Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

331–340 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#331

Post by refulgentis »

semiquaver wrote: post #320
pbhjpbhj wrote: post #185

Earlier quoted context omitted.

It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se ? The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission. Seems weak, unless you know of some precedent case(s)?

The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library). You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have z…

Hello fellow "law isn't code" traveller. (my least favorite engineer habit!)

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#332

Post by snnn »

ffsm8 wrote: post #171
tux3 wrote: post #119

Earlier quoted context omitted.

I think behavioral analysis could be promising. There's a lot of weird stuff this code does on startup that any reasonable Debian package on the average install should not be doing in a million years. Games and proprietary software will sometimes ship with DRM protection layers that do insane things in the name of obfuscation, making it hard to distinguish from malware. But (with only a couple exceptions) there's no…

> No one wants a Linux antivirus ClamAV has been around for a very long time at this point. It's just not installed on servers, usually

Does not have to be installed. See this: https://learn.microsoft.com/en-us/azure/defender-for-cloud/c...

A cloud provider can take snapshots of running VMs then run antivirus scan offline to minimize the impact to the customers.

Similarly, many applications are containerized and the containers are stateless, we can scan the docker images instead. This approach has been quite mature.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#333

Post by ycombinatrix »

pas wrote: post #261
formerly_proven wrote: post #159

Earlier quoted context omitted.

No

... why?

my understanding is that fuzzing "caught" the issue by crashing with ifunc disabled

but it wouldn't have "caught" the backdoor which uses public key cryptography

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#334

Post by EasyMark »

mardifoufs wrote: post #196
tejohnso wrote: post #192

Earlier quoted context omitted.

> possible even some arm of the U.S. govt. Possible. But why mention U.S. specifically? Is it more likely than Russia, Iran, China, France ... ?

The US is behind more documented backdoors than those other countries.

Highly likely, China has been estimated to have cyberhacking resources that are 10-50x what the USA has currently. It's not even close. The USA will have to up it's game soon or accept China being able to shut down large swathes of the grid and critical infrastructure at will

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#336

Post by rcxdude »

everybackdoor wrote: post #292
raggi wrote: post #150

Earlier quoted context omitted.

Think whatever you shall about systemd of course, but please stop with the blind belief mud slinging: - systemd didn't create the patch to include libsystemd, distros did - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though - you can implement notify in standalone code in about the same effort as it takes to use the dependency, there wasn…

[flagged]

This is full conspiracy mode thinking.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#337

Post by kbolino »

sweetjuly wrote: post #300
kbolino wrote: post #240

Earlier quoted context omitted.

SELinux context is passed down to child processes. If sshd is running as confined root (system_u:system_r:sshd_t or similar), then the bash spawned by RCE will be too. Even if sshd is allowed to masquerade as an unconfined non-root user, that user will (regardless of SELinux) be unable to read or write /dev/kmem, ignore standard file permissions, etc.

That's my point though--users expect to be able to do those things over ssh. Sandboxing sshd is hard because its child processes are expected to be able to do anything that an admin sitting at the console could do, up to and including reading/writing kernel memory.

I'm assuming SSH root login is disabled and sudo requires separate authentication to elevate, but yeah, if there's a way to elevate yourself to unconfined root trivially after logging in, this doesn't buy you anything.

Now, sandboxing sudo (in the general case) with SELinux probably isn't possible.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#338

Post by snnn »

EasyMark wrote: post #279
ffsm8 wrote: post #171

Earlier quoted context omitted.

> No one wants a Linux antivirus ClamAV has been around for a very long time at this point. It's just not installed on servers, usually

don't most people who use that just use it for scanning incoming email attachments usually?

ClamAV also has a lot of findings when scanning some open source project's source code. For example, LLVM project's test data. Because some of the test data are meant to check if a known security bug is fixed, from a antivirus software perspective these data files can be seen as exploits. ClamAV is commonly used. Or, I would suggest adding it to every CI build pipeline. Most time it wouldn't have any finding, but it is better than nothing. I would like to offer free help if an open source project has the need to harden their build pipelines and their release process.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#339

Post by grepfru_it »

pas wrote: post #219
martinohansen wrote: post #207

Imagine a future where state actors have hundreds of AI agents fixing bugs, gaining reputation while they slowly introduce backdoors. I really hope open source models succeed.

... if we want security it needs trust anyway. it doesn't matter if it's amazing Code GPT or Chad NSA, the PR needs to be reviewed by someone we trust. it's the trust that's the problem. web of trust purists were right just ahead of the time.

this is why microsoft bought github and has been onboarding major open source projects. they will be the trusted 3rd party (whether we like it our not is a different story)
Post reply on HN