Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

71–80 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#71

Post by asveikau »

cesarb wrote: post #61
asveikau wrote: post #27

I have found it irritating how in the community, in recent years, it's popular to say that if a project doesn't have recent commits or releases that something is seriously wrong. This is a toxic attitude. There was nothing wrong with "unmaintained" lzma two years ago. The math of the lzma algorithm doesn't change. The library was "done" and that's ok. The whiny mailing list post from the sock puppet, complaining abou…

> The math of the lzma algorithm doesn't change. The library was "done" and that's ok. Playing devil's advocate: the math doesn't change, but the environment around it does. Just off the top of my head, we have: the 32-bit to 64-bit transition, the removal of pre-C89 support ( https://fedoraproject.org/wiki/Changes/PortingToModernC ) which requires an autotools update, the periodic tightening of undefined behaviors,…

> the 32-bit to 64-bit transition

Lzma is from 2010. Amd64 became mainstream in the mid 2000s.

> removal of pre-C89 support

Ibid. Also, at the library API level, c89 compatible code is still pretty familiar to c99 and later.

> new architectures like RISC-V

Shouldn't matter for portable C code?

> the increasing amount of cores and a slowdown in the increase of per-core speed,

Iirc parallelism was already a focus of this library in the 2010s, I don't think it really needs a lot of work in that area.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#72

Post by Tuna-Fish »

noncoml wrote: post #14

Unpopular opinion, but I cannot but admire the whole operation. Condemn it of course, but still admire it. It was a piece of art! From conception to execution, masterful! We got extremely lucky that it was caught so early.

If the payload didn't have a random .5 second hang during SSH login, it would probably not have been found for a long time.

The next time, the attackers probably manage to build a payload that doesn't cause weird latency spikes on operations that people wait on.

(For some reason this brings to mind how Kim Dotcom figured out he was the target of an illegal wiretap... because he suddenly had a much higher ping in MW3. When he troubleshooted, he found out that all his packets specifically got routed a very long physical distance through a GCSB office. GCSB has no mandate to wiretap permanent NZ residents. He ended up getting a personal apology from the NZ Prime Minister.)

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#73

Post by bulatb »

asveikau wrote: post #27

I have found it irritating how in the community, in recent years, it's popular to say that if a project doesn't have recent commits or releases that something is seriously wrong. This is a toxic attitude. There was nothing wrong with "unmaintained" lzma two years ago. The math of the lzma algorithm doesn't change. The library was "done" and that's ok. The whiny mailing list post from the sock puppet, complaining abou…

A software project has the features it implements, the capabilities it offers users, and the boundary between itself and the environment in which those features create value for the user by becoming capabilities.

The "accounting" features in the source code may be finished and bug-free, but if the outside world has changed and now the user can't install the software, or it won't run on their system, or it's not compatible with other current software, then the software system doesn't grant the capability "accounting," even though the features are "finished."

Nothing with a boundary is ever finished. Boundaries just keep the outside world from coming in too fast to handle. If you don't maintain them then eventually the system will be overwhelmed and fail, a little at a time, or all at once.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#74

Post by [deleted] »

greyface- wrote: post #58
jmward01 wrote: post #52

Earlier quoted context omitted.

I am definitely not a lawyer so I have no claim to knowing what is or is not a crime. However, if backdooring SSH on a potentially wide scale doesn't trip afoul of laws then we need to seriously have a discussion about the modern world. I'd argue that investigating this as a crime is likely in the best interest of public safety and even (I hesitate to say this) national security considering the potential scale of thi…

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

[deleted]

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#75

Post by CodesInChaos »

Thorrez wrote: post #53
CodesInChaos wrote: post #26

Earlier quoted context omitted.

It might be possible to use timing information to detect this, since the signature verification code appears to only run if the client public key matches a specific fingerprint. The backdoor's signature verification should cost around 100us, so keys matching the fingerprint should take that much longer to process than keys that do not match it. Detecting this timing difference should at least be realistic over LAN, p…

According to[1], the backdoor introduces a much larger slowdown, without backdoor: 0m0.299s, with backdoor: 0m0.807s. I'm not sure exactly why the slowdown is so large. [1] https://www.openwall.com/lists/oss-security/2024/03/29/4

The effect of the slowdown on the total handshake time wouldn't work well for detection, since without a baseline you can't tell if it's slow due to the backdoor, or due to high network latency or a slow/busy CPU. The relative timing of different steps in the TCP and SSH handshakes on the other hand should work, since the backdoor should only affect one/some steps (RSA verification), while others remain unaffected (e.g. the TCP handshake).

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#76

Post by TheBlight »

baq wrote: post #70
TheBlight wrote: post #40

Earlier quoted context omitted.

I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice. I think the attacker had a target in mind…

> But why would a government want to own tons of random Linux machines that have open sshd mappings? They don’t want tons. They want the few important ones. Turns out it was easiest to get to the important ones by pwning tons of random ones.

That still implies there was a target in mind. But also they would've had to assume the access would be relatively short-lived. This means to me they had something specific they wanted to get access to, didn't plan to be there long, and weren't terribly concerned about leaving a trail of their methods.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#77

Post by Seattle3503 »

greyface- wrote: post #43
jmward01 wrote: post #39

Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.

I understand the impulse to seek justice, but what crime have they committed? It's illegal to gain unauthorized access, but not to write vulnerable code. Is there evidence that this is being exploited in the wild?

I'd be surprised if the attacker didn't meet the criteria for mens rea.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#78

Post by asveikau »

bulatb wrote: post #73
asveikau wrote: post #27

I have found it irritating how in the community, in recent years, it's popular to say that if a project doesn't have recent commits or releases that something is seriously wrong. This is a toxic attitude. There was nothing wrong with "unmaintained" lzma two years ago. The math of the lzma algorithm doesn't change. The library was "done" and that's ok. The whiny mailing list post from the sock puppet, complaining abou…

A software project has the features it implements, the capabilities it offers users, and the boundary between itself and the environment in which those features create value for the user by becoming capabilities. The "accounting" features in the source code may be finished and bug-free, but if the outside world has changed and now the user can't install the software, or it won't run on their system, or it's not compa…

I feel like this narrative is especially untrue for things like lzma where the only dependencies are memory and CPU, and written in a stable language like C. I've had similar experiences porting code for things like image formats, audio codecs, etc. where the interface is basically "decode this buffer into another buffer using math". In most cases you can plop that kind of library right in without any maintenance at all, it might be decades old, and it works. The type of maintenance I would expect for that would be around security holes. Once I patched an old library like that to handle the fact that the register keyword was deprecated.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#80

Post by sneak »

ndriscoll wrote: post #69
greyface- wrote: post #58

Earlier quoted context omitted.

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

If more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).

The criminal conspiracy laws don’t apply to the organizations that write this kind of code, just like murder laws don’t.
Post reply on HN