Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

61–70 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#61

Post by cesarb »

asveikau wrote: post #27

I have found it irritating how in the community, in recent years, it's popular to say that if a project doesn't have recent commits or releases that something is seriously wrong. This is a toxic attitude. There was nothing wrong with "unmaintained" lzma two years ago. The math of the lzma algorithm doesn't change. The library was "done" and that's ok. The whiny mailing list post from the sock puppet, complaining abou…

> The math of the lzma algorithm doesn't change. The library was "done" and that's ok.

Playing devil's advocate: the math doesn't change, but the environment around it does. Just off the top of my head, we have: the 32-bit to 64-bit transition, the removal of pre-C89 support (https://fedoraproject.org/wiki/Changes/PortingToModernC) which requires an autotools update, the periodic tightening of undefined behaviors, new architectures like RISC-V, the increasing amount of cores and a slowdown in the increase of per-core speed, the periodic release of new and exciting vector instructions, and exotic security features like CHERI which require more care with things like pointer provenance.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#62

Post by greyface- »

ronsor wrote: post #54
greyface- wrote: post #43

Earlier quoted context omitted.

I understand the impulse to seek justice, but what crime have they committed? It's illegal to gain unauthorized access, but not to write vulnerable code. Is there evidence that this is being exploited in the wild?

It's not simply vulnerable code: it's an actual backdoor. That is malware distribution (without permission) and is therefore illegal.

Is it illegal to distribute malware? I see security researchers doing it all the time for analysis purposes.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#63

Post by hellcow »

jeroenhd wrote: post #12
junon wrote: post #3

EDIT: Here's some more RE work on the matter. Has some symbol remapping information that was extracted from the prefix trie the backdoor used to hide strings. Looks like it tried to hide itself even from RE/analysis, too. https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9... Full list of decoded strings here: https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01 -- For someone unfamiliar with openssl…

> However, since this is an RCE in the context of e.g. an sshd process itself, this means that sshd running as root would allow the payload to itself run as root. With the right sandboxing techniques, SELinux and mitigations could prevent the attacker from doing anything with root permissions. However, applying a sandbox to an SSH daemon effectively is very difficult.

Another reason to adopt OpenBSD style pledge/unveil in Linux.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#64

Post by ronsor »

greyface- wrote: post #62
ronsor wrote: post #54

Earlier quoted context omitted.

It's not simply vulnerable code: it's an actual backdoor. That is malware distribution (without permission) and is therefore illegal.

Is it illegal to distribute malware? I see security researchers doing it all the time for analysis purposes.

No, it is not illegal to distribute malware by itself, but it is illegal to trick people into installing malware. The latter was the goal of the XZ contributor.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#65

Post by stephc_int13 »

greyface- wrote: post #43
jmward01 wrote: post #39

Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.

I understand the impulse to seek justice, but what crime have they committed? It's illegal to gain unauthorized access, but not to write vulnerable code. Is there evidence that this is being exploited in the wild?

Calling this backdoor "vulnerable code" is a gross mischaracterization.

This is closer to a large scale trojan horse, that does not have to be randomly discovered by a hacker to be exploited, but is readily available for privileged remote code execution by whoever have the private key to access this backdoor.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#66

Post by fragmede »

greyface- wrote: post #58
jmward01 wrote: post #52

Earlier quoted context omitted.

I am definitely not a lawyer so I have no claim to knowing what is or is not a crime. However, if backdooring SSH on a potentially wide scale doesn't trip afoul of laws then we need to seriously have a discussion about the modern world. I'd argue that investigating this as a crime is likely in the best interest of public safety and even (I hesitate to say this) national security considering the potential scale of thi…

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

CFAA covers distribution of malicious software without the owners consent, the Wire Fraud Act covers malware distribution schemes intended to defraud for property, Computer Misuse act in the UK is broad and far reaching like the CFAA, so this likely fall afoul of that. The GDPR protects personal data, so there's possibly a case that could be made that this violates that as well, though that might be a bit of reach.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#67

Post by fragmede »

greyface- wrote: post #62
ronsor wrote: post #54

Earlier quoted context omitted.

It's not simply vulnerable code: it's an actual backdoor. That is malware distribution (without permission) and is therefore illegal.

Is it illegal to distribute malware? I see security researchers doing it all the time for analysis purposes.

specifically, thevCFAA covers distribution of malicious software without the owners consent. Security researchs downloading malware implicitly give consent to be downloading malware marked as such.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#68

Post by stephc_int13 »

greyface- wrote: post #58
jmward01 wrote: post #52

Earlier quoted context omitted.

I am definitely not a lawyer so I have no claim to knowing what is or is not a crime. However, if backdooring SSH on a potentially wide scale doesn't trip afoul of laws then we need to seriously have a discussion about the modern world. I'd argue that investigating this as a crime is likely in the best interest of public safety and even (I hesitate to say this) national security considering the potential scale of thi…

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

It is like opening the door of a safe and letting someone else rob the money inside.

This is way beyond "moral level".

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#69

Post by ndriscoll »

greyface- wrote: post #58
jmward01 wrote: post #52

Earlier quoted context omitted.

I am definitely not a lawyer so I have no claim to knowing what is or is not a crime. However, if backdooring SSH on a potentially wide scale doesn't trip afoul of laws then we need to seriously have a discussion about the modern world. I'd argue that investigating this as a crime is likely in the best interest of public safety and even (I hesitate to say this) national security considering the potential scale of thi…

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

If more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#70

Post by baq »

TheBlight wrote: post #40
dralley wrote: post #32

Earlier quoted context omitted.

I don't know that they had a singular target necessarily. Much like Solarwinds, they could take their pick of thousands of targets if this had gone undetected.

I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice. I think the attacker had a target in mind…

> But why would a government want to own tons of random Linux machines that have open sshd mappings?

They don’t want tons. They want the few important ones.

Turns out it was easiest to get to the important ones by pwning tons of random ones.

Post reply on HN