Backdoor in upstream xz/liblzma leading to SSH server compromise

#1

Post by rkta » Fri, Mar 29, 2024, 4:16 PM UTC

Backdoor in upstream xz/liblzma leading to SSH server compromise
openwall.com

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#2

Post by Rucadi » Fri, Mar 29, 2024, 4:33 PM UTC

Saw this on nix, which was using a compromised version in the unstable channel, I hope not too many systems are affected.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#3

Post by jeffbee » Fri, Mar 29, 2024, 4:36 PM UTC

Safety through obscurity and weirdness! If you disable ifunc, like any sensible person, this backdoor disables itself.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#4

Post by _mlbt » Fri, Mar 29, 2024, 4:36 PM UTC

> openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma.

It looks to be limited to Linux systems that are running certain patches. macOS and BSD seem unaffected?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#5

Post by rasengan » Fri, Mar 29, 2024, 4:37 PM UTC

> One portion of the backdoor is solely in the distributed tarballs. For easier reference, here's a link to debian's import of the tarball, but it is also present in the tarballs for 5.6.0 and 5.6.1:

Ubuntu 22.04 version:

dpkg -l |grep liblzma ii liblzma5:amd64 5.2.5-2ubuntu1 amd64 XZ-format compression library

Whew!

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#6

Post by yogorenapan » Fri, Mar 29, 2024, 4:40 PM UTC

Very strange behavior from the upstream developers. Possible government involvement? I have a feeling LANG is checked to target servers from particular countries

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#7

Post by cf100clunk » Fri, Mar 29, 2024, 4:40 PM UTC

  I am *not* a security researcher, nor a reverse engineer.  There's lots of
  stuff I have not analyzed and most of what I observed is purely from
  observation rather than exhaustively analyzing the backdoor code.

I love this sort of technical writing from contributors outside the mainstream debugging world who might be averse to sharing. What an excellently summarized report of his findings that should be seen as a template.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#8

Post by agwa » Fri, Mar 29, 2024, 4:40 PM UTC

> openssh does not directly use liblzma. However debian and several other distributions patch openssh to support systemd notification, and libsystemd does depend on lzma.

The systemd notification protocol could have been as simple as just writing a newline to a pipe, but instead you have to link to the libsystemd C library, so now security-critical daemons like openssh have additional dependencies like liblzma loaded into their address space (even if you don't use systemd as PID 1), increasing the risks of supply chain attacks. Thanks, systemd.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#9

Post by 0x0 » Fri, Mar 29, 2024, 4:41 PM UTC

Homebrew is currently shipping 5.6.1 (and was shipping 5.6.0 as well). Hopefully not affected on mac?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#10

Post by asveikau » Fri, Mar 29, 2024, 4:42 PM UTC

That's completely crazy, the backdoor is introduced through a very cryptic addition to the configure script. Just looking at the diff, it doesn't look malicious at all, it looks like build script gibberish.