XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
1–10 of 862 posts
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#2[deleted]
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#3EDIT: Here's some more RE work on the matter. Has some symbol remapping information that was extracted from the prefix trie the backdoor used to hide strings. Looks like it tried to hide itself even from RE/analysis, too.
https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9...
Full list of decoded strings here:
https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01
--
For someone unfamiliar with openssl's internals (like me): The N value, I presume, is pulled from the `n` field of `rsa_st`:
https://github.com/openssl/openssl/blob/56e63f570bd5a479439b...
Which is a `BIGNUM`:
https://github.com/openssl/openssl/blob/56e63f570bd5a479439b...
Which appears to be a variable length type.
The back door pulls this from the certificate received from a remote attacker, attempts to decrypt it with ChaCha20, and if it decrypts successfully, passed to `system()`, which is essentially a simple wrapper that executes a line of shellscript under whichever user the process is currently executing.
If I'm understanding things correctly, this is worse than a public key bypass (which myself and I think a number of others presumed it might be) - a public key bypass would, in theory, only allow you access as the user you're logging in with. Assumedly, hardened SSH configurations would disallow root access.
However, since this is an RCE in the context of e.g. an sshd process itself, this means that sshd running as root would allow the payload to itself run as root.
Wild. This is about as bad as a widespread RCE can realistically get.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#4[deleted]
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#5Is there a git diff which shows this going in?
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#6So this basically means to scan for this exploit remotely we'd need the private key of the attacker which we don't have. Only other option is to run detection scripts locally. Yikes.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#7[deleted]
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#8If that's true, then I am 100% certain that this backdoor is from a nation state-level actor.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#9If that's true, then I am 100% certain that this backdoor is from a nation state-level actor.
That's what this feels like. That, or someone who wanted to sell this to one. Can't imagine the ABC's are sleeping on this one at this point.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#10[dead]