[richin13]

I read somewhere that some recent changes in systems would've made the backdoor useless so they had to rush out, which caused them to be reckless and get discovered

[sho_hn]

This refers to the fact that systemd was planning to drop the dependency on liblzma (the conpression library installed by xz), and instead dlopen it at runtime when needed. Not for security reasons, but to avoid pulling the libs into initramfs images.

The backdoor relies on sshd being patched to depend on libsystemd to call sd_notify(), which several distros had done.

OpenSSH has since merged a new patch upstream that implements similar logic to sd_notify() in sshd itself to allow distros to drop that patch.

So the attack surface of both sshd and libsystemd has since shrunk a bit.

[rav]

> The backdoor relies on sshd being patched to depend on libsystemd to call sd_notify

I remember when we added sd_notify support to our services at work, I was wondering why one would pull in libsystemd as a dependency for this. I mean, there's a pure-Python library [1] that basically boils down to:

  import os, socket
  
  def notify(state=b"READY=1"):
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
    addr = os.getenv('NOTIFY_SOCKET')
    if addr[0] == '@':
     addr = '\0' + addr[1:]
    sock.connect(addr)
    sock.sendall(state)

With proper error handling, that's about 50 lines of C code. I would vendor that into my application in a heartbeat.

[1]: https://raw.githubusercontent.com/bb4242/sdnotify/master/sdn...

[richin13]

> systems

damn it, autocorrect!