Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

351–360 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#351

Post by littlestymaar »

cryptonector wrote: post #299
treasy wrote: post #216

Earlier quoted context omitted.

If you look at the diagram of privsep, the authentication process is part of the privileged binary, which is where this RCE lives http://www.citi.umich.edu/u/provos/ssh/priv.jpg

The signature validation could be moved into an unprivileged process forked from that one.

That's an easy thing to say after the fact indeed but yes. In fact after such a disastrous backdoor I wouldn't be surprised if OpenSSH moved all code calling external libraries to unprivileged processes to make sure such an attack can never have such a dramatic effect (an auth bypass would still likely be possible, but that's still way better than a root RCE…).

At this point “All libraries could be malicious” is a threat model that must be considered for something as security critical as OpenSSH.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#353

Post by tevon »

Currently if you visit the xz repository it is disabled for violating github's TOS.

While it should clearly be disabled, I feel like github should leave the code and history up, while displaying a banner (and disabled any features that could be exploited), so that researchers and others can learn about the exploit.

In more minor situations when a library is hosting malicious code, if I found the repo to be down I might not think anything of it.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#354

Post by xuhu »

It just seems implausible that the malicious x86 code would not have shown up in strace, perf record, or some backtrace. Once this ended up in all the major distros, some syscall or glibc call would have eventually looked like a red flag to someone before long.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#355

Post by tialaramex »

swid wrote: post #123
chatmasta wrote: post #107

Can someone explain succinctly what the backdoor does ? Do we even know yet? The backdoor itself is not a payload, right? Does it need a malicious archive to exploit it? Or does it hook into the sshd process to listen for malicious packets from a remote attacker? The OP makes it sound like an attacker can send a malicious payload in the pre-auth phase of an SSH session - but why does he say that an exploit might neve…

You can imagine a door that opens if you knock on it just right. For anyone without the secret knock, it appears and functions as a wall. Without the secret knock, there might not even be a way to prove it opens at all. This is sort of the situation here. xz tries to decode some data before it does anything shady; since it is asymmetric; it can do the decryption without providing the secret encryption key (it has the…

Private key. In cryptography we distinguish keys which are symmetric (needed by both parties and unavailable to everyone else) as "Secret" keys, with the pair of keys used in public key cryptography identified as the Private key (typically known only to one person/ system/ whatever) and Public key (known to anybody who cares)

Thus, in most of today's systems today your password is a secret. You know your password and so does the system authenticating you. In contrast the crucial key for a web site's HTTPS is private. Visitors don't know this key, the people issuing the certificate don't know it, only the site itself has the key.

I remember this by the lyrics to "The Fly" by the band U2, "They say a secret is something you tell one other person. So I'm telling you, child".

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#356

Post by grepfru_it »

tootie wrote: post #139
jmward01 wrote: post #39

Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.

CISA had a report on this pretty quickly. I think they refer cases to Secret Service for enforcement. But really, we seemingly have no idea who or where the perpetrator is located. This could easily be a state actor. It could be a lone wolf. And the effects of the attack would be global too, so jurisdiction is tricky. We really have no idea at this point. The personas used to push the commits and push for inclusion w…

github retains an incredible amount of data to review. but if it is a state actor, they likely covered their tracks very well. when i found the original address of the person who hacked elon musk's twitter account it led to an amazon ec2 instance. that instance was bought with stolen financial information and accessed via several vpns and proxies. i would expect state actors to further obfuscate their tracks with shell companies and the like

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#357

Post by jhfdbkofdchk »

tevon wrote: post #353

Currently if you visit the xz repository it is disabled for violating github's TOS. While it should clearly be disabled, I feel like github should leave the code and history up, while displaying a banner (and disabled any features that could be exploited), so that researchers and others can learn about the exploit. In more minor situations when a library is hosting malicious code, if I found the repo to be down I mig…

I imagine they don’t want automation downloading it.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#359

Post by snnn »

asveikau wrote: post #121
snnn wrote: post #115

Earlier quoted context omitted.

Actually, the new architectures are a big source of concerns. As a maintainer of a large open source project, I often received pull requests for CPU architectures that I never had a chance to touch. Therefore I cannot build the code, cannot run the tests, and do not understand most of the code. C/C++ themselves are portable, but libs like xz needs to beat the other competitors on performance, which means you may need…

I am a former MS employee, I used to read the compatibility patches when I was bored at the office. Anyway, liblzma does not "need" to outperform any "competition". If someone wants to work on some performance optimization, it's completely fair to fork. Look at how many performance oriented forks there are of libjpeg. The vanilla libjpeg still works.

The vanilla python works fine but conda is definitely more popular among data scientists.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#360

Post by yodsanklai »

matrix_overload wrote: post #306
undersuit wrote: post #238

Earlier quoted context omitted.

Because in the closed source model the frustrated developer that looked into this SSH slowness submits a ticket for the owner of the malicious code to dismiss.

Not necessarily. A frustrated developer posts about it, it catches attention of someone who knows how to use Ghidra et al, and it gets dug out quite fast. Except, with closed-source software maintained by a for-profit company, suck cockup would mean a huge reputational hit, with billions of dollars of lost market cap. So, there are very high incentives for companies to vet their devs, have proper code reviews, etc. B…

> So, there are very high incentives for companies to vet their devs, have proper code reviews, etc.

I'm not sure about that. It takes a few leetcode interviews to get in major tech companies. As for the review process, it's not always thorough (if it looks legit and the tests pass...). However, employees are identifiable and would take huge risk to be caught doing anything fishy.

Post reply on HN