@comex Having updates delayed for years provides strong assurance you'll have lots of serious security vulnerabilities unfixed. Most security relevant fixes don't actually receive CVE assignments and therefore don't get backported. Delaying changes for a a month and backporting patches for serious issues might make sense but delaying for years is not going to bring you security. It's also possible that a tiny portion of the huge stream of security vulnerabilities being fixed were intentional.

@comex Many Debian developers likely use Debian unstable. The payload specifically targeted Debian. It relied on Debian adding liblzma as an indirect dependency of sshd through classic Debian downstream patching adding libsystemd as a dependency of sshd which pulled in liblzma. This avoided them needed to do more easily detected cross-process nonsense. If they hadn't caused a performance issue with their code, there's a high chance they would have gotten away with this for much longer.

@comex They could have targeted Arch Linux, NixOS, etc. too but they didn't bother making their payload work on them. They could have done something in systemd itself instead of targeting sshd indirectly. It didn't work on Arch Linux because sshd isn't patched to add notify support and it also seems the attacker hard-wired certain bits for Debian and Fedora. There was also a sockpuppet campaign to get it included into Debian and Fedora ASAP along with the maintainer pushing for it and helping.

@DanielMicay I know.

@DanielMicay …so to be clear, I’m not blaming Debian, just reconsidering stable versus unstable. And yes, lacking upstream fixes is a real issue. But on days like today it sure would have been nice to be hiding behind others rather than bearing the full force of the winds of regressions. Heck, days like that are not uncommon; it’s just that the regressions usually aren’t security-related…

@comex My point is largely that Debian stable users were only shielded from the first phase of this attack. The attack is also quite probably still ongoing since many people will have updated to the backdoored sshd but not yet updated to patch out the backdoor. It's very easy to scan every port across the whole IPv4 space and take advantage of this against every server with it exposed. I don't think it's unlikely that many servers were compromised and that there's another phase happening.