If the RCE is Russian, it could be used a communication kill-switch on the morning of an attack outside Ukraine, similar to the Viasat hack https://en.m.wikipedia.org/wiki/Viasat_hack
XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
371–380 of 862 posts
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#372Unpopular opinion, but I cannot but admire the whole operation. Condemn it of course, but still admire it. It was a piece of art! From conception to execution, masterful! We got extremely lucky that it was caught so early.
> "After all, He-Who-Must-Not-Be-Merged did great things - terrible, yes, but great." I think the most ingenious part was picking the right project to infiltrate. Reading "Hans'" IFUNC pull request discussion is heart-wrenching in hindsight, but it really shows why this project was chosen. I would love to know how many people where behind "Jia" and "Hans" analyzing and strategizing communication and code contribution…
Carelessness could arguably a part of operation: testing/probing how thoroughly the community scrutinizes communication from untrusted individuals.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#373Earlier quoted context omitted.
You can imagine a door that opens if you knock on it just right. For anyone without the secret knock, it appears and functions as a wall. Without the secret knock, there might not even be a way to prove it opens at all. This is sort of the situation here. xz tries to decode some data before it does anything shady; since it is asymmetric; it can do the decryption without providing the secret encryption key (it has the…
Private key. In cryptography we distinguish keys which are symmetric (needed by both parties and unavailable to everyone else) as "Secret" keys, with the pair of keys used in public key cryptography identified as the Private key (typically known only to one person/ system/ whatever) and Public key (known to anybody who cares) Thus, in most of today's systems today your password is a secret . You know your password an…
> You know your password and so does the system authenticating you.
Nitpick, but no it shouldn’t.
The HASH of your password is recorded. You never submit your password, you submit that hash and they compare it.
The difference is that there is no two passwords that collide; but there are hashes that may.
And that two equal passwords from two equal users are not necessarily accessible to someone with the hash list because they are modified at rest with salts.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#374Imagine a future where state actors have hundreds of AI agents fixing bugs, gaining reputation while they slowly introduce backdoors. I really hope open source models succeed.
I work for a large closed-source software company and I can tell you with 100% that it is full of domestic and foreign agents. Being open source means that more eyes can and will look at something. That only increases the chance of malicious actions being found out ... just like this supply-chain attack.
[deleted]
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#375Earlier quoted context omitted.
Using an SSH key used with GitHub for other purposes than GitHub is not a good practice (even if it's common). https://github.com/dolmen/github-keygen
I’m confused. I make a unique private key for each machine I use. How is using that machine-specific key on multiple hosts insecure?
Your SSH public keys used on GitHub are very publicly exposed.
This information could be used by SSH servers you are connecting to. You might think you are connecting anonymously, while in fact your SSH client is sending your public key which could then be resolved to your GitHub account.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#376Earlier quoted context omitted.
What is constantly overlooked here on HN is that in legal terms, one of the most important things is intent . Commenters on HN always approach legal issues from a technical perspective but that is simply not how the judicial system works. Whether something is “technically X” or not is irrelevant, laws are usually written with the purpose of catching people based on their intent (malicious hacking), not merely on the…
Yeah, it bothers me so much. They really seem to think that "law is code".
It is code, but it runs on human wetware which can decode input about actual events into output about intent, and reach consensus about this output via proper court procedures.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#377One of the takeaways from this to me is that there is way too much sketchy bullshit happening in critical system software. Prebuilt binary blobs [1]? Rewriting calls to SIMD enhanced versions at runtime [2]? Disabling sanitizers [3]? Incomprehensible build scripts [4]? All of this was either at least strongly frowned upon, if not outright unacceptable, on every project I've ever worked on, either professionally or fo…
> Prebuilt binary blobs [1]?
My understanding is that the binary blobs were test data. Find a bug that happens on certain input. Craft a payload that both triggers the bug and does the malicious thing you want to do. Add the binary blob to /tests/files/. Then write a legitimate test to ensure that the bug goes away.
Then do some build script bullshit to somehow get that binary into the build.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#378Earlier quoted context omitted.
There is one possible time pressure involved, which is that libsystemd dropped the liblzma dependency
Absolutely no intelligence agency would look at a successful compromise where they have a highly positioned agent in an organization like this, and burn them trying to rush an under-developed exploit in that would then become not useful almost immediately (because the liblzma dependency would be dropped next distro upgrade cycle). If you had a human-asset with decision making authority and trust in place, then as fun…
Might a time-sensitive high-priority goal override such reasoning? For example, the US presidential election is coming up. Making it into Ubuntu LTS could be worth the risk if valuable government targets are running that.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#379Earlier quoted context omitted.
A software project has the features it implements, the capabilities it offers users, and the boundary between itself and the environment in which those features create value for the user by becoming capabilities. The "accounting" features in the source code may be finished and bug-free, but if the outside world has changed and now the user can't install the software, or it won't run on their system, or it's not compa…
I feel like this narrative is especially untrue for things like lzma where the only dependencies are memory and CPU, and written in a stable language like C. I've had similar experiences porting code for things like image formats, audio codecs, etc. where the interface is basically "decode this buffer into another buffer using math". In most cases you can plop that kind of library right in without any maintenance at…
Smaller boundaries are likelier to need less maintenance, but nothing stands still. The reason you can run an ancient simple binary on newer systems is that someone has deliberately made that possible. People worked to make sure the environment around its boundary would stay the same instead of drifting randomly away with time—usually so doggedly (and thanklessly) that we can argue whether that stability was really a result of maintenance or just a fact of nature.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#380One have question on this is, if the backdoor would not been discovered due to performance issue (which was as I understood it purely an oversight/fixable deficiency in the code), what are the chances of discovering this backdoor later, or are there tools that would have picked it up? Those questions are IMO relevant to understand if this kind of backdoor is the first one of the kind, or the first one that was uncove…
I expect a lot of people will be doing a whole lot of thinking along these lines over the next months. Code review? Some kind of behavioral analysis? IMO the call to system() was kind of sloppy, and a binary capabilities scanner could have potentially identified a path to that.
Dynamic linking was a mistake and should be eliminated