Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

121–130 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#121

Post by acdha »

knoxa2511 wrote: post #28
acdha wrote: post #6

Has anyone tried the PoC against one of the anomalous process behavior tools? (Carbon Black, AWS GuardDuty, SysDig, etc.) I’m curious how likely it is that someone would have noticed relatively quickly had this rolled forward and this seems like a perfect test case for that product category.

Sysdig released a blog on friday. "For runtime detection, one way to go about it is to watch for the loading of the malicious library by SSHD. These shared libraries often include the version in their filename." The blog has the actual rule content which I haven't seen from other security vendors https://sysdig.com/blog/cve-2024-3094-detecting-the-sshd-bac...

Thanks! That’s a little disappointing since I would have thought that the way it hooked those functions could’ve been caught by a generic heuristic but perhaps that’s more common than I thought.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#122

Post by AlexCoventry »

noman-land wrote: post #90
dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

Got any advice to easily set up port knocking?

It's old and there are probably friendlier options out there now, but

https://github.com/moxie0/knockknock/blob/master/INSTALL

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#123

Post by vikarti »

mr_mitm wrote: post #73
jolmg wrote: post #56

Earlier quoted context omitted.

> The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. If that's important, one should be able to set up port knocking such that you're able to do the knocks even by changing the port in a sequence by hand on e.g. a web browser address bar.

Note that port knocking is vulnerable to replay attacks. Single Packet Authentication is better, but requires a private key (can be your SSH key). https://www.cipherdyne.org/fwknop/

This looks related to some other problem: - There is Alice's server which provide service X - There are clients like Bob who needs this service. - There is Mallory who thinks clients doesn't need such service. Mallory have significant resources (more than Alice or Bob). - Mallory thinks it's ok to block access to Alice' server IF it's known that it's Alice's server and not some random site. Mallory sometimes also thinks it's ok to block if protocol is unknown.

This problem solved by XRay in all of it's versions. It could be possible (if overkill) to use mostly same methods to authenticate correct user and provide eir access.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#125

Post by udev4096 »

sureglymop wrote: post #31
herpderperator wrote: post #22

> Note: successful exploitation does not generate any log entries. Does this mean, had this exploit gone unnoticed, the attacker could have executed arbitrary commands as root without even a single sshd log entry on the compromised host regarding the 'connection'?

Yes.. The RCE happens at the connection stage before anything is logged.

That's insane. How exactly does this happen? Are there no EDR/IDS who can detect an RCE at the connection stage?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#126

Post by password4321 »

AlexCoventry wrote: post #109
TacticalCoder wrote: post #75

Earlier quoted context omitted.

> Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. Indeed: I whitelist hosts/IP blocks allowed to SSH in. I don't use port-knocking but I never ever criticized those using port knocking. I do really wonder if people are still going to say that port knocking is pointless and security theatre: we now have a clear example where people who were using port-kno…

> say that port knocking is pointless and security theatre Who was saying that?

https://hn.algolia.com/?query=port%20knocking%20obscurity&ty...

20200515 https://news.ycombinator.com/item?id=23187662

etc.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#127

Post by oarsinsync »

Joel_Mckay wrote: post #51
herpderperator wrote: post #42

Earlier quoted context omitted.

The thing about port knocking is that if you're on a host where you don't have the ability to port-knock, then you're not able to connect. This can turn into a footgun: you're away from your usual device, something happens and you desperately need to connect, but now you can't because all the devices in your vicinity don't have the ability to perform $SECURITY_FEATURE_X so that you can connect, and you're screaming a…

Port knocking with ssh over https using client certs. And port knocking is one of the few effective methods against the standard distributed brute forcing slow attacks. Note if you blanket-ban IN/RU/UK/CN/HK/TW/IR/MX/BZ/BA + tor/proxies lists, than 99.998% of your nuisance traffic issues disappear overnight. =)

> if you blanket-ban IN/RU/UK/CN/HK/TW/IR/MX/BZ/BA

The list of countries there: India, Russia, United Kingdom, China, Hong Kong, Taiwan, Iran, Mexico, Belize, Bosnia and Herzegovina

I’m amused that the UK is in that group.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#128

Post by FergusArgyll »

gitfan86 wrote: post #41
herpderperator wrote: post #22

> Note: successful exploitation does not generate any log entries. Does this mean, had this exploit gone unnoticed, the attacker could have executed arbitrary commands as root without even a single sshd log entry on the compromised host regarding the 'connection'?

Yeah, but then you would have ssh traffic without a matching login. Wonder if any anomaly detection would work on that

Interesting... Though you can edit whatever log file you want

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#130

Post by AlexCoventry »

wolverine876 wrote: post #104
declan_roberts wrote: post #77

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA. Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

> The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. What are some examples?

https://en.wikipedia.org/wiki/Tailored_Access_Operations
Post reply on HN