It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.
how are you going to sell it if anyone can get in?
Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
91–100 of 500 posts
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#92Earlier quoted context omitted.
The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…
> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. You can type http://hostname:porttoknock in a browser. As long as you're not behind a super restrictive gateway that doesn't let you connect to arbitrary ports, you're golden.
It seems like there’d be a pretty big overlap between those kinds of hosts.
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#93Earlier quoted context omitted.
The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…
> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. You can type http://hostname:porttoknock in a browser. As long as you're not behind a super restrictive gateway that doesn't let you connect to arbitrary ports, you're golden.
I'm a bit of a noob about this. Can you explain what this means?
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#94Earlier quoted context omitted.
> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. If that's important, one should be able to set up port knocking such that you're able to do the knocks even by changing the port in a sequence by hand on e.g. a web browser address bar.
Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key). https://www.cipherdyne.org/fwknop/
What if the knocking sequence was derived from a TOTP secret?
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#95Earlier quoted context omitted.
Not if you set it up such that each knocking sequence can only be used once. Port knocking is a flexible concept.
I wonder if one could combine port knocking and TOTP in some way, so the sequence is determined by the TOTP? (Security is not my thing; don't judge me!)
Was just having the same thought reading this thread.
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#96Do we know who's the attacker?
The name that keeps coming up is Jia Tan ( https://github.com/JiaT75/ ) but we have no way of knowing if this is a real name, pseudonym, or even a collective of people.
Given the sophistication of this attack it would indeed be downright negligent to presume that it's the attackers' legal name and that they have zero OPSEC.
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#97Is there anything actually illegal here? Like is it a plausible “business” model for talented and morally compromised developers to do this and then sell the private key to state actors without actually breaking in themselves or allowing anyone else to break in. Edit: MIT license provides a pretty broad disclaimer to say it isn’t fit for any purpose implied or otherwise.
Yes. This would surely be prosecutable under the CFAA. Honestly, if I were involved in this, I'd hope that it was, say, the FBI that caught me. I think that'd be the best chance of staying out of the Guantanamo Bay Hilton, laws be damned.
Even with the MIT disclaimer and the author not being the distributor or have any relationship with the distributor. Publishing vulnerable open source software to GitHub with a disclaimer that says it isn’t fit for any purpose seems like a bit of an oversight of using MIT license in distros to me.
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#98Earlier quoted context omitted.
> When loading liblzma, it patches the ELF GOT (global offset table) with the address of the malicious code. How was this part obfuscated/undetected?
it was part of the binary malware payload hidden in a binary blob of "test data". In a compression/decompression test suite, a subtly broken allegedly compressed binary blob is not out of place. This suggests we need to audit information flow during builds - the shipping production binary package should be reproduceably buildable without reading test data or test code.
How/why did the test data get bundled into the final library output?
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#99[flagged]
Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor
#100Earlier quoted context omitted.
Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key). https://www.cipherdyne.org/fwknop/
What if the knocking sequence was derived from a TOTP secret?
Ooo, that's a fun idea