Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

11–20 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#11

Post by miduil »

nindalf wrote: post #7
miduil wrote: post #5

Earlier quoted context omitted.

It's a POC nevertheless, it's a complete implementation of the RCE minus obviously the private key.

It doesn't matter. The people with the private key already knew all of this because they implemented it. The script kiddies without the private key can't do anything without it. A POC doesn't help them in any way. A way to check if servers are vulnerable is probably by querying the package manager for the installed version of xz. Not very sophisticated, but it'll work.

> It doesn't matter.

To understand the exact behavior and extend of the backdoor, this does matter. An end to end proof of how it works is exactly what was needed.

> A way to check if servers are vulnerable is probably by querying the package manager

Yes, this has been know since the initial report + later discovering what exact strings are present for the payload.

https://github.com/Neo23x0/signature-base/blob/master/yara/b...

> Not very sophisticated, but it'll work.

Unfortunately, we live in a world with closed-servers and appliances - being able as a customer or pen tester rule out certain class of security issues without having the source/insights available is usually desirable.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#12

Post by winkelmann »

arnaudsm wrote: post #9

Have we seen exploitation in the wild yet?

I assume the operation has most likely been called off. Their goal was probably to wait until it got into stable distros. I doubt there is a large number of unstable Debian or Fedora Rawhide servers with open SSH in the wild.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#14

Post by [deleted] »

cjbprime wrote: post #8
miduil wrote: post #2

Super impressed how quickly the community and in particular amlweems were able to implement and document a POC. If the cryptographic or payload loading functionality has no further vulnerabilities, this would have been also at least not introducing a security flaw to all the other attackers until the key is broken or something. Edit: I think what's next for anyone is to figure out a way to probe for vulnerable deploy…

Probing for vulnerable deployments over the network (without the attacker's private key) seems impossible, not non-trivial. The best one could do is more micro-benchmarking, but for an arbitrary Internet host you aren't going to know whether it's slow because it's vulnerable, or because it's far away, or because the computer's slow in general -- you don't have access to how long connection attempts to that host took…

[deleted]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#15

Post by bobby_the_whale »

acdha wrote: post #6

Has anyone tried the PoC against one of the anomalous process behavior tools? (Carbon Black, AWS GuardDuty, SysDig, etc.) I’m curious how likely it is that someone would have noticed relatively quickly had this rolled forward and this seems like a perfect test case for that product category.

[dead]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#16

Post by haswell »

asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

I suspect the original rationale is about preserving the longevity of the backdoor. If you blow a hole wide open that anyone can enter, it’s going to be found and shut down quickly.

If this hadn’t had the performance impact that brought it quickly to the surface, it’s possible that this would have lived quietly for a long time exactly because it’s not widely exploitable.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#18

Post by Alifatisk »

asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#19

Post by linsomniac »

asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

Am I reading it correctly that the payload signature includes the target SSH host key? So you can't just spray it around to servers, it's fairly computationally expensive to send it to a host.
Post reply on HN