Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

371–380 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#371

Post by parl_match »

juitpykyk wrote: post #295
declan_roberts wrote: post #87

Earlier quoted context omitted.

I agree that this is probably about persistence. Initially I thought the developer was playing the long-con to dump some crypto exchange and make off with literally a billion dollars or more. But if that was the case they wouldn't bother with the key. It'd be a one-and-done situation. It would be a stop-the-world event. Now it looks more like nation-state spycraft.

You're talking as if securing a backdoor with public cryptography is some unimaginable feat of technology. It's literally a couple hours work.

Inserting a change like this as a one off would cause lots of scrutiny, which would probably get it detected. Instead, the bad actor spent years contributing to the project before dropping this.

So, while writing the exploit might be a couple of hours work, actually pulling it off is quite a bit more difficult.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#372

Post by db48x »

jeroenhd wrote: post #337
croemer wrote: post #312

Earlier quoted context omitted.

Jia Tan's GitHub activity was mostly 10-18@UTC, consistent with Europe/Israel/Russia

It's rather trivial to fake git commits. Basing this stuff on email times (especially replies to emails sent that same day) would be more relevant. However. if this operation was pulled off with the precision and opsec that it seems to have been, I wouldn't be too surprised if whatever group is behind this attack would've sent over + funded a developer somewhere in a time zone of their choice. No doubt any nation sta…

The git timestamps in the git commits probably were faked, but they implicate China. There were a handful of apparent slippups though, and if we take those timestamps to be correct then it looks like they were in eastern Europe (or possibly Finland, the Baltics, or the Mediterranean coast all the way down to Egypt). And if we instead assume that these timestamps are a second–level misdirection then there is a huge complexity penalty; my money is on the simpler answer (but not all my money; it’s not a sure bet).

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#373

Post by db48x »

bawolff wrote: post #275
Voultapher wrote: post #241

Earlier quoted context omitted.

NSO Group They are an Israel based company, that sell zero-click RCEs for phones and more. Such malicious software was involved in the murder of journalist Jamal Khashoggi. Their exploits, developed in-house as well as presumably partially bought on the black market, are some of the most sophisticated exploits found in the wild, e.g. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... > JBIG2 doesn't have…

> that sell zero-click RCEs Exactly my point. They do not sell backdoors. Don't get me wrong, still icky, but definitely not a "very well engineered, multi-year software backdoors"

I’m not sure why you’re making that point; the exploit we are talking about _is_ an RCE.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#374

Post by Taniwha »

asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

I wonder if anyone has packet logs from the past few weeks that show attempts at sshd - might be some incriminating IP addresses to start hunting with

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#375

Post by bawolff »

db48x wrote: post #373
bawolff wrote: post #275

Earlier quoted context omitted.

> that sell zero-click RCEs Exactly my point. They do not sell backdoors. Don't get me wrong, still icky, but definitely not a "very well engineered, multi-year software backdoors"

I’m not sure why you’re making that point; the exploit we are talking about _is_ an RCE.

The person i was replying to claimed that countries like usa rely on hardware modification while countries like israel rely on back-doors. This does not seem to be the case. Israel doesn't (or at least hasn't been caught) making backdoors, while the usa actually has (e.g. Dual_EG).

RCE is a broad category and includes many things. That said, while technically the liblzma thing is an RCE, supply chain attacks aren't really what most people mean when they talk about an RCE vulnerability.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#376

Post by picture »

cgh wrote: post #368

Comment I saw on Ars: >Interestingly enough, "Jia Tan" is very close to 加蛋 in Mandarin, meaning "to add an egg". Unlikely to be a real name or a coincidence.

Jia Tan could mean literally anything as pinyin since it doesn't have diacritics for tone. 嘉坛 (Jiā tán) could be a totally plausible name, and so could 佳檀 (also Jiā tán). Chinese names can largely use any character that doesn't come with a really bad meaning

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#377

Post by klabb3 »

croemer wrote: post #312
declan_roberts wrote: post #77

One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA. Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.

Jia Tan's GitHub activity was mostly 10-18@UTC, consistent with Europe/Israel/Russia

Thanks, i was wondering about this since day 0 and was too lazy to look it up. Yes it can be spoofed, but I imagine a good chunk of day-to-day is work is semi-interactive, which would make it preferable to have the attacker be in the same tz as the victims. Anyone know what tz Lasse was at? If not (eg he’s in the US), then I’d say Occam’s razor that the attacker is working those UTC 10-18 office hours without extra steps. Tz proves nothing and for a 3y low-intensity operation I’d just assume the attacker won’t introduce that much friction only to mislead. I’m sure there are much stronger signals in the investigation work that’s going on now. Unfortunately, given the hush-hush-by-default nature of our beloved intel agencies, we’ll probably never know.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#378

Post by justinclift »

unkulunkulu wrote: post #351
justinclift wrote: post #319

Earlier quoted context omitted.

It'll be kind of tragic if this backdoor turns out to be the developer's pet "enable remote debugging" code, and they didn't mean for it to get out into a release. ;)

I would be scared to work near a person who writes his debugging tools this way :D

Heh Heh Heh

"It seemed like a good idea at the time" is a pretty common story though. ;)

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#379

Post by bilekas »

This whole thing has been consuming me over the whole weekend. The mechanisms are interesting and a collection of great obfuscations, the social engineering is a story that’s shamefully all too familiar for open source maintainers.

I find most interesting how they chose their attack vector of using BAD test data, it makes the rest of the steps incredibly easier when you have a good archive, manipulate it in a structured method (this should show on a graph of the binary pattern btw for future reference) then use it for a fuzzy bad data test. It’s great.

The rest of the techniques are banal enough except the most brilliant move seems to be that they could add “patches” or even whole new back doors using the same pattern on a different test file. Without being noticed.

Really really interesting, GitHub shouldn’t have hidden and removed the repo though. It’s not helpful at all to work through this whole drama.

Edit: I don’t mean to say this is banal in any way, but once the payload was decided and achieved through a super clever idea, the rest was just great obfuscation.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#380

Post by seattle_spring »

bawolff wrote: post #227
gghffguhvc wrote: post #97

Earlier quoted context omitted.

Even with the MIT disclaimer and the author not being the distributor or have any relationship with the distributor. Publishing vulnerable open source software to GitHub with a disclaimer that says it isn’t fit for any purpose seems like a bit of an oversight of using MIT license in distros to me.

That is not how disclaimers work. You cannot disclaim liability for intentionally harming someone. You also cannot avoid criminal charges for a crime simply by shouting "don't blame me"

There's a great South Park episode about this, titled "Human CentiPad." Not for the squeamish.
Post reply on HN