Their experience could make for a valuable lesson and prevent future occurrences.
P.S., this does not look like an individual behavior. It's hard to imagine that an individual would spend three years just to plant a backdoor in sshd.
He made a sock puppet asking debian to update the package in 'unstable'. (along with other package update requests so it wouldn't look suspicious).
And IDK that we've entirely ruled out that Jia Tan didn't wind up being blackmailed or coerced or something -- although if they were really running sockpuppets to get themselves added to the project up front that is probably less likely.
(1) changing the RSA decrypt function in OpenSSH is all the code hidden in crc64 does: that's the only known behavior, but we don't know what the changed function does besides letting some authentication through, nor do we know if there are other things it does
(2) there's no malicious machine in your LAN exploiting the RSA decrypt to log onto your sshd: nobody has seen one yet, but it doesn't mean there's no such thing.
If you are not using a distro that does dpkg or rpm, or if your machine is not x86-64, you're free from the "code hidden in crc64", the one that targets sshd, CVE-2024-3094. Are there unknown backdoors? Who knows. Do we count the landlock sabotage as a backdoor?
It's hard to deal with unknowns. Assume the worst, maybe, but what even is the worst?
It is unclear what exploiting means. The backdoor is doing _something_ for 0.5s if RSA key exchange happens.
So even a valid login might trigger not yet known side effects. It might just tunnel commands over dns for example (DNS being a well known side effect of ssh anyway).
So "exploiting" might mean as little as "used ssh".
The backdoor is not fully analyzed as of now. As such nothing can be said about the system besides "it is potentially compromised".
For it to turn out like this is incredibly disappointing
Extremely wicked backdoor, but he only lost the main maintainer and github. Github will be reactivated soon for him, so others can take over.
It was said he is on an internet break at the moment, so I hope this doesn't ruin weeks for him. It's thankless enough to maintain something like xz.
