Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

311–320 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#311

Post by creato »

One of the takeaways from this to me is that there is way too much sketchy bullshit happening in critical system software. Prebuilt binary blobs [1]? Rewriting calls to SIMD enhanced versions at runtime [2]? Disabling sanitizers [3]? Incomprehensible build scripts [4]?

All of this was either at least strongly frowned upon, if not outright unacceptable, on every project I've ever worked on, either professionally or for fun. And the stakes were far lower for those projects than critical linux system software.

1. https://lwn.net/Articles/967442/

2, 3: https://github.com/google/oss-fuzz/pull/10667

4. https://news.ycombinator.com/item?id=39866161

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#312

Post by amscanne »

londons_explore wrote: post #250
quatrefoil wrote: post #135

Earlier quoted context omitted.

If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks). That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.

I suspect I could have used this exact attack against 10,000 random SSH servers spread all over the world, and not be detected. Most people don't log TCP connections, and those that do don't go through their logs looking for odd certificates in ssh connections. And no common logging at the ssh/pam level would have picked this up. Your only chance is some sysadmin who has put 'tripwires' on certain syscalls like syste…

There is no ‘system()’ syscall, and fork/exec would be extremely common for opensshd — it’s what it does to spawn new shells which go on to do anything.

I’m not arguing with the point, but this is a great place to hide — very difficult to have meaningful detection rules even for a sophisticated sysadmin.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#313

Post by colinsane »

sitkack wrote: post #220
colinsane wrote: post #122

Earlier quoted context omitted.

sure. what makes you think they aren't?

Why would the FBI investigate the NSA? We have zero idea who the actors involved are.

my comment allows for the NSA to be involved in this and for the FBI to not be investigating them.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#314

Post by ecshafer »

bee_rider wrote: post #295
pas wrote: post #219

Earlier quoted context omitted.

... if we want security it needs trust anyway. it doesn't matter if it's amazing Code GPT or Chad NSA, the PR needs to be reviewed by someone we trust. it's the trust that's the problem. web of trust purists were right just ahead of the time.

It would actually be sort of interesting if multiple adversarial intelligence agencies could review and sign commits. We might not trust any particular intelligence agency, but I bet the NSA and China would both be interested in not letting much through, if they knew the other guy was looking.

That is an interesting solution. If China, US, Russia, EU, etc all sign off and say "yep this is secure" we should trust it. Since if they think they found an exploit, they might assume the other people found an exploit. This is a little bit like the idea of a fair cut for a cake. If you have two people that want the last slice of cake, you have one cut and the other choose the first slice, since the chooser will choose the biggest slice, so the slicer knowing they will get the smaller will make it as equal as possible. In this case the NSA makes the cut (the code), and Russia / China chooses if its allowed in.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#315

Post by bee_rider »

jmward01 wrote: post #52
greyface- wrote: post #43

Earlier quoted context omitted.

I understand the impulse to seek justice, but what crime have they committed? It's illegal to gain unauthorized access, but not to write vulnerable code. Is there evidence that this is being exploited in the wild?

I am definitely not a lawyer so I have no claim to knowing what is or is not a crime. However, if backdooring SSH on a potentially wide scale doesn't trip afoul of laws then we need to seriously have a discussion about the modern world. I'd argue that investigating this as a crime is likely in the best interest of public safety and even (I hesitate to say this) national security considering the potential scale of thi…

Laws don’t fix technical issues any more than they fix physical ones. Clearly this was possible, so it could be done by a foreign intelligence agency or well-hidden criminal organization.

I think this is probably illegal. But, I think we should not punish this sort of thing too harshly. Tech is an ecosystem. Organizations need to evolve to protect themselves. Instead, we should make companies liable for the damage that happens when they are hit by one of these attacks.

Before anyone calls it out: yes, this will be blaming the victim. But, companies aren’t people, and so we don’t really need to worry about the psychological damage that victim blaming would do, in their case. They are systems, that respond to incentives, and we should provide the incentives to make them tough.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#316

Post by BuildTheRobots »

Tuna-Fish wrote: post #72
noncoml wrote: post #14

Unpopular opinion, but I cannot but admire the whole operation. Condemn it of course, but still admire it. It was a piece of art! From conception to execution, masterful! We got extremely lucky that it was caught so early.

If the payload didn't have a random .5 second hang during SSH login, it would probably not have been found for a long time. The next time, the attackers probably manage to build a payload that doesn't cause weird latency spikes on operations that people wait on. (For some reason this brings to mind how Kim Dotcom figured out he was the target of an illegal wiretap... because he suddenly had a much higher ping in MW3.…

I'm a little out of touch, but for over a decade I'd say half the boxes I touched either didn't have enough entropy or were trying to do rDNS for (internal) ranges to servers that didn't host it and is nearly always hand waved away by the team running it as NFN.

That is to say, a half-second pause during the ssh login is absolutely the _least_ suspicious place place for it to happen and I'm somewhat amazed anyone thought to go picking at it as quickly as they did.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#317

Post by fuzunoglu »

Aloisius wrote: post #35
fuzunoglu wrote: post #25

Earlier quoted context omitted.

What is the possibility of identity theft that is commenced on state-level? There are reports that the time the backdoor was pushed do not match the usual timing of changes committed by the author. It also seems like a convenient ground for a false flag operation: hijacking an account that belong to a trustworthy developer from another country.

And risk discovery by the trustworthy developer? Unlikely.

What if the developer passed away? It is also easy to blame the developer with mental issues otherwise.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#319

Post by cryptonector »

plg94 wrote: post #129
chatmasta wrote: post #107

Can someone explain succinctly what the backdoor does ? Do we even know yet? The backdoor itself is not a payload, right? Does it need a malicious archive to exploit it? Or does it hook into the sshd process to listen for malicious packets from a remote attacker? The OP makes it sound like an attacker can send a malicious payload in the pre-auth phase of an SSH session - but why does he say that an exploit might neve…

I don't think we know what exactly this does, yet. I can only answer one of those questions, as far as I understand the "unreplayable" part is refering to this: > Apparently the backdoor reverts back to regular operation if the payload is malformed or *the signature from the attacker's key doesn't verify*. emphasis mine, note the "signature of the attacker's key". So unless that key is leaked, or someone breaks the R…

It's not using RSA. It's hooking RSA. And the attacker's signature is Ed448, not RSA.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#320

Post by semiquaver »

pbhjpbhj wrote: post #185
semiquaver wrote: post #108

Earlier quoted context omitted.

CFAA covers this. Its a crime to > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; Where one of the definitions of “protected computer” is one that is used in interstate commerce, which covers effectively all of them.

It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se ? The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission. Seems weak, unless you know of some precedent case(s)?

The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library).

You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have zero trouble convicting on these facts.

Post reply on HN