Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

571–580 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#571

Post by tw04 »

Muromec wrote: post #483
tw04 wrote: post #446

Earlier quoted context omitted.

What exactly is a CLA going to do to a CCP operative (as appears to be the case with xz)? Do you think the party is going to extradite one of their state sponsored hacking groups because they got caught trying to implement a backdoor? Or do you think they don’t have the resources to fake an identity?

The whole Chinese name and UTC+8 were a cover, as the person apparently was from EET

While it ultimately doesn’t matter if it was Russia or China beyond potential political fallout. Do you have a link to the proof pointing towards EET?

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#572

Post by kortilla »

tialaramex wrote: post #355
swid wrote: post #123

Earlier quoted context omitted.

You can imagine a door that opens if you knock on it just right. For anyone without the secret knock, it appears and functions as a wall. Without the secret knock, there might not even be a way to prove it opens at all. This is sort of the situation here. xz tries to decode some data before it does anything shady; since it is asymmetric; it can do the decryption without providing the secret encryption key (it has the…

Private key. In cryptography we distinguish keys which are symmetric (needed by both parties and unavailable to everyone else) as "Secret" keys, with the pair of keys used in public key cryptography identified as the Private key (typically known only to one person/ system/ whatever) and Public key (known to anybody who cares) Thus, in most of today's systems today your password is a secret . You know your password an…

Private keys are also “secrets” here in the security world.

“Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing”

Your distinction is not shared by the industry so it’s not something helpful to correct people on.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#573

Post by omeid2 »

fredamaral wrote: post #445
omeid2 wrote: post #438

Earlier quoted context omitted.

CLA is not an ID check. It is to handover the rights for the code over to the project owners rather than doing any identity check.

agreed. but it does not mean i couldn't be. as per the terms, the content of a CLA could be anything. and that's my point

Then the question becomes "should we require ID for open source contributions?" and the answer is most likely no, not a good idea.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#574

Post by godelski »

beanjuiceII wrote: post #509
godelski wrote: post #476

Earlier quoted context omitted.

Honestly this is why I think we should pay people for open source projects. It is a tragedy of the commons issues. All of us benefit a lot from these free software, and done for free. Pay doesn't exactly fix the problems directly, but they do decrease the risk. Pay means people can work on these full time instead of on the side. Pay means it is harder to bribe someone. Pay also makes the people contributing feel bett…

Ya so we could have paid this dude to put the exploits in our programs good IDEA y

If you're going to criticize me, at least read what I wrote first

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#575

Post by t0mas88 »

chris_wot wrote: post #116
rdtsc wrote: post #105

Earlier quoted context omitted.

At least for some comic relief I'd like to imagine Jia's boss slapping him and saying something like "you idiot, we worked on this for so many years and you couldn't have checked for any perf issues?" But seriously, we could have found ourselves with this in all stable repos: RHEL, Debian, Ubuntu, IoT devices 5 years from now and it would have been a much larger shit show.

Surely this is something the FBI should be involved with? Or some authority?

Probably the FBI for the public part of it, but if this wasn't a US owned operation you can be sure the CIA/NSA/military will do their own investigation.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#576

Post by kortilla »

BlueFalconHD wrote: post #222
plg94 wrote: post #129

Earlier quoted context omitted.

I don't think we know what exactly this does, yet. I can only answer one of those questions, as far as I understand the "unreplayable" part is refering to this: > Apparently the backdoor reverts back to regular operation if the payload is malformed or *the signature from the attacker's key doesn't verify*. emphasis mine, note the "signature of the attacker's key". So unless that key is leaked, or someone breaks the R…

It would be really cool if in 20 years when we have quantum computers powerful enough we could see what this exploit does.

We do know what it does. If it decrypts it just passes to system().

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#577

Post by armada651 »

AnonHP wrote: post #532
SV_BubbleTime wrote: post #373

Earlier quoted context omitted.

> You know your password and so does the system authenticating you. Nitpick, but no it shouldn’t. The HASH of your password is recorded. You never submit your password, you submit that hash and they compare it. The difference is that there is no two passwords that collide; but there are hashes that may. And that two equal passwords from two equal users are not necessarily accessible to someone with the hash list beca…

> Nitpick, but no it shouldn’t. The HASH of your password is recorded. You never submit your password, you submit that hash and they compare it. Nitpick, but the password is submitted as-is by most client applications, and the server hashes the submitted password and compares it with the hash it has (of course, with salting).

> Nitpick, but the password is submitted as-is by most client applications, and the server hashes the submitted password and compares it with the hash it has (of course, with salting).

I never understood why clients are coded this way. It's trivially easy to send the salt to the client and have it do the hashing. Though I guess it doesn't really improve security in a lot of cases, because if you successfully MITM a web app you can just serve a compromised client.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#578

Post by timeon »

KnightHawk3 wrote: post #444
DrTung wrote: post #371

If the RCE is Russian, it could be used a communication kill-switch on the morning of an attack outside Ukraine, similar to the Viasat hack https://en.m.wikipedia.org/wiki/Viasat_hack

Why does it have to be russian? Could be any country, even USA, China. I don't see why this sort of attack is limited to Russia.

> Why does it have to be russian? Could be any country, even USA, China.

Are you sure you are replying to right comment? Because they did not implied it was not other country or actor. It even directly starts with 'IF'.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#579

Post by yosito »

imiric wrote: post #429
tigerlily wrote: post #370

As a de facto maintainer of an obscure open source game, I see devs come and go. I just merge all the worthwhile contributions. Some collaborators go pretty deep with their features, with a variety of coding styles, in a mishmash of C and C++. I'm not always across the implementation details, but in the back of my mind I'm thinking, man, anyone could just code up some real nasty backdoor and the project would be scre…

The late author of ZeroMQ, Pieter Hintjens, advocated for a practice called Optimistic Merging[1], where contributions would be merged immediately, without reviewing the code or waiting for CI results. So your approach of having lax merging guidelines is not far off. While I can see the merits this has in building a community of contributors who are happy to work on a project, I always felt that it opens the project…

I wonder how good automated LLM-based code reviews would be at picking up suspicious patterns in pull requests.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#580

Post by trallnag »

jsploit wrote: post #521
spxneo wrote: post #512

Earlier quoted context omitted.

Exactly I don't understand the obsession with Russia Literally just a country with people like you and me. "Jia Tan" does not sound Russian https://boehs.org/node/everything-i-know-about-the-xz-backdo...

> "Jia Tan" does not sound Russian It's not a real name.

What about X Æ A-12?
Post reply on HN