Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

251–260 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#251

Post by timschmidt »

BlueFalconHD wrote: post #225
avidiax wrote: post #167

Earlier quoted context omitted.

The NSA demands that Intel and AMD provide backdoor ways to turn off the IME/PSP, which are basically a small OS running in a small processor inside your processor. So the precedent is that the government wants less embedded software in their hardware, at least for themselves. If we relied on gadget vendors to maintain such software, I think we can just look at any IoT or router manufacturer to get an idea of just ho…

What does the IME or PSP do?

Short answer: anything it wants.

IME has privileged access to the MMU(s), all system memory, and even out-of-band access to the network adapter such the the OS cannot inspect network traffic originating with or destined for the IME.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#252

Post by dools »

Ekaros wrote: post #229
superb_dev wrote: post #223

Earlier quoted context omitted.

This feels very targeted

Or very untargeted. Something intended just to lay dormant by chance if succeeded... It is very good backdoor to have if you at whatever time have dozens of options. See sshd running, test this you are done if it works, if not move to something else.

Or targeted not really at doing anything but at researching the nature of supply chain vulnerabilities themselves.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#253

Post by cqqxo4zV46cp »

x0x0 wrote: post #143
wepple wrote: post #99

Earlier quoted context omitted.

I expect a lot of people will be doing a whole lot of thinking along these lines over the next months. Code review? Some kind of behavioral analysis? IMO the call to system() was kind of sloppy, and a binary capabilities scanner could have potentially identified a path to that.

[flagged]

No. You are still bitter about systemd and are trying to assert blame which does not reasonably exist.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#255

Post by tootie »

junon wrote: post #3

EDIT: Here's some more RE work on the matter. Has some symbol remapping information that was extracted from the prefix trie the backdoor used to hide strings. Looks like it tried to hide itself even from RE/analysis, too. https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9... Full list of decoded strings here: https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01 -- For someone unfamiliar with openssl…

Mind boggling. How do you even decide what to do with privileges on a billion computers?

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#256

Post by joeyh »

ghostpepper wrote: post #184
joeyh wrote: post #104

Earlier quoted context omitted.

Since a liblzma backdoor could be used to modify compiler packages that are installed on some distributions, it gets right back to a trusting trust attack. Although initial detection via eg strace would be possible, if the backdoor was later removed or went quiescentit would be full trusting trust territory.

How would this be possible? This backdoor works because lzma is loaded into sshd (by a roundabout method involving systemd). I don't think gcc or clang links lzma.

dpkg-deb is linked with liblzma

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#257

Post by treasy »

transpute wrote: post #237
treasy wrote: post #194

Earlier quoted context omitted.

You can definitely prevent a lot of file/executable accesses via SELinux by running sshd in the default sshd_t or even customizing your own sshd domain and preventing sshd from being able to run binaries in its own domain without a transition. What you cannot prevent though is certain things that sshd _requires_ to function like certain capabilities and networking access. by default sshd has access to all files in /h…

https://news.ycombinator.com/item?id=39879559 > Libselinux pulls in liblzma too

libselinux is the userspace tooling for selinux, it is irrelevant to this specific discussion as the backdoor does not target selinux in any way, and sshd does not have the capabilities required to make use of the libselinux tooling anyway

libselinux is just an unwitting vector to link liblzma with openssh

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#258

Post by robocat »

tux3 wrote: post #119
wepple wrote: post #99

Earlier quoted context omitted.

I expect a lot of people will be doing a whole lot of thinking along these lines over the next months. Code review? Some kind of behavioral analysis? IMO the call to system() was kind of sloppy, and a binary capabilities scanner could have potentially identified a path to that.

I think behavioral analysis could be promising. There's a lot of weird stuff this code does on startup that any reasonable Debian package on the average install should not be doing in a million years. Games and proprietary software will sometimes ship with DRM protection layers that do insane things in the name of obfuscation, making it hard to distinguish from malware. But (with only a couple exceptions) there's no…

> we may not have the same luck next time

If the prior is 1 was out there (this one), the chances that there is 1+ still undetected seems fairly high to me.

To behaviourally detect this requires many independent actors to be looking in independent ways(e.g. security researchers, internal teams). Edit: I mean with private code & tests (not open source, nor purchasable antivirus). It's not easy to donate to Google Zero. Some of the best funded and most skilled teams seem to be antivirus vendors (and high value person protection). I hate the antivirus industry yet I've been helped by it (the anti-tragedy of the commons).

Commonly public detection code (e.g. open source) is likely to be defeated by attackers with a lot of resources.

Hard to protect ourselves against countries where the individuals are safe from prosecution. Even nefarious means like assasination likely only work against individuals and not teams.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#259

Post by timschmidt »

javajosh wrote: post #178
fragmede wrote: post #66

Earlier quoted context omitted.

CFAA covers distribution of malicious software without the owners consent, the Wire Fraud Act covers malware distribution schemes intended to defraud for property, Computer Misuse act in the UK is broad and far reaching like the CFAA, so this likely fall afoul of that. The GDPR protects personal data, so there's possibly a case that could be made that this violates that as well, though that might be a bit of reach.

In which case the defense will claim, correctly, that this malware was never distributed. It was caught. "Attempted malware distribution" may not actually be a crime (but IANAL so I don't know).

Folks who run Debian SID or Fedora testing may disagree.
Post reply on HN