provides critical functions for compressing and decompressing data during all kinds of operations. xz Utils also supports the legacy .lzma format, making this component even more crucial.<\/p>\n\n\n<h2 class=\"wp-block-heading\">What has happened?<\/h2>\n\n\n<p class=\"wp-block-paragraph\">Andres Freund, a developer and engineer working on Microsoft&#8217;s PostgreSQL offerings, was troubleshooting performance issues experienced by a Debian system with <strong>SSH, the most widely used protocol for remotely logging into devices over the Internet.<\/strong><\/p>\n\n\n<p class=\"wp-block-paragraph\">Specifically, SSH logins consumed too many CPU cycles and generated errors with valgrind, a utility for monitoring computer memory.<\/p>\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"es\" dir=\"ltr\">Vamos a resumir el m\u00e1s reciente problema de seguridad en <a href=\"https:\/\/twitter.com\/hashtag\/Linux?src=hash&amp;ref_src=twsrc%5Etfw\">#Linux<\/a> <br>RedHat lanz\u00f3 el viernes una alerta de seguridad urgente advirtiendo que dos versiones de una popular biblioteca de compresi\u00f3n de datos llamada XZ Utils  conten\u00edan c\u00f3digo malicioso que permit\u00eda acceso no autorizado.\u2026 <a href=\"https:\/\/t.co\/gKwzsnLNjc\">pic.twitter.com\/gKwzsnLNjc<\/a><\/p>&mdash; DiegoGerm\u00e1nGonz\u00e1lez (@Dggonzalez2015) <a href=\"https:\/\/twitter.com\/Dggonzalez2015\/status\/1774123728063943066?ref_src=twsrc%5Etfw\">March 30, 2024<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n<p class=\"wp-block-paragraph\"><strong>Thanks to a combination of luck and Freund&#8217;s attention, he discovered that the problems were due to updates of xz Utils. <\/strong>On Friday, Freund turned to the Open Source Security List to reveal that the updates were the result of someone intentionally introducing a backdoor into the compression software.<\/p>\n\n\n<h2 class=\"wp-block-heading\">What does the back door do?<\/h2>\n\n\n<p class=\"wp-block-paragraph\">The malicious code added to versions 5.6.0 and 5.6.1 of xz Utils modified the software&#8217;s operation when performing lzma compression or decompression operations. When these functions involved SSH, they allowed executing malicious code with root privileges.<\/p>\n\n<div class=\"sc-card-program\">\r\n  <div class=\"sc-card-program__body\">\r\n    <div class=\"sc-card-program__row clearfix\">\r\n      <div class=\"sc-card-program__col-logo\">\r\n        <img decoding=\"async\" class=\"sc-card-program__img\" alt=\"Windows 11\" src=\"https:\/\/images.sftcdn.net\/images\/t_app-icon-s\/p\/3a83edc2-8bcb-4baa-8fbe-3ddcf458c1a4\/1709716978\/windows-11-win11icon.png\" width=\"100px\" height=\"100px\">\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-title\">\r\n        <span class=\"sc-card-program__title\">Windows 11<\/span>\r\n        <a class=\"sc-card-program__button sc-card-program-internal\" href=\"https:\/\/windows-11.en.softonic.com\/\" target=\"_self\" rel=\"noopener noreferrer\">DOWNLOAD<\/a>\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-rating\">\r\n        <svg class=\"rating-score__content\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\" x=\"0\" y=\"0\" viewbox=\"0 0 50 50\" enable-background=\"new 0 0 50 50\" xml:space=\"preserve\"><path class=\"rating-score__background rating-score--good\" fill=\"none\" stroke-width=\"6\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><path class=\"rating-score__value rating-score__value--0\" fill=\"none\" stroke-width=\"6\" stroke-dashoffset=\"0\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><text class=\"rating-score__number\" content=\"\" text-anchor=\"middle\" transform=\"matrix(1 0 0 1 25 31.0837)\" data-auto=\"app-user-score\"><\/text><\/svg>\r\n      <\/div>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <span class=\"sc-card-program__description\"><\/span>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <img decoding=\"async\" class=\"sc-card-program__bigpic\" src=\"\" onerror=\"this.style.display='none'\">\r\n    <\/div>\r\n    <a class=\"sc-card-program__link track-link sc-card-program-internal\" href=\"https:\/\/windows-11.en.softonic.com\/\" target=\"_self\" rel=\"noopener noreferrer\"><\/a>\r\n  <\/div>\r\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>This code allowed someone in possession of a default encryption key to log into the system with a backdoor via SSH.<\/strong> From that moment on, that person would have the same level of control as any authorized administrator.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Thanks to a combination of luck and Freund&#8217;s watchful eye, he discovered that the issues were due to updates of xz Utils in Linux.<\/p>\n","protected":false},"author":9265,"featured_media":276811,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":2},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-276809","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/276809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9265"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=276809"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/276809\/revisions"}],"predecessor-version":[{"id":314098,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/276809\/revisions\/314098"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/276811"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=276809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=276809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=276809"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=276809"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=276809"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=276809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}