HN user

gertvdijk

5 karma

https://blog.g3rt.nl/

Posts0
Comments1
View on HN
No posts found.
Backdoor in upstream xz/liblzma leading to SSH server compromise 2 years ago

They just signed each other's keys around that time, and one needs to redistribute the public keys for that; nothing suspicious about it I think. The key fingerprint 22D465F2B4C173803B20C6DE59FCF207FEA7F445 remained the same.

before:

    pub   rsa4096/0x59FCF207FEA7F445 2022-12-28 [SC] [expires: 2027-12-27]
        22D465F2B4C173803B20C6DE59FCF207FEA7F445
    uid                             Jia Tan <jiat0218@gmail.com>
    sig        0x59FCF207FEA7F445 2022-12-28   [selfsig]
    sub   rsa4096/0x63CCE556C94DDA4F 2022-12-28 [E] [expires: 2027-12-27]
    sig        0x59FCF207FEA7F445 2022-12-28   [keybind]
after:
    pub   rsa4096/0x59FCF207FEA7F445 2022-12-28 [SC] [expires: 2027-12-27]
        22D465F2B4C173803B20C6DE59FCF207FEA7F445
    uid                             Jia Tan <jiat0218@gmail.com>
    sig        0x59FCF207FEA7F445 2022-12-28   [selfsig]
    sig        0x38EE757D69184620 2024-01-12   Lasse Collin <lasse.collin@tukaani.org>
    sub   rsa4096/0x63CCE556C94DDA4F 2022-12-28 [E] [expires: 2027-12-27]
    sig        0x59FCF207FEA7F445 2022-12-28   [keybind]
Lasse's key for reference:
    pub   rsa4096/0x38EE757D69184620 2010-10-24 [SC] [expires: 2025-02-07]
        3690C240CE51B4670D30AD1C38EE757D69184620
    uid                             Lasse Collin <lasse.collin@tukaani.org>
    sig        0x38EE757D69184620 2024-01-08   [selfsig]
    sig        0x59FCF207FEA7F445 2024-01-12   Jia Tan <jiat0218@gmail.com>
    sub   rsa4096/0x5923A9D358ADF744 2010-10-24 [E] [expires: 2025-02-07]
    sig        0x38EE757D69184620 2024-01-08   [keybind]
0ThreadHN