Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

231–240 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#231

Post by Voultapher »

btown wrote: post #163
declan_roberts wrote: post #87

Earlier quoted context omitted.

I agree that this is probably about persistence. Initially I thought the developer was playing the long-con to dump some crypto exchange and make off with literally a billion dollars or more. But if that was the case they wouldn't bother with the key. It'd be a one-and-done situation. It would be a stop-the-world event. Now it looks more like nation-state spycraft.

It's worth also noting that the spycraft involved a coordinated harassment campaign of the original maintainer, with multiple writing styles, to accelerate a transition of maintainership to the attacker: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.h... While this doesn't prove…

I mean one person can use sock puppet accounts to write emails.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#232

Post by markus92 »

bawolff wrote: post #214
declan_roberts wrote: post #77

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA. Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

> Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors What is this in reference to?

Stuxnet?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#233

Post by ginko »

bawolff wrote: post #214
declan_roberts wrote: post #77

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA. Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

> Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors What is this in reference to?

Probably Stuxnet.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#234

Post by [deleted] »

bawolff wrote: post #214
declan_roberts wrote: post #77

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA. Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

> Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors What is this in reference to?

[deleted]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#235

Post by hammock »

bawolff wrote: post #214
declan_roberts wrote: post #77

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA. Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

> Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors What is this in reference to?

Bob Maxwell (Ghislaine's father) sold backdoored software to corporations and governments all around the world, including US targets, on behalf of Israel's Mossad.

"The Maxwell-Mossad team steals spy software PROMIS from the United States, Mossad puts an undetectable trap door in it so Mossad can track the activities of anyone using it, then Maxwell sells it around the world (including back to the U.S. -- with the trap door)."

https://kclibrary.bibliocommons.com/v2/record/S120C257904

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#236

Post by shp0ngle »

kstrauser wrote: post #62
gghffguhvc wrote: post #48

Is there anything actually illegal here? Like is it a plausible “business” model for talented and morally compromised developers to do this and then sell the private key to state actors without actually breaking in themselves or allowing anyone else to break in. Edit: MIT license provides a pretty broad disclaimer to say it isn’t fit for any purpose implied or otherwise.

Yes. This would surely be prosecutable under the CFAA. Honestly, if I were involved in this, I'd hope that it was, say, the FBI that caught me. I think that'd be the best chance of staying out of the Guantanamo Bay Hilton, laws be damned.

CIA didn't put anyone new into gitmo for years.

The 30 remaining gitmo prisoners are all W Bush holdovers that all subsequent administrations forgot.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#237

Post by __MatrixMan__ »

allanbreyes wrote: post #210
btown wrote: post #163

Earlier quoted context omitted.

It's worth also noting that the spycraft involved a coordinated harassment campaign of the original maintainer, with multiple writing styles, to accelerate a transition of maintainership to the attacker: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.h... While this doesn't prove…

Ugh, that this psyops sockpuppetry may have started or contributed to the maintainer's mental health issues seems like the most depressing part of all this. Maintaining OSS is hard enough.

No good deed goes unpunished, what a shame.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#238

Post by btown »

allanbreyes wrote: post #210
btown wrote: post #163

Earlier quoted context omitted.

It's worth also noting that the spycraft involved a coordinated harassment campaign of the original maintainer, with multiple writing styles, to accelerate a transition of maintainership to the attacker: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.h... While this doesn't prove…

Ugh, that this psyops sockpuppetry may have started or contributed to the maintainer's mental health issues seems like the most depressing part of all this. Maintaining OSS is hard enough.

I hope that one takeaway from this entire situation is that if you're a maintainer and your users are pushing you outside your levels of comfort, that's a reflection on them, not on you - and that it could be reflective of something far, far worse than just their impatience.

If you, as a maintainer, value stability of not only your software but also your own mental health, it is entirely something you can be proud of to resist calls for new features, scope increases, and rapid team additions.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#239

Post by t0mas88 »

est31 wrote: post #59
stingraycharles wrote: post #38

Earlier quoted context omitted.

I like the theory that actually, it wasn’t luck but was picked up on by detection tools of a large entity (Google / Microsoft / NSA / whatever), and they’re just presenting the story like this to keep their detection methods a secret. It’s what I would do.

I doubt that if Google detected it with some internal tool, they'd reach out to Microsoft to hide their contribution. It was reported by an MS engineer who happens to be involved in another OSS project. MS is doing business with the US intelligence community, for example there is the Skype story: First, rumors that NSA offers a lot of money for people who can break Skype's E2E encryption, then MS buys Skype, then MS…

Intelligence agencies are very careful about sharing their findings, even with "friends", because the findings will disclose some information about their capabilities and possibly methods.

Let's say agency A has some scanning capability on open source software that detected this backdoor attempt by agency B. If they had gone public, agency B now knows they have this ability. So agency B will adjust their ways the next time and the scanning capability becomes less useful. While if agency A had told Microsoft to "find" this by accident, nobody would know about their scanning capability. And the next attempt by agency B would only try to avoid having the performance impact this first attempt had, probably leaving it visible to agency A.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#240

Post by takeda »

pxx wrote: post #221
takeda wrote: post #204

Earlier quoted context omitted.

If you think of it as a state sponsored attack it makes a lot of sense to have a "secure" vulnerability in system that your own citizens might use. It looks like the whole contribution to xz was an effort to just inject that backdoor. For example the author created the whole test framework where he could hide the malicious payload. Before he started work on xz, he made contribution to libarchive in BSD which created…

The libarchive diff didn't create any vulnerability. The fprintf calls were consistent with others in the same repository.

They still preferred to revert it as it looks very suspicious.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068047

https://github.com/libarchive/libarchive/pull/2101

Post reply on HN