431–440 of 500 posts
It's pretty interesting that they didn't just introduce an RCE that anyone can exploit, it requires the attacker's private key. It's ironically a very security conscious vulnerability.
I suspect the original rationale is about preserving the longevity of the backdoor. If you blow a hole wide open that anyone can enter, it’s going to be found and shut down quickly. If this hadn’t had the performance impact that brought it quickly to the surface, it’s possible that this would have lived quietly for a long time exactly because it’s not widely exploitable.
Earlier quoted context omitted.
Jia Tan's GitHub activity was mostly 10-18@UTC, consistent with Europe/Israel/Russia
It's rather trivial to fake git commits. Basing this stuff on email times (especially replies to emails sent that same day) would be more relevant. However. if this operation was pulled off with the precision and opsec that it seems to have been, I wouldn't be too surprised if whatever group is behind this attack would've sent over + funded a developer somewhere in a time zone of their choice. No doubt any nation sta…
See the writeup here: https://til.simonwillison.net/clickhouse/github-explorer
Earlier quoted context omitted.
Chaining multiple different login system can make sense. A more sensible solution over port knocking would be an alternative sshd implementation with a tunnel to the second sshd implementation. Naturally the first one should not run as root (similar to the port knocking daemon). That way it would not be in clear text, and the number of bits of security will be order of magnitude larger even with very simple password.…
Chaining login methods would not help if the outermost login method is backdoored with an RCE.
Building security in depth correctly is not simple. It takes work to construct layers so that one compromised layer do not cause whole system failure.
Earlier quoted context omitted.
Yeah, but then you would have ssh traffic without a matching login. Wonder if any anomaly detection would work on that
That would look the same as a random failed ssh login, which happens all the time. The connection isn't maintained past that point (unless the payload chooses to do so).
Earlier quoted context omitted.
Jia Tan's GitHub activity was mostly 10-18@UTC, consistent with Europe/Israel/Russia
Thanks, i was wondering about this since day 0 and was too lazy to look it up. Yes it can be spoofed, but I imagine a good chunk of day-to-day is work is semi-interactive, which would make it preferable to have the attacker be in the same tz as the victims. Anyone know what tz Lasse was at? If not (eg he’s in the US), then I’d say Occam’s razor that the attacker is working those UTC 10-18 office hours without extra s…
Earlier quoted context omitted.
That doesn't seem correct: If they determine the vulnerability is only exploitable by the NSA for reasons such as computational resources, budget, or skill set, they label it as NOBUS and will not move to patch it, but rather leave it open to exploit against current or future targets. If (!) the NSA regards ssh keys as secure, then from that article it sounds like the NOBUS thing would fit.
That would only fit "If (!) the NSA regards ssh keys as secure >for everyone but them<
If they didn't have the key though, then yeah it doesn't fit. Unless they can walk through ssh key security anyway. :)
Earlier quoted context omitted.
Jia Tan's GitHub activity was mostly 10-18@UTC, consistent with Europe/Israel/Russia
Thanks, i was wondering about this since day 0 and was too lazy to look it up. Yes it can be spoofed, but I imagine a good chunk of day-to-day is work is semi-interactive, which would make it preferable to have the attacker be in the same tz as the victims. Anyone know what tz Lasse was at? If not (eg he’s in the US), then I’d say Occam’s razor that the attacker is working those UTC 10-18 office hours without extra s…
Earlier quoted context omitted.
For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.
I'm not sure why everyone is 100% sure this was a state-sponsored security breach. I agree that it's more likely than not state-sponsored, but I can imagine all sorts of other groups who would have an interest in something like this, organized crime in particular. Imagine how many banks or crypto wallets they could break into with a RCE this pervasive.
That said it's a lot of work - 2 years at least. It's an exploit that's so good that you'd have to use incredibly carefully - also because if/when it's discovered it's going to break everywhere.
I've read descriptions about how the NSA (and presumably other such agencies) and they're really careful. The first job is to make sure the target doesn't get confirmation that they are in fact a target. The second is that they always cover their tracks so the target doesn't know they were a target.
Criminals tend to do the first but almost never the second so a tool like this - while I'm sure they would love - isn't worth the amount of work it would take to develop.
Again - I'm not 100% on this but ... 40% ? say 20% criminals, 10% lone wolf?