Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

621–630 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#621

Post by guenthert »

quatrefoil wrote: post #135
sega_sai wrote: post #95

One have question on this is, if the backdoor would not been discovered due to performance issue (which was as I understood it purely an oversight/fixable deficiency in the code), what are the chances of discovering this backdoor later, or are there tools that would have picked it up? Those questions are IMO relevant to understand if this kind of backdoor is the first one of the kind, or the first one that was uncove…

If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks). That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.

Hmmh, brings up the question, if no exploit actually occurred, was a crime committed? Can't the authors claim that they were testing how quickly the community of a thousand eyes would react, you know, for science?

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#622

Post by rigid »

tomasGiden wrote: post #592
nrdvana wrote: post #459

Earlier quoted context omitted.

That just raises the hurdle for the attacker. The attacker in this case has full control to replace any function within ssh with their own version, and the master process of sshd will always need the ability to fork and still be root on the child process before dropping privileges. I don't see any way around that. They only needed to override one function this time, but if you raise the bar they would just override m…

I’m highly safety critical systems you have software (and hardware) diversity were multiple pieces of software, developed independently, have to vote on the result. Maybe highly critical pieces of Linux like the login process should be designed the same way. So that two binaries without common dependencies would need to accept the login for the user to get privileges. Exactly how to do it (especially transparently fo…

> login process

RCE doesn't really follow a login process design. As soon as you got RCE you can be considered pwned.

If not now, then at the time the next locally exploitable vulnerability comes up. There are plenty.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#623

Post by [deleted] »

p-e-w wrote: post #474
imiric wrote: post #452

Earlier quoted context omitted.

> When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. There is nothing you can do to protect yourself against it. Sure you can. You can be more vigilant and careful when walking near traffic. So maybe don't have headphones on, and engage all your senses on the immediate threats around you. This won't guarantee that a car won't…

It's not defeatist to admit and accept that some things are ultimately out of our control. And more importantly, that any attempt to increase control over them comes with downsides. An open source project that imposes all kinds of restrictions and complex bureaucratic checks before anything can get merged, is a project I wouldn't want to participate in. I imagine many others might feel the same. So perhaps the loss f…

[deleted]

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#624

Post by _zoltan_ »

asveikau wrote: post #27

I have found it irritating how in the community, in recent years, it's popular to say that if a project doesn't have recent commits or releases that something is seriously wrong. This is a toxic attitude. There was nothing wrong with "unmaintained" lzma two years ago. The math of the lzma algorithm doesn't change. The library was "done" and that's ok. The whiny mailing list post from the sock puppet, complaining abou…

I was just looking at headscale. Last release mid 2023.

I had immediately asked myself: is this even maintained anymore?

I think this is a very valid question to ask.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#625

Post by rigid »

quatrefoil wrote: post #135
sega_sai wrote: post #95

One have question on this is, if the backdoor would not been discovered due to performance issue (which was as I understood it purely an oversight/fixable deficiency in the code), what are the chances of discovering this backdoor later, or are there tools that would have picked it up? Those questions are IMO relevant to understand if this kind of backdoor is the first one of the kind, or the first one that was uncove…

If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks). That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.

> where no auditor ever looks

Well, software supply chains are a thing.

"where no auditor ever is paid to look" would be more correct.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#626

Post by NekkoDroid »

guenthert wrote: post #621
quatrefoil wrote: post #135

Earlier quoted context omitted.

If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks). That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.

Hmmh, brings up the question, if no exploit actually occurred, was a crime committed? Can't the authors claim that they were testing how quickly the community of a thousand eyes would react, you know, for science?

That's like asking if someone that went into a crowded place with a full-automatic and started shooting at people but "purposefully missing" is just testing how fast law enforcement reacts, you know, for science.

After something like 2 years of planning this out and targeted changes this isn't something "just done for science".

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#627

Post by rigid »

xlii wrote: post #586
sega_sai wrote: post #95

One have question on this is, if the backdoor would not been discovered due to performance issue (which was as I understood it purely an oversight/fixable deficiency in the code), what are the chances of discovering this backdoor later, or are there tools that would have picked it up? Those questions are IMO relevant to understand if this kind of backdoor is the first one of the kind, or the first one that was uncove…

Working for about a year in an environment that was exposed to high volume of malevolent IT actors (and some pretty scary ones) I’d say: discovery chances very always pretty high. Keeping veil of secrecy requires unimaginable amount of energy. Same goes with truth consistency. One little slip and everything goes to nothing. Sometimes single sentence can start a chain of reaction and uncover meticulous crafted plan. T…

> it enabled it in the first place

it took roughly two years including social engineering.

I'd say the same approach is much easier in a big software company.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#628

Post by tux3 »

forty wrote: post #559
tialaramex wrote: post #355

Earlier quoted context omitted.

Private key. In cryptography we distinguish keys which are symmetric (needed by both parties and unavailable to everyone else) as "Secret" keys, with the pair of keys used in public key cryptography identified as the Private key (typically known only to one person/ system/ whatever) and Public key (known to anybody who cares) Thus, in most of today's systems today your password is a secret . You know your password an…

I have often seen the secret component of an asymmetric key pair referred as secret key as well. See libsodium for example. Maybe it's because curve/ed 25519 secrets are 32 random bytes unlike RSA keys which have specific structure which makes them distinct from generic secrets.

It also allows "pk" and "sk" as overly short variable names, an argument developpers are sometimes tempted by!

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#629

Post by therein »

ignoramous wrote: post #37
gavinhoward wrote: post #8

If that's true, then I am 100% certain that this backdoor is from a nation state-level actor.

I imagine such actors are embed within major consumer tech teams, too: Twitter, TikTok, Chrome, Snap, WhatsApp, Instagram... covers ~70% of all humanity.

This could be something that agent that infiltrated into companies could use to execute stuff on internal hosts that they have SSH connectivity to but no access.

You could get into bastion hosts and then to PROD and leave no log traces.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#630

Post by broadsidepicnic »

juliusdavies wrote: post #597
perbu wrote: post #596

Earlier quoted context omitted.

Gross negligence and willfull misconduct cannot be waved away like this, in certain legislations, at least.

Yes, but hopefully it does protect Lasse Collin.

From what?
Post reply on HN