Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

431–440 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#431

Post by brailsafe »

Dalewyn wrote: post #424
consumer451 wrote: post #419

Earlier quoted context omitted.

But there have to be specific trade-offs, in each case. I am reminded of the words of "a wise man." https://news.ycombinator.com/item?id=39874049 Captain's Log: This entire branch of comments responding to OP is not helping advance humanity in any significant way. I would appreciate my statement of protest being noted by the alien archeologists who find these bits in the wreckage of my species.

I think drunk driving being an oil that keeps society lubricated cannot and should not be understated. Yes, drunk driving kills people and that's unacceptable. On the other hand, people going out to eat and drink with family, friends, and co-workers after work helps keep society functioning, and the police respect this reality because they don't arrest clearly-drunk patrons coming out of restaurants to drive back hom…

What is more depressing is how we can acknowledge that reality and continue to do absolutely nothing to mitigate it but punish it, in many cases.

The more people practically need to drive, the more people will drunk drive and kill people, yet in so many cases we just sort of stop there and be like "welp, guess that's just nature" instead of building viable alternatives. However the other theoretical possibly is that if people didn't need to drive, they might end up drinking more.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#432

Post by heresWaldo »

georgyo wrote: post #158
heresWaldo wrote: post #137

Earlier quoted context omitted.

Yeah these types of security issues will be used by politicians to force hardware makers to lockdown hardware, embed software in chips. The go fast startups habit of “import the world to make my company products” is a huge security issue IT workers ignore. The only solution politics and big tech will chase is obsolete said job market by pulling more of the stack into locked down hardware, with updates only allowed to…

I'm not saying political forces won't try legislating the problem away, but that won't even help here. A supply chain attack can happen in hardware or software. Hardware has firmware, which is software. What makes this XZ attack so scary is that it was directly from a "trusted" source. A similar attack could come from any trusted source. At least with software it is much easier to patch.

Like you said it has firmware which is flashable. Secure enclaves are never 100% secure but if only, for example, Apple can upload to them, it dramatically reduces some random open source project being git pulled. Apple may still pull open source but they would be on the hook to avoid this.

Open sources days of declaring “use at your risk” have become a liability in this hyper networked society. It’s now becoming part of the problem it was imagined up to solve.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#433

Post by keepamovin »

p-e-w wrote: post #392
tigerlily wrote: post #370

As a de facto maintainer of an obscure open source game, I see devs come and go. I just merge all the worthwhile contributions. Some collaborators go pretty deep with their features, with a variety of coding styles, in a mishmash of C and C++. I'm not always across the implementation details, but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be scre…

> but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be screwed That's true of course, but it's not a problem specific to software. In fact, I'm not even sure it's a "problem" in a meaningful sense at all. When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. Th…

This is a good take. But even in a forest, sometimes when tragedy strikes people do postmortems, question regulations and push for change.

Sometimes, it does seem like the internet incentivizes or makes everyone else accessible to a higher ratio of people who seem to harm than normal.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#434

Post by fredamaral »

tigerlily wrote: post #370

As a de facto maintainer of an obscure open source game, I see devs come and go. I just merge all the worthwhile contributions. Some collaborators go pretty deep with their features, with a variety of coding styles, in a mishmash of C and C++. I'm not always across the implementation details, but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be scre…

dont you think that something as simple as a CLA (contributor legal agreement) would prevent this type of thing? of course creates noise in the open source contribution funnel, but let's be honest: if you are dedicating yourself to something like contributing to oss, signing a CLA should not be something unrealistic.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#435

Post by mendyberger »

p-e-w wrote: post #392
tigerlily wrote: post #370

As a de facto maintainer of an obscure open source game, I see devs come and go. I just merge all the worthwhile contributions. Some collaborators go pretty deep with their features, with a variety of coding styles, in a mishmash of C and C++. I'm not always across the implementation details, but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be scre…

> but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be screwed That's true of course, but it's not a problem specific to software. In fact, I'm not even sure it's a "problem" in a meaningful sense at all. When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. Th…

Difference is that software backdoors can effect billions of people. That driver on the road can't effect too many without being caught.

In this case, had they been a bit more careful with performance, they could have effected millions of machines without being caught. There aren't many cases where a lone wolf can do so much damage outside of software.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#436

Post by CanaryLayout »

mjg59 wrote: post #381
cryptonector wrote: post #299

Earlier quoted context omitted.

The signature validation could be moved into an unprivileged process forked from that one.

It wouldn't matter in this case, since the exploit could simply rewrite the function that calls out to the unprivileged process. If you already have malicious code in your privileged parent process there's no way to recover from that.

Exactly. The attack came in by hitching a ride on to systemd.

sshd is not the problem. the ldd/monolith architecture surrounding systemd is.

What if I duplicated this attack but instead targeted dbus or any other thing that systemd is managing?

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#437

Post by CanaryLayout »

asveikau wrote: post #416
littlestymaar wrote: post #351

Earlier quoted context omitted.

That's an easy thing to say after the fact indeed but yes. In fact after such a disastrous backdoor I wouldn't be surprised if OpenSSH moved all code calling external libraries to unprivileged processes to make sure such an attack can never have such a dramatic effect (an auth bypass would still likely be possible, but that's still way better than a root RCE…). At this point “All libraries could be malicious” is a th…

I don't think that's a threat model that OpenSSH should waste too much time on. Ultimately this is malicious code in the build machine compiling a critical system library. That's not reasonable to defend against. Keep in mind that upstream didn't even link to liblzma. Debian patched it to do so. OpenSSH should defend against that too?

any one of us if we sat on the OSSH team would flip the middle finger. What code is the project supposed to write when nothing on main dyn loaded liblzma. It was brought in from a patch they don't have realistic control over.

This is a Linux problem, and the problem is systemd, which is who brought the lib into memory and init'd it.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#438

Post by omeid2 »

fredamaral wrote: post #434
tigerlily wrote: post #370

As a de facto maintainer of an obscure open source game, I see devs come and go. I just merge all the worthwhile contributions. Some collaborators go pretty deep with their features, with a variety of coding styles, in a mishmash of C and C++. I'm not always across the implementation details, but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be scre…

dont you think that something as simple as a CLA (contributor legal agreement) would prevent this type of thing? of course creates noise in the open source contribution funnel, but let's be honest: if you are dedicating yourself to something like contributing to oss, signing a CLA should not be something unrealistic.

CLA is not an ID check. It is to handover the rights for the code over to the project owners rather than doing any identity check.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#439

Post by ngcc_hk »

Whilst we are in 3bp mode, what happen if a state actor want to harm open source … not to destroy it but to pollute it … as said you can check and test all. Legal … they do not care.

I wonder.

… We are all good vs even Buddha has evil nature mental model.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#440

Post by sgammon »

There appears to be a string encoded in the binary payload:

https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01...

Which functions as a killswitch:

https://piaille.fr/@zeno/112185928685603910

If that is indeed the case, one mitigation might be

```

echo "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" | sudo tee -a /etc/environment

```

Post reply on HN