Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

461–470 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#461

Post by xign »

cgh wrote: post #368

Comment I saw on Ars: >Interestingly enough, "Jia Tan" is very close to 加蛋 in Mandarin, meaning "to add an egg". Unlikely to be a real name or a coincidence.

Jia Tan is absolute a possible real name. Most people commenting on this topic aren't even Chinese native speakers lol. Each pinyin can map to a lot of different Chinese characters because they are missing the tone of the character anyway.

Tan is a real Chinese surname, and could be mandarin or hokkien.

Either way the name is likely made up. Obviously the attacker wasn't going to just use their real names.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#463

Post by racingmars »

daymanstep wrote: post #449
waihtis wrote: post #443

Earlier quoted context omitted.

pretty unhealthy attitude to live by tbh. almost better being burned by a malicious payload once every 10 years than live in perpetual fear of being constantly scammed

I think that depends on the context. If you're maintaining one of the most widely used packages that is directly linked to by libsystemd and is included by pretty much every Linux distro as part of the base system? Then maybe some measure of paranoia is justified. I think the OpenBSD developers are right to be as paranoid as they are. Anyone who is maintaining a security critical system should be on guard against the…

> If you're maintaining one of the most widely used packages that is directly linked to by libsystemd and is included by pretty much every Linux distro as part of the base system? Then maybe some measure of paranoia is justified.

But whose problem is that? systemd chose to link against liblzma, not the other way around. I doubt the xz maintainer(s) make money off of the project, and I'm assuming it's a spare-time/side-project type thing. Why should the fact that the library is included in every distro and is a dependency of systemd affect the xz maintainers' obligations? The leader of systemd has been variously employed by RedHat and Microsoft... if they're choosing to pull in an external dependency for systemd and then making money off of selling their Linux distros/cloud services, it would seem they're the ones that could afford to take on the burden of reviewing everything with a fine-toothed comb, not the xz maintaners.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#464

Post by NarcissistDev »

racingmars wrote: post #463
daymanstep wrote: post #449

Earlier quoted context omitted.

I think that depends on the context. If you're maintaining one of the most widely used packages that is directly linked to by libsystemd and is included by pretty much every Linux distro as part of the base system? Then maybe some measure of paranoia is justified. I think the OpenBSD developers are right to be as paranoid as they are. Anyone who is maintaining a security critical system should be on guard against the…

> If you're maintaining one of the most widely used packages that is directly linked to by libsystemd and is included by pretty much every Linux distro as part of the base system? Then maybe some measure of paranoia is justified. But whose problem is that? systemd chose to link against liblzma, not the other way around. I doubt the xz maintainer(s) make money off of the project, and I'm assuming it's a spare-time/sid…

I like your thinking. Absolutely. And very true. Even the folk who put the backdoor in will be getting paid. Everybody making bank, except Lasse.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#465

Post by [deleted] »

daymanstep wrote: post #449
waihtis wrote: post #443

Earlier quoted context omitted.

pretty unhealthy attitude to live by tbh. almost better being burned by a malicious payload once every 10 years than live in perpetual fear of being constantly scammed

I think that depends on the context. If you're maintaining one of the most widely used packages that is directly linked to by libsystemd and is included by pretty much every Linux distro as part of the base system? Then maybe some measure of paranoia is justified. I think the OpenBSD developers are right to be as paranoid as they are. Anyone who is maintaining a security critical system should be on guard against the…

[deleted]

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#466

Post by NarcissistDev »

waihtis wrote: post #450
daymanstep wrote: post #449

Earlier quoted context omitted.

I think that depends on the context. If you're maintaining one of the most widely used packages that is directly linked to by libsystemd and is included by pretty much every Linux distro as part of the base system? Then maybe some measure of paranoia is justified. I think the OpenBSD developers are right to be as paranoid as they are. Anyone who is maintaining a security critical system should be on guard against the…

Oh absolutely true for things like OpenBSD and such

Thing is, sec should be taken seriously across the board. I love what OpenBSD devs did - they seen an entire community of naive coders who didn’t give much of a crap about security and started something. I have used OpenBSD for 10 years and thoroughly recommend it to anyone to give you a good slap around the face for how shit is done right.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#467

Post by dxthrwy856 »

cookiengineer wrote: post #401
dxthrwy856 wrote: post #391

The parallels in this one to the audacity event a couple years back are ridiculous. Cookie guy claimed that he got stabbed and that the federal police was involved in the case, which kind of hints that the events were connected to much bigger actors than just 4chan. At the time a lot of people thought its just Muse Group that's involved, but maybe it was a (Russian) state actor? Because before that he claimed that au…

Careful, APT28 is pretty dangerous. They are merging their ops with APT29 these days, and I wouldn't wake the cozy bear if I were you.

So it was a state level actor that organized the doxxing campaign?

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#468

Post by waihtis »

NarcissistDev wrote: post #466
waihtis wrote: post #450

Earlier quoted context omitted.

Oh absolutely true for things like OpenBSD and such

Thing is, sec should be taken seriously across the board. I love what OpenBSD devs did - they seen an entire community of naive coders who didn’t give much of a crap about security and started something. I have used OpenBSD for 10 years and thoroughly recommend it to anyone to give you a good slap around the face for how shit is done right.

I sort of agree, I think we should collectively raise the level of paranoia slight, by some tens of percentages, to remove a lot of negative outcomes - but I wouldn't expect off-hand hobby devs to even remotely apply the same level of risk management as OpenBSD does.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#469

Post by saagarjha »

lyu07282 wrote: post #118
Alifatisk wrote: post #18

Earlier quoted context omitted.

For real, it's almost like a state-sponsored exploit. It's crafted and executed incredibly well, the performance issue feels like pure luck it got found.

one question I still have is what exactly the performance issue was? I heard it might be related to enumeration of shared libraries, decoding of the scrambled strings[1], etc. anyone know for sure yet? one other point for investigation is if the code is similar to any other known implants? like the way it obfuscates strings, the way it detects debuggers, the way its setting up a vtable, there might be code fragments…

It's the symbol lookup that's slow.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#470

Post by saagarjha »

NarcissistDev wrote: post #430
j16sdiz wrote: post #405

Earlier quoted context omitted.

By whom? The attacker have assumed the maintainer role. Nobody is reviewing.

There’s a severe and dangerous lack of paranoia in this dev space. If I was letting someone maintain my codebase, I would 1 Billion percent be reviewing everything… if there was a binary added, I’d be building it myself and comparing the checksums. Trust absolutely no-one. If you can give a close friend or a loved one a loan of money and it is so easy for them to never pay you back, it should be a reminder that devs…

What's the point of having someone maintain your codebase if you have to do even more work than if you just did everything yourself?
Post reply on HN