How did this happen, what are the implications and what can you do about it?
19 hours ago
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ ~~~~~~
⚙️ Discover my series on Automation of cybersecurity measures. THE Coded.
🔒 Related Stories: Data breaches | Application security | Cyber security
💻 Free content on Cybersecurity Jobs | ✉️ Register for Broadcast list
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ ~~~~~~
You may have heard of the xz utilities vulnerability now if you’re on social media, if you follow me, or if you follow anyone else working in security. You can follow me @teriradichel on x. I usually write about events that happen in the news, but not immediately, because I find that when an incident first happens there is an excessive amount of noise, drama, incorrect perspectives and of speculation. I like to wait for the facts and enough details to develop an informed opinion.
In this case, we may not have all the facts yet, but the evidence from top researchers seems to indicate that this was a problem. Nation-state effort — meaning some governments took the actions that led to this code vulnerability – rather than a random developer in China. And who knows if it came from China or if someone connected to a Chinese network and took steps from there to make it look like it came from China. We may never know for sure. But here’s what we know.
The xz utils vulnerability problem in a nutshell
There is a open source library (free software) called xz utilities which is used in many operating systems like some versions of Linux And the Windowsas well as other software such as Home brewing which deploys software to Apple Macintosh computers.
Someone who helped write this software library inserted malware into this code. Anyone who knew malware existed would be able to take control of your system or steal data from it.
Since this software was included in so many different types of software…