XZ backdoor: Hook analysis

The XZ backdoor behavior inside OpenSSH, specifically in version 9.7p1, has been analyzed by Kaspersky experts. The backdoor hides unauthorized connections, allows bypassing SSH authentication, and enables remote code execution on infected servers. Key findings include an anti-replay feature, custom steganography to hide the public key, and log hiding capabilities. The backdoor hooks functions related to RSA key manipulation and has remote command execution capabilities. The attacker can use any username/password to log in without checks and execute system commands. The backdoor also uses an ED448 public key extracted from the binary for decryption and signature verification. The payload decryption involves using ChaCha20 encryption, and the payload signature is verified using the attacker's private key. The backdoor commands include bypassing SSH authentication, remote command execution via 'system' call, and closing the pre-auth session. The analysis details the process of extracting the public key, decrypting the payload, and executing commands with root or non-root privileges.