Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

381–390 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#381

Post by bdowling »

barkingcat wrote: post #269
yread wrote: post #254

Earlier quoted context omitted.

Maybe they weren't all sockpuppets. Here Jigar Kumar was nitpicking Jia Tan's changes: https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.h... That was not necessary to gain trust. Writing style is different, too. Later when Jia gained commit access he reminds him to merge it.

that's precisely what sock puppetry does ... talk/write in a different writing style to make others believe it's different people.

For all we know there is a whole cyber-squadron (or whatever their military units are called) behind Jia Tan and other accounts.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#382

Post by masklinn »

acid__ wrote: post #310
AlexCoventry wrote: post #130

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Tailored_Access_Operations

Be sure to check out the mentioned catalog. [1] The NSA's capabilities back in 2008 were pretty astonishing: "RAGEMASTER" A $30 device that taps a VGA cable and transmits the contents of your screen to the NSA van sitting outside! Crazy stuff. Makes you wonder what they've built in the last 15 years. [1] https://en.wikipedia.org/wiki/ANT_catalog

Today you’ve got open access USB cable which can stream your shit out on WiFi, no doubt the NSA has worse.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#383

Post by mondrian »

bilekas wrote: post #379

This whole thing has been consuming me over the whole weekend. The mechanisms are interesting and a collection of great obfuscations, the social engineering is a story that’s shamefully all too familiar for open source maintainers. I find most interesting how they chose their attack vector of using BAD test data, it makes the rest of the steps incredibly easier when you have a good archive, manipulate it in a structu…

A main culprit seems to be the addition of binary files to the repo, to be used as test inputs. Especially if these files are “binary garbage” to prove a test fails. Seems like an obvious place to hide malicious stuff.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#384

Post by metrxqin »

btown wrote: post #163
declan_roberts wrote: post #87

Earlier quoted context omitted.

I agree that this is probably about persistence. Initially I thought the developer was playing the long-con to dump some crypto exchange and make off with literally a billion dollars or more. But if that was the case they wouldn't bother with the key. It'd be a one-and-done situation. It would be a stop-the-world event. Now it looks more like nation-state spycraft.

It's worth also noting that the spycraft involved a coordinated harassment campaign of the original maintainer, with multiple writing styles, to accelerate a transition of maintainership to the attacker: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.h... While this doesn't prove…

I'm literally shocked by the conversations in the mail-list, it's blatantly an exploitation of others' kindness.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#385

Post by bilekas »

mondrian wrote: post #383
bilekas wrote: post #379

This whole thing has been consuming me over the whole weekend. The mechanisms are interesting and a collection of great obfuscations, the social engineering is a story that’s shamefully all too familiar for open source maintainers. I find most interesting how they chose their attack vector of using BAD test data, it makes the rest of the steps incredibly easier when you have a good archive, manipulate it in a structu…

A main culprit seems to be the addition of binary files to the repo, to be used as test inputs. Especially if these files are “binary garbage” to prove a test fails. Seems like an obvious place to hide malicious stuff.

It is an obvious place for sure, but it also would have been picked up if the builds where a bit more transperant. That batch build script should have been questioned before approval.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#386

Post by cjbprime »

anonymous-panda wrote: post #262
cjbprime wrote: post #8

Earlier quoted context omitted.

Probing for vulnerable deployments over the network (without the attacker's private key) seems impossible, not non-trivial. The best one could do is more micro-benchmarking, but for an arbitrary Internet host you aren't going to know whether it's slow because it's vulnerable, or because it's far away, or because the computer's slow in general -- you don't have access to how long connection attempts to that host took…

Should be able to do it by having the scanner take multiple samples. As long as you don’t need a valid login and the performance issue is still observable, you should be about to scan for it with minimal cost

Looks like the slowdown is actually at sshd process startup time, not authentication time. So it's back to being completely impossible to network-probe for.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#387

Post by jeltz »

mistrial9 wrote: post #294
est31 wrote: post #59

Earlier quoted context omitted.

I doubt that if Google detected it with some internal tool, they'd reach out to Microsoft to hide their contribution. It was reported by an MS engineer who happens to be involved in another OSS project. MS is doing business with the US intelligence community, for example there is the Skype story: First, rumors that NSA offers a lot of money for people who can break Skype's E2E encryption, then MS buys Skype, then MS…

> an MS engineer no this engineer is world-known for being core PostgreSQL, a team with high standards.. unlike that company you mention

He is also one of the sharpest developers I have had the fortune to speak to (and do some minor work with on the mailing list) and he knows a lot about performance and profiling. I 100% think that he found it on his own. He would also be an odd choice for Microsoft to pick since I doubt he works anywhere close to any of their security teams (unless they went through some serious lengths to find just the guy where it would be 100% believable that he just stumbled on it).

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#388

Post by AnotherGoodName »

picture wrote: post #376
cgh wrote: post #368

Comment I saw on Ars: >Interestingly enough, "Jia Tan" is very close to 加蛋 in Mandarin, meaning "to add an egg". Unlikely to be a real name or a coincidence.

Jia Tan could mean literally anything as pinyin since it doesn't have diacritics for tone. 嘉坛 (Jiā tán) could be a totally plausible name, and so could 佳檀 (also Jiā tán). Chinese names can largely use any character that doesn't come with a really bad meaning

Yeah a quick Google brings up lots of real Jia Tans who clearly aren't behind this and hopefully aren't being wrongly accused here. But it is clearly a real and common name.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#390

Post by shp0ngle »

AnotherGoodName wrote: post #388
picture wrote: post #376

Earlier quoted context omitted.

Jia Tan could mean literally anything as pinyin since it doesn't have diacritics for tone. 嘉坛 (Jiā tán) could be a totally plausible name, and so could 佳檀 (also Jiā tán). Chinese names can largely use any character that doesn't come with a really bad meaning

Yeah a quick Google brings up lots of real Jia Tans who clearly aren't behind this and hopefully aren't being wrongly accused here. But it is clearly a real and common name.

As other poster said, Chinese has diacritics that got usually removed when put into English websites
Post reply on HN