Xzbot: Notes, honeypot, and exploit demo for the xz backdoor • Hacker News Board

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#51

Post by Joel_Mckay » Mon, Apr 01, 2024, 5:33 PM UTC

herpderperator wrote: post #42

dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

Port knocking with ssh over https using client certs.

And port knocking is one of the few effective methods against the standard distributed brute forcing slow attacks.

Note if you blanket-ban IN/RU/UK/CN/HK/TW/IR/MX/BZ/BA + tor/proxies lists, than 99.998% of your nuisance traffic issues disappear overnight. =)

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#52

Post by jsmith99 » Mon, Apr 01, 2024, 5:34 PM UTC

stingraycharles wrote: post #38

Alifatisk wrote: post #18

Earlier quoted context omitted.

For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.

I like the theory that actually, it wasn’t luck but was picked up on by detection tools of a large entity (Google / Microsoft / NSA / whatever), and they’re just presenting the story like this to keep their detection methods a secret. It’s what I would do.

The attacker changed the projects contact details at oss fuzz (an automated detection tool). There’s an interesting discussion as to whether that would have picked up the vulnerability https://github.com/google/oss-fuzz/issues/11760

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#53

Post by morkalork » Mon, Apr 01, 2024, 5:39 PM UTC

TechDebtDevin wrote: post #39

Alifatisk wrote: post #20

Earlier quoted context omitted.

Must be punching the air right now

Likely a team of people at a three letter agency.

I wonder if they have OKRs too.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#54

Post by dec0dedab0de » Mon, Apr 01, 2024, 5:40 PM UTC

herpderperator wrote: post #42

dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

Absolutely, everything in security is a tradeoff. I guess the real point is that there should be layers, and even though you should never rely on security through obscurity, you should still probably have a bit of obscurity in the mix.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#55

Post by deknos » Mon, Apr 01, 2024, 5:40 PM UTC

Joel_Mckay wrote: post #51

herpderperator wrote: post #42

Earlier quoted context omitted.

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

Port knocking with ssh over https using client certs. And port knocking is one of the few effective methods against the standard distributed brute forcing slow attacks. Note if you blanket-ban IN/RU/UK/CN/HK/TW/IR/MX/BZ/BA + tor/proxies lists, than 99.998% of your nuisance traffic issues disappear overnight. =)

can you give an example for an implementation of portnocking/ssh/over https and client certs?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#56

Post by jolmg » Mon, Apr 01, 2024, 5:40 PM UTC

herpderperator wrote: post #42

dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect.

If that's important, one should be able to set up port knocking such that you're able to do the knocks even by changing the port in a sequence by hand on e.g. a web browser address bar.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#57

Post by nottorp » Mon, Apr 01, 2024, 5:42 PM UTC

herpderperator wrote: post #42

dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

You just described the problem with using keys for any login, like the latest fad is?

And generally with depending on a device (phone, xxxkey or whatever) for access.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#58

Post by toasteros » Mon, Apr 01, 2024, 5:46 PM UTC

yodsanklai wrote: post #37

Do we know who's the attacker?

The name that keeps coming up is Jia Tan (https://github.com/JiaT75/) but we have no way of knowing if this is a real name, pseudonym, or even a collective of people.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#59

Post by est31 » Mon, Apr 01, 2024, 5:46 PM UTC

stingraycharles wrote: post #38

Alifatisk wrote: post #18

Earlier quoted context omitted.

For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.

I like the theory that actually, it wasn’t luck but was picked up on by detection tools of a large entity (Google / Microsoft / NSA / whatever), and they’re just presenting the story like this to keep their detection methods a secret. It’s what I would do.

I doubt that if Google detected it with some internal tool, they'd reach out to Microsoft to hide their contribution.

It was reported by an MS engineer who happens to be involved in another OSS project. MS is doing business with the US intelligence community, for example there is the Skype story: First, rumors that NSA offers a lot of money for people who can break Skype's E2E encryption, then MS buys Skype, then MS changes Skype's client to not be E2E encrypted any more and to use MS servers instead of peer to peer, allowing undetectable wiretapping of arbitrary connections.

But it's a quite credible story too that it was just a random discovery. Even if it was the NSA, why would they hide that capability. It doesn't take much to run a script to compare git state with uploaded source tarballs in distros like Debian (Debian has separate tarballs for the source and the source with Debian patches applied).

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#60

Post by TheBlight » Mon, Apr 01, 2024, 5:47 PM UTC

TechDebtDevin wrote: post #39

Alifatisk wrote: post #20

Earlier quoted context omitted.

Must be punching the air right now

Likely a team of people at a three letter agency.

Everyone keeps saying this but it seems unlikely to me that they'd do this for a relatively short window of opportunity and leave their methods for all to see.