Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

391–400 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#391

Post by dxthrwy856 »

The parallels in this one to the audacity event a couple years back are ridiculous.

Cookie guy claimed that he got stabbed and that the federal police was involved in the case, which kind of hints that the events were connected to much bigger actors than just 4chan. At the time a lot of people thought its just Muse Group that's involved, but maybe it was a (Russian) state actor?

Because before that he claimed that audacity had lots of telemetry/backdoors which were the reason he forked and removed in his first commits. Maybe audacity is backdoored after all?

Have to check the audacity source code now.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#392

Post by [deleted] »

timmytokyo wrote: post #132
Alifatisk wrote: post #18

Earlier quoted context omitted.

For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.

I'm not sure why everyone is 100% sure this was a state-sponsored security breach. I agree that it's more likely than not state-sponsored, but I can imagine all sorts of other groups who would have an interest in something like this, organized crime in particular. Imagine how many banks or crypto wallets they could break into with a RCE this pervasive.

[deleted]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#393

Post by CommitSyn »

justinclift wrote: post #323
halJordan wrote: post #229

Earlier quoted context omitted.

This is not that concept. That concept is no one but us can technically complete the exploit. Technical feasibility in that you need a supercomputer to do it, not protecting a backdoor with the normal cia triad

That doesn't seem correct: If they determine the vulnerability is only exploitable by the NSA for reasons such as computational resources, budget, or skill set, they label it as NOBUS and will not move to patch it, but rather leave it open to exploit against current or future targets. If (!) the NSA regards ssh keys as secure, then from that article it sounds like the NOBUS thing would fit.

That would only fit "If (!) the NSA regards ssh keys as secure >for everyone but them<

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#394

Post by CommitSyn »

dxthrwy856 wrote: post #391

The parallels in this one to the audacity event a couple years back are ridiculous. Cookie guy claimed that he got stabbed and that the federal police was involved in the case, which kind of hints that the events were connected to much bigger actors than just 4chan. At the time a lot of people thought its just Muse Group that's involved, but maybe it was a (Russian) state actor? Because before that he claimed that au…

Cookie guy?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#395

Post by whirlwin »

asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

Imagine how much the private key is worth on the black market

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#396

Post by withinboredom »

bilekas wrote: post #379

This whole thing has been consuming me over the whole weekend. The mechanisms are interesting and a collection of great obfuscations, the social engineering is a story that’s shamefully all too familiar for open source maintainers. I find most interesting how they chose their attack vector of using BAD test data, it makes the rest of the steps incredibly easier when you have a good archive, manipulate it in a structu…

It’s got me suspicious of build-time dependency we have in an open source tool, where the dependency goes out of its way to prefer xz and we even discovered that it installs xz on the host machine if it isn’t already installed — as a convenience. Kinda weird because it didn’t do that for any other dependencies.

These long-games are kinda scary and until whatever “evil” is actually done you have no idea what is actually malicious or just weird.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#397

Post by gghffguhvc »

bawolff wrote: post #227
gghffguhvc wrote: post #97

Earlier quoted context omitted.

Even with the MIT disclaimer and the author not being the distributor or have any relationship with the distributor. Publishing vulnerable open source software to GitHub with a disclaimer that says it isn’t fit for any purpose seems like a bit of an oversight of using MIT license in distros to me.

That is not how disclaimers work. You cannot disclaim liability for intentionally harming someone. You also cannot avoid criminal charges for a crime simply by shouting "don't blame me"

I did setup the question in a way that the developer doesn’t harm someone themselves but sells it to a state actor. I.e extremely similar outcome to finding a zero day and selling it to a state actor except it is “more” secure - need private key.

The point about MIT is that they are saying to the world when publishing “as is” folks. Not claiming I haven’t backdoored it for Uncle Sam.in fact I’m not claiming anything, use at your own risk.

It used to be the law to implicitly do this by weak encryption for exports.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#398

Post by EasyMark »

This whole thing makes me wonder if AI could detect "anomalies" like the human who found the actual hack did. Observe a system (lots of systems) and use that data to spot anomylous behavior from "new" versions of packages being added, throw up a red flag that is like "this really doesn't act like it did in the past because parameter(s) are unusual given previous versions"

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#399

Post by bayindirh »

asveikau wrote: post #10

It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.

It's a (failed) case study in "what if we backdoor it in a way only good guys can use but bad guys can't?"

Computers don't know who's / what's good or bad. They're deterministic machines which responds to commands.

I don't know whether there'll be any clues about who did this, but this will be the poster child of "you can't have backdoors and security in a single system" argument (which I strongly support).

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#400

Post by [deleted] »

kstrauser wrote: post #249
shp0ngle wrote: post #236

Earlier quoted context omitted.

CIA didn't put anyone new into gitmo for years. The 30 remaining gitmo prisoners are all W Bush holdovers that all subsequent administrations forgot.

Conspiracy theorist: That's what they want you to believe. And in fairness, the whole nature of their secrecy means there's no way to know for sure. It might be just a boogeyman kept around as a useful tool for scaring people into not breaking national security-level laws. I mean, it's not as though I want to go around hacking the planet, but the idea of ending up at a CIA "black site", assuming such things even exis…

[deleted]
Post reply on HN