Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

321–330 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#321

Post by heavyset_go »

declan_roberts wrote: post #87
haswell wrote: post #16

Earlier quoted context omitted.

I suspect the original rationale is about preserving the longevity of the backdoor. If you blow a hole wide open that anyone can enter, it’s going to be found and shut down quickly. If this hadn’t had the performance impact that brought it quickly to the surface, it’s possible that this would have lived quietly for a long time exactly because it’s not widely exploitable.

I agree that this is probably about persistence. Initially I thought the developer was playing the long-con to dump some crypto exchange and make off with literally a billion dollars or more. But if that was the case they wouldn't bother with the key. It'd be a one-and-done situation. It would be a stop-the-world event. Now it looks more like nation-state spycraft.

> Now it looks more like nation-state spycraft.

I disagree, plenty of exploits implemented WireGuard-like crypto key access to them.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#322

Post by est31 »

mistrial9 wrote: post #294
est31 wrote: post #59

Earlier quoted context omitted.

I doubt that if Google detected it with some internal tool, they'd reach out to Microsoft to hide their contribution. It was reported by an MS engineer who happens to be involved in another OSS project. MS is doing business with the US intelligence community, for example there is the Skype story: First, rumors that NSA offers a lot of money for people who can break Skype's E2E encryption, then MS buys Skype, then MS…

> an MS engineer no this engineer is world-known for being core PostgreSQL, a team with high standards.. unlike that company you mention

Yeah definitely, good point. I got that wrong above: He is in fact a postgres contributor who happens to be MS employee and not an MS employee who happens to be a postgres contributor.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#323

Post by justinclift »

halJordan wrote: post #229
cesarb wrote: post #136

Earlier quoted context omitted.

This is called NOBUS: https://en.wikipedia.org/wiki/NOBUS

This is not that concept. That concept is no one but us can technically complete the exploit. Technical feasibility in that you need a supercomputer to do it, not protecting a backdoor with the normal cia triad

That doesn't seem correct:

    If they determine the vulnerability is only exploitable by the NSA for reasons
    such as computational resources, budget, or skill set, they label it as NOBUS
    and will not move to patch it, but rather leave it open to exploit against current
    or future targets.
If (!) the NSA regards ssh keys as secure, then from that article it sounds like the NOBUS thing would fit.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#324

Post by KeplerBoy »

greyface- wrote: post #288
pama wrote: post #284

Earlier quoted context omitted.

You are talking about the greatest exposed hack of the computer supply chain so far by a big margin. Laws can be made retroactively for this type of thing. It has implications that are beyond the legal system, as the threat level is way beyond what is typically required as a sniff test for justifying military actions. This was not an RCE based on identifying negligent code; this was a carefully designed trap that cou…

> Laws can be made retroactively Not in the United States. https://constitution.congress.gov/browse/article-1/section-9...

Meh, these are potentially the kind of crimes where laws don't apply.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#325

Post by drpixie »

belorn wrote: post #160
dec0dedab0de wrote: post #36

Stuff like this is why I like port knocking, and limiting access to specific client IPs/networks when possible. 20 years ago, I was working at an ISP/Telco and one of our vendors had a permanent admin account hardcoded on their gear, you couldn't change the password and it didn't log access, or show up as an active user session. Always limit traffic to just what is necessary, does the entire internet really need to b…

Rather than port knocking, I prefer IP knocking. The server has several ip addresses and once a correct sequence of connection is made, the ssh port opens. Since so few know about IP knocking, it much safer than port knocking. /s

Sounds like (another) good reason for IPv6 - your box can have many, very obscure addresses :)

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#326

Post by heavyset_go »

kbenson wrote: post #305
juitpykyk wrote: post #295

Earlier quoted context omitted.

You're talking as if securing a backdoor with public cryptography is some unimaginable feat of technology. It's literally a couple hours work.

I don't think they were using complexity as the reason for that assumption, but instead goals. Adding security doesn't require a nation state's level of resources, but it is a more attractive feature for a nation state that wants to preserve it over time and prevent adversaries from making use of it.

This makes sense in closed source products where you'll never get to audit the source for such exploits, but little sense in open source projects where anyone can audit it.

That's to say an enterprise router or switch would likely have secured exploits put there by corporate and national security agencies, whereas open source exploits would benefit from the probable deniability.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#327

Post by papascrubs »

webmaven wrote: post #111
Alifatisk wrote: post #18

Earlier quoted context omitted.

For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.

Was the performance issue pure luck? Or was it a subtle bit of sabotage by someone inside the attacking group worried about the implications of the capability? If it had been successfully and secretly deployed, this is the sort of thing that could make your leaders much more comfortable with starting a "limited war". There are shades of "Setec Astronomy" here.

Plot twist:

It was a psyop to increase the scrutiny around OSS components.

Kidding. Mostly...

But given the amount of scrutiny folks are going to start putting into some supply chains... Probably cheaper to execute than most company's annual security awareness budgets cost.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#328

Post by ryanmerket »

nialv7 wrote: post #91
asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

how are you going to sell it if anyone can get in?

this is probably the right answer. hacking group getting a 0day to sell to nation states on a per-use agreement.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#329

Post by est31 »

bevekspldnw wrote: post #193
est31 wrote: post #59

Earlier quoted context omitted.

I doubt that if Google detected it with some internal tool, they'd reach out to Microsoft to hide their contribution. It was reported by an MS engineer who happens to be involved in another OSS project. MS is doing business with the US intelligence community, for example there is the Skype story: First, rumors that NSA offers a lot of money for people who can break Skype's E2E encryption, then MS buys Skype, then MS…

“Even if it was the NSA, why would they hide that capability” Perhaps you’re not familiar with what NSA historically stood for: Never Say Anything.

Googling for "site:nsa.gov filetype:pdf" gives tens of thousands of results with documents produced by the NSA about various things (the google counter is known to lie but that's not my point). They do publish things.
Post reply on HN