Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

411–420 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#411

Post by darby_eight »

consumer451 wrote: post #398
p-e-w wrote: post #392

Earlier quoted context omitted.

> but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be screwed That's true of course, but it's not a problem specific to software. In fact, I'm not even sure it's a "problem" in a meaningful sense at all. When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. Th…

> But at the end of the day, the vast majority of people just don't seek to actively harm others. Everything humans do relies on that assumption, and always has. https://en.wikipedia.org/wiki/Normalcy_bias ? > It's symptomatic of the insane Silicon Valley vision that the world can and should be managed and controlled at every level of detail. Which is a "cure" that would be much worse than any disease it could possib…

[dead]

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#412

Post by pmarreck »

consumer451 wrote: post #398
p-e-w wrote: post #392

Earlier quoted context omitted.

> but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be screwed That's true of course, but it's not a problem specific to software. In fact, I'm not even sure it's a "problem" in a meaningful sense at all. When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. Th…

> But at the end of the day, the vast majority of people just don't seek to actively harm others. Everything humans do relies on that assumption, and always has. https://en.wikipedia.org/wiki/Normalcy_bias ? > It's symptomatic of the insane Silicon Valley vision that the world can and should be managed and controlled at every level of detail. Which is a "cure" that would be much worse than any disease it could possib…

You need to accept that everything has a tradeoff and some amount of drama just seems to be built into the system.

Take sex work, for example. Legalizing it leads to an overall increase in sex trafficking. But it also does this: https://www.washingtonpost.com/news/wonk/wp/2014/07/17/when-...

My personal opinion is that if something is going to find a way to conduct itself in secret anyway (at high risk and cost) if it is banned, it is always better to just suck it up and permit it and regulate it in the open instead. Trafficked people are far easier to discover in an open market than a black one. Effects of anything (both positive and negative) are far easier to assess when the thing being assessed is legal.

Should we ban cash because it incentivizes mugging and pickpocketing and theft? (I've been the victim of pickpocketing. The most valuable thing they took was an irreplaceable military ID I carried (I was long since inactive)... Not the $25 in cash in my wallet at the time.) I mean, there would literally be far fewer muggings if no one carried cash. Is it thus the cash's "fault"?

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#413

Post by asveikau »

bulatb wrote: post #379
asveikau wrote: post #78

Earlier quoted context omitted.

I feel like this narrative is especially untrue for things like lzma where the only dependencies are memory and CPU, and written in a stable language like C. I've had similar experiences porting code for things like image formats, audio codecs, etc. where the interface is basically "decode this buffer into another buffer using math". In most cases you can plop that kind of library right in without any maintenance at…

Smaller boundaries are likelier to need less maintenance, but nothing stands still. The reason you can run an ancient simple binary on newer systems is that someone has deliberately made that possible. People worked to make sure the environment around its boundary would stay the same instead of drifting randomly away with time—usually so doggedly (and thanklessly) that we can argue whether that stability was really a…

> The reason you can run an ancient simple binary on newer systems is that someone has deliberately made that possible.

I'm not talking about binaries. I'm talking about C sources. I've done the kind of work you're talking about. You're overestimating it.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#415

Post by dragonwriter »

mik1998 wrote: post #113
hnarn wrote: post #106

Earlier quoted context omitted.

based on what?

I did my own research. If you look at the git repository commit log and some mailing list messages, you will see that the author ("Jia Tan", fake name) speaks impeccable English (already lessens the chance of being a Chinese operative), however he commits in the +0800 time zone (Beijing). He works during Chinese holidays and doesn't work during Western holidays. However, the times don't make sense: It looks like he w…

> He works during Chinese holidays and doesn't work during Western holidays.

“Western Holidays”, as if that is a coherent, cross-nationally consistent set.

Other than the fact that you specific suggestion of it being American makes little sense based in this sibce its not accurate construed as American holidays, this phrasing is bizarre in this context.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#416

Post by asveikau »

littlestymaar wrote: post #351
cryptonector wrote: post #299

Earlier quoted context omitted.

The signature validation could be moved into an unprivileged process forked from that one.

That's an easy thing to say after the fact indeed but yes. In fact after such a disastrous backdoor I wouldn't be surprised if OpenSSH moved all code calling external libraries to unprivileged processes to make sure such an attack can never have such a dramatic effect (an auth bypass would still likely be possible, but that's still way better than a root RCE…). At this point “All libraries could be malicious” is a th…

I don't think that's a threat model that OpenSSH should waste too much time on. Ultimately this is malicious code in the build machine compiling a critical system library. That's not reasonable to defend against.

Keep in mind that upstream didn't even link to liblzma. Debian patched it to do so. OpenSSH should defend against that too?

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#417

Post by lobocinza »

XorNot wrote: post #288
raggi wrote: post #154

Earlier quoted context omitted.

There is one possible time pressure involved, which is that libsystemd dropped the liblzma dependency

Absolutely no intelligence agency would look at a successful compromise where they have a highly positioned agent in an organization like this, and burn them trying to rush an under-developed exploit in that would then become not useful almost immediately (because the liblzma dependency would be dropped next distro upgrade cycle). If you had a human-asset with decision making authority and trust in place, then as fun…

Presumably this intelligence agency have multiple such initiatives and can afford to burn one to achieve a goal.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#418

Post by ikekkdcjkfke »

p-e-w wrote: post #392
tigerlily wrote: post #370

As a de facto maintainer of an obscure open source game, I see devs come and go. I just merge all the worthwhile contributions. Some collaborators go pretty deep with their features, with a variety of coding styles, in a mishmash of C and C++. I'm not always across the implementation details, but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be scre…

> but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be screwed That's true of course, but it's not a problem specific to software. In fact, I'm not even sure it's a "problem" in a meaningful sense at all. When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. Th…

[flagged]

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#419

Post by consumer451 »

pmarreck wrote: post #412
consumer451 wrote: post #398

Earlier quoted context omitted.

> But at the end of the day, the vast majority of people just don't seek to actively harm others. Everything humans do relies on that assumption, and always has. https://en.wikipedia.org/wiki/Normalcy_bias ? > It's symptomatic of the insane Silicon Valley vision that the world can and should be managed and controlled at every level of detail. Which is a "cure" that would be much worse than any disease it could possib…

You need to accept that everything has a tradeoff and some amount of drama just seems to be built into the system. Take sex work, for example. Legalizing it leads to an overall increase in sex trafficking. But it also does this: https://www.washingtonpost.com/news/wonk/wp/2014/07/17/when-... My personal opinion is that if something is going to find a way to conduct itself in secret anyway (at high risk and cost) if i…

But there have to be specific trade-offs, in each case.

I am reminded of the words of "a wise man."

https://news.ycombinator.com/item?id=39874049

Captain's Log: This entire branch of comments responding to OP is not helping advance humanity in any significant way. I would appreciate my statement of protest being noted by the alien archeologists who find these bits in the wreckage of my species.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#420

Post by wepple »

armitron wrote: post #36
bawolff wrote: post #34

The headline seems like a distinction without a difference. Bypassing ssh auth means getting a root shell. There is no significant difference between that and running system(). At most maybe system() has less logging.

> Bypassing ssh auth means getting a root shell Only if you're allowed to login as root, which is definitely not the case everywhere.

Plus, detection is likely to be be very different.
Post reply on HN