This is extremely interesting, in that this Linux SSH backdoor that was introduced through xz seems to have been reported by a Microsoft employee at just the perfect time to take heat away from Microsoft for a large percentage of Exchange servers that are unpatched against vulnerabilities as disclosed by Germany. Consequently, the xz SSH backdoor didn’t make it to many Linux versions, with many being development branches. In the case of Arch based distributions, they weren’t affected as the script and exploit mechanism only affected RPM and DEB based distributions that used the related library. But the German revelations about unpatched and out of service Exchange servers shows a major flaw with Microsoft’s business model and security support, where Linux is open source and receives much more support for a longer period of time, and since open source it can even be improved or extended through third parties or your own developers. So was this a sneaky marketing coverup? As they say with propaganda, don’t look here, look over there.
https://techrights.org/n/2024/03/31/Microsoft-Exchange-chaos-the-real-news.shtml
By Roy Schestowitz
The more important news to watch today or this weekend: (it’s still largely unresolved and it enables blackmail, political/industrial espionage, and further security breaches)
For many of the above servers, it’s unequivocally a case of “too late”. The E-mails (and beyond) got copied by hostile actors and the consequences remain to be seen for years to come. This can cause suicides and cost billions of euros/dollars in damages (over time).
Oh, forget about that!
Let’s talk about the version of xz that’s in Microsoft’s GitHub.
Microsofters didn’t invent a logo and a brand name for it this time around?
Well, we guess not. Or not yet.
So earlier on we made some remarks on the flaws that impacted mostly cutting-edge distros (which rush to adopt new and untested/unaudited stuff). We saw that before with OpenSSL and similarly security-sensitive packages, which distros typically adopt just months later (maturity required). We wrote some articles about it in 2021, rebutting the scare-mongering and hype/FUD. Microsofters played a big role in that FUD at the time. It happened again a year later (2022).
Now it’s 2024. The facts still matter.
The media mostly credits Red Hat (regarding xz), but Red Hat was merely a respondent, and Red Hat formally complained about words like “backdoor” or logos and brand names being leveraged to hype up holes like “heartbleed” (which did not actually cause much damage, it just caused damage to the perception/image of Linux, owing to endless media hype that lasted many years).
As we explained at the time, and many times in fact, Microsofters were responsible for this hype campaign (even if the original discovery came from a Google employee).
So today it seems familiar. Why? Because the latest reports we’ve found make it clear that the disclosure came from Microsoft staff at a very strategic time (see screenshots above).
What Microsoft wants you not to notice (or resort to “whataboutism” when clients choose to move to GNU/Linux) is the stuff at the top.
Yes, Andres Freund works for Microsoft. It was not clear at first. He used his anarazel.de email instead of Microsoft email. Why?
What a timing to disclose his ‘revelations’ (a lot of this involves GitHub, not just systemd, which is led/run by Microsoft staff).
As noted above, Microsofters did the same with “heartbleed” over a decade ago. Because “Microsoft heart Linux”.
So what exactly happened here? One can guess based on salient points of evidence.
Stockpiling holes for strategic times?
We debated this in length only a week ago in IRC because any time Microsoft has an epic security blunder the “Linux” news suddenly gets filled with FUD. And once again they’re bombarding all “Linux” related news with alarming security-themed headlines (not so unprecedented a pattern). The Friday/Saturday news about “Linux” looked like this, and that’s aside from the above. Pseudonymous reporters, who could even be on Microsoft’s payroll, released some information about a hole just at the same time Microsoft had a lot of answering to do (and an emergency patch, which came far too late, as servers had already been breached, exposing perhaps trillions of emails, some of them very sensitive).
We need answers here. For instance, how long has Microsoft’s Andres Freund known about this issue? Did someone give him a tip?
This man is in the business of selling Windows, not Linux, and at Microsoft security is never the objective. It is just another “product” or “add-on”. █