2 ms·

Malicious Maven Package Impersonating 'XZ for Java' Library Introduces Backdoor

• salawat 2y ago
  Better idea: Don't use someone elses thing, until you have read and understand the damn thing. Once you have done that, either pin it to that piece at that revision, and never update as long as it does what you need, or just bloody re-implement it yourself. Boom. Saved from a supply chain attack. I know, it requires reading code. Oh noes. Them's the breaks. Also, this would only actually allow a compromise as part of an exploit chain, as without firewall rules being explicitly setup to permit traffic between hosts on port 11337, that traffic would get nixed at the network layer. For a production system, you whitelist any expected network traffic. Depending on what you're doing, that may include locking down expected ports on the loop back connection. If they try to augment it to call out, then you might have issues, but that significantly inflated this gadget's size. I would absolutely not worry about this nonsense on any of my systems. Interesting that xz in particular seems to attract these types of compromises/attacks though.