XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Post by rl3 » Sat, Mar 30, 2024, 10:38 PM UTC

ceejayoz wrote: post #103

sneak wrote: post #92

Earlier quoted context omitted.

Nah, the CIA assassinates people in MLAT zones all the time. The laws that apply to you and I don’t apply to the privileged operators of the state’s prerogatives. We don’t even know that this specific backdoor wasn’t the NSA or CIA. Assuming it was a foreign intelligence service because the fake name was asian-sounding is a bit silly. The people who wrote this code might be sitting in Virginia or Maryland already.

> The people who wrote this code might be sitting in Virginia or Maryland already. Sure, that’s possible. They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.

Post by pja » Sat, Mar 30, 2024, 10:40 PM UTC

formerly_proven wrote: post #142

Denvercoder9 wrote: post #56

Earlier quoted context omitted.

That one's a separate attack vector, which is seemingly unused in the sshd attack. It only disables sandboxing of the xzdec(2) utility, which is not used in the sshd attack.

Which strongly suggests that they planned and/or executed more backdoors via Jia Tan’s access.

Post by pbhjpbhj » Sat, Mar 30, 2024, 10:41 PM UTC

semiquaver wrote: post #108

greyface- wrote: post #58

Earlier quoted context omitted.

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

CFAA covers this. Its a crime to > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; Where one of the definitions of “protected computer” is one that is used in interstate commerce, which covers effectively all of them.

Post by tux3 » Sat, Mar 30, 2024, 10:42 PM UTC

raggi wrote: post #141

tux3 wrote: post #119

Earlier quoted context omitted.

I think behavioral analysis could be promising. There's a lot of weird stuff this code does on startup that any reasonable Debian package on the average install should not be doing in a million years. Games and proprietary software will sometimes ship with DRM protection layers that do insane things in the name of obfuscation, making it hard to distinguish from malware. But (with only a couple exceptions) there's no…

Except had we been doing that they would have put guards in place to detect it - as they already had guards to avoid the code path when a debugger is attached, to avoid building the payload in when it's not one of the target systems, and so on. Their evasion was fairly extensive, so we'd need many novel dynamic systems to stand a chance, and we'd have to guard those systems extremely tightly - the author got patches…

Post by ghostpepper » Sat, Mar 30, 2024, 10:43 PM UTC

skywhopper wrote: post #128

chatmasta wrote: post #107

Can someone explain succinctly what the backdoor does ? Do we even know yet? The backdoor itself is not a payload, right? Does it need a malicious archive to exploit it? Or does it hook into the sshd process to listen for malicious packets from a remote attacker? The OP makes it sound like an attacker can send a malicious payload in the pre-auth phase of an SSH session - but why does he say that an exploit might neve…

From what I’ve read I think the attack vector is: 1. sshd starts and loads the libsystemd library which loads the XZ library which contains the hack 2. The XZ library injects its own versions of functions in openssl that verify RSA signatures 3. When someone logs into SSH and presents a signed SSH certificate as authentication, those hacked functions are called 4. The certificate, in turn, can contain arbitrary data…