Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

71–80 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#71

Post by alfanick »

gghffguhvc wrote: post #48

Is there anything actually illegal here? Like is it a plausible “business” model for talented and morally compromised developers to do this and then sell the private key to state actors without actually breaking in themselves or allowing anyone else to break in. Edit: MIT license provides a pretty broad disclaimer to say it isn’t fit for any purpose implied or otherwise.

Legality things, depends on jurisdiction, which may or may not depend on:

* where were the authors of the code, * where the code is stored, * who is attacked, * where are their servers, * who is attacking, * where are they based, * where did they attack from, * ...

IANAL but it seems very complicated from law perspective (we, humanity, don't have a global law)

Edit2: making a bullet point list is hard

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#72

Post by MOARDONGZPLZ »

edflsafoiewq wrote: post #64
stingraycharles wrote: post #38

Earlier quoted context omitted.

I like the theory that actually, it wasn’t luck but was picked up on by detection tools of a large entity (Google / Microsoft / NSA / whatever), and they’re just presenting the story like this to keep their detection methods a secret. It’s what I would do.

They could announce it without revealing their detection method. I don't see what the extra indirection buys them.

Shutting down 99.9% of speculation on how the vulnerability was found in the first place.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#73

Post by mr_mitm »

jolmg wrote: post #56
herpderperator wrote: post #42

Earlier quoted context omitted.

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. If that's important, one should be able to set up port knocking such that you're able to do the knocks even by changing the port in a sequence by hand on e.g. a web browser address bar.

Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key).

https://www.cipherdyne.org/fwknop/

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#74

Post by davikr »

faxmeyourcode wrote: post #43

Edit: I misunderstood what I was reading in the link below, my original comment is here for posterity. :) > From down in the same mail thread: it looks like the individual who committed the backdoor has made some recent contributions to the kernel as well... Ouch. https://www.openwall.com/lists/oss-security/2024/03/29/10 The OP is such great analysis, I love reading this kind of stuff!

Lasse Collin is not Jia Tan until proven otherwise.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#75

Post by TacticalCoder »

dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

> Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible.

Indeed: I whitelist hosts/IP blocks allowed to SSH in. I don't use port-knocking but I never ever criticized those using port knocking.

I do really wonder if people are still going to say that port knocking is pointless and security theatre: we now have a clear example where people who were using port-knocking were protected while those who didn't were potentially wide open to the biggest backdoor discovered to date (even if it's wasn't yet in all the major distros).

> ... does the entire internet really need to be able to SSH to your box?

Nope and I never ever understood the argument saying: "Port-knocking is security theatre, it doesn't bring any added security".

To me port-knocking didn't lower the security of a system.

It seems that we now have a clear proof that it's actually helping versus certain type of attacks (including source-code supply chain attacks).

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#76

Post by [deleted] »

MuffinFlavored wrote: post #61

Instead of needing the honeypot openssh.patch at compile-time https://github.com/amlweems/xzbot/blob/main/openssh.patch How did the exploit do this at runtime? I know the chain was: opensshd -> systemd for notifications -> xz included as transient dependency How did liblzma.so.5.6.1 hook/patch all the way back to openssh_RSA_verify when it was loaded into memory?

[deleted]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#77

Post by declan_roberts »

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA.

Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#78

Post by MuffinFlavored »

tadfisher wrote: post #68
MuffinFlavored wrote: post #61

Instead of needing the honeypot openssh.patch at compile-time https://github.com/amlweems/xzbot/blob/main/openssh.patch How did the exploit do this at runtime? I know the chain was: opensshd -> systemd for notifications -> xz included as transient dependency How did liblzma.so.5.6.1 hook/patch all the way back to openssh_RSA_verify when it was loaded into memory?

When loading liblzma, it patches the ELF GOT (global offset table) with the address of the malicious code. In case it's loaded before libcrypto, it registers a symbol audit handler (a glibc-specific feature, IIUC) to get notified when libcrypto's symbols are resolved so it can defer patching the GOT.

> When loading liblzma, it patches the ELF GOT (global offset table) with the address of the malicious code.

How was this part obfuscated/undetected?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#79

Post by jolmg »

mr_mitm wrote: post #73
jolmg wrote: post #56

Earlier quoted context omitted.

> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. If that's important, one should be able to set up port knocking such that you're able to do the knocks even by changing the port in a sequence by hand on e.g. a web browser address bar.

Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key). https://www.cipherdyne.org/fwknop/

Not if you set it up such that each knocking sequence can only be used once. Port knocking is a flexible concept.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#80

Post by Denvercoder9 »

faxmeyourcode wrote: post #43

Edit: I misunderstood what I was reading in the link below, my original comment is here for posterity. :) > From down in the same mail thread: it looks like the individual who committed the backdoor has made some recent contributions to the kernel as well... Ouch. https://www.openwall.com/lists/oss-security/2024/03/29/10 The OP is such great analysis, I love reading this kind of stuff!

The referenced patch series had not made it into the kernel yet.
Post reply on HN