Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

291–300 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#291

Post by selfmodruntime »

slaymaker1907 wrote: post #220
pixl97 wrote: post #32

Earlier quoted context omitted.

So who's started scanning open source lib test cases for more stuff like this?

I think it would help to try and secure signing infrastructure as much as possible. First of all, try to have 3 devs for any given project (this is the most difficult step). Make sure logging into or changing any of the signing stuff requires at least 2 of the devs, one to initiate the JIT and one to monitor. Additionally, take supply chain steps like requiring independent approval for PRs and requiring the signing p…

All this riffraff and OSS maintainers basically work for free.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#292

Post by kstrauser »

bawolff wrote: post #273
kstrauser wrote: post #258

Earlier quoted context omitted.

That's exactly right. Imagine a license that said "...and I can come to your house and kill you if I want to." Even if someone signed it in ink and mailed a copy back, the licensor still can't go to their house and kill them even though the agreement says they can. I can imagine the case of maybe a "King of the Hill"-type game played on bare hardware, where you're actively trying to hack into and destroy other player…

> For a real world analogy, if you go skydiving, and you sign an injury against waiver, and you get hurt out of pure dumb luck and not negligence, good luck suing anyone for that. You jumped out of a plane. What did you think might happen? But if you walk into a McDonald's and fall through the floor into a basement and break your leg, no number of "not responsible for accidents" signs on the walls would keep them fro…

I use to go to the In-N-Out in Oakland that just closed. That was a possibility, believe me.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#293

Post by formerly_proven »

pama wrote: post #278
gowld wrote: post #202

Earlier quoted context omitted.

OpenSSH and Linux were not targeted/affected. xz and the Debian distribtion of OpenSSH were targeted.

The core source of the vulnerability (symbol lookup order allowing a dependency to preempt a function) might theoretically be fixed at the Linux+OpenSSH level.

Damien Miller (OpenSSH maintainer, OpenBSD committer) has written a patch that implements the relevant libsystemd functionality without libsystemd: https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#294

Post by mistrial9 »

est31 wrote: post #59
stingraycharles wrote: post #38

Earlier quoted context omitted.

I like the theory that actually, it wasn’t luck but was picked up on by detection tools of a large entity (Google / Microsoft / NSA / whatever), and they’re just presenting the story like this to keep their detection methods a secret. It’s what I would do.

I doubt that if Google detected it with some internal tool, they'd reach out to Microsoft to hide their contribution. It was reported by an MS engineer who happens to be involved in another OSS project. MS is doing business with the US intelligence community, for example there is the Skype story: First, rumors that NSA offers a lot of money for people who can break Skype's E2E encryption, then MS buys Skype, then MS…

> an MS engineer

no this engineer is world-known for being core PostgreSQL, a team with high standards.. unlike that company you mention

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#295

Post by juitpykyk »

declan_roberts wrote: post #87
haswell wrote: post #16

Earlier quoted context omitted.

I suspect the original rationale is about preserving the longevity of the backdoor. If you blow a hole wide open that anyone can enter, it’s going to be found and shut down quickly. If this hadn’t had the performance impact that brought it quickly to the surface, it’s possible that this would have lived quietly for a long time exactly because it’s not widely exploitable.

I agree that this is probably about persistence. Initially I thought the developer was playing the long-con to dump some crypto exchange and make off with literally a billion dollars or more. But if that was the case they wouldn't bother with the key. It'd be a one-and-done situation. It would be a stop-the-world event. Now it looks more like nation-state spycraft.

You're talking as if securing a backdoor with public cryptography is some unimaginable feat of technology.

It's literally a couple hours work.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#296

Post by ajross »

stefan_ wrote: post #265
ajross wrote: post #153

Earlier quoted context omitted.

It's also worth pointing out, given the almost two years of seemingly valuable contribution, that this could be a real person who was compromised or coerced into pushing the exploit.

It’s also worth pointing out that parts of the RCE were prepared almost two years ago which makes this entirely implausible.

Were they? The attacker has had commit rights for 1.5 years or so, but my understanding is that all the exploit components were recent commits. Is that wrong?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#297

Post by bobby_the_whale »

formerly_proven wrote: post #293
pama wrote: post #278

Earlier quoted context omitted.

The core source of the vulnerability (symbol lookup order allowing a dependency to preempt a function) might theoretically be fixed at the Linux+OpenSSH level.

Damien Miller (OpenSSH maintainer, OpenBSD committer) has written a patch that implements the relevant libsystemd functionality without libsystemd: https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13

[dead]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#298

Post by Aloisius »

slaymaker1907 wrote: post #277
bawolff wrote: post #224

Earlier quoted context omitted.

I do not think any of that would have prevented this situation.

Upon further reading, I think you might be correct. I initially thought a good signing process would be sufficient since it sounded like this malicious blob was secretly being included in the tarball by the build server, but it instead seems to be the case that the malicious binary was included in the repo as a test file. You could probably still protect against this sort of attack using signing, but it would be much…

It was both. The binary object file was obfuscated in two "test" xz files in the repo itself. The code to extract the object file and inject it into the build process was only in the GitHub release tarball.

The code in the tarball could have been prevented if only automated tarballs were permitted (for instance, GitHub's branch/tag source tarballs) or caught after the fact by verifying the file hashes in the tarball against those in the repo.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#299

Post by TheBlight »

ufo wrote: post #205
TheBlight wrote: post #176

Earlier quoted context omitted.

It was found in a few weeks so why is it more likely it wouldn't have been noticed for months/years with more people running the backdoored version of the code?

We were lucky that the backdoor called attention to itself, because it impacted the performance off ssh and introduced valgrind warnings.

Doesn't that further suggest non-state actor(s)?
Post reply on HN