Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

121–130 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#121

Post by sethherr »

timschmidt wrote: post #113
nick238 wrote: post #105

Earlier quoted context omitted.

I picture some division in [nation-state] where they're constantly creating personas, slowly working all sorts of languishing open source packages with few maintainers (this is the actual hard, very slow part), then once they have a bit of an in, they could recruit more technical expertise. The division is run by some evil genius who knows this could pay off big, but others are skeptical, so their resources are prett…

Moxie's reasons for disallowing Signal distribution via F-droid always rang a little flat to me ( https://github.com/signalapp/Signal-Android/issues/127 ). Lots of chatter about the supposedly superior security model of Google Play Store, and as a result fewer eyes independently building and testing the Signal code base. Everyone is entitled to their opinions, but independent and reproducible builds seem like a net p…

He says the decision not to distribute prebuilt APKs is because:

> if you aren't able to build TextSecure from source, you probably aren't capable of managing the risks associated with 3rd party sources.

Which is a compelling argument from my perspective. I also think that people who can’t compile code should probably not root their phone.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#122

Post by publius_0xf3 »

mkl wrote: post #5
MBCook wrote: post #2

Luckily, thanks to Elon, we’ll never know since you haven’t have a Twitter account to view the thread.

Change "twitter" to "twiiit" to get a random nitter instance: https://twiiit.com/bl4sty/status/1776691497506623562

Wow, it works. But it's not random, afaict. I keep getting the privacydev instance.

How do they keep theirs up and running?

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#123

Post by timschmidt »

sethherr wrote: post #121
timschmidt wrote: post #113

Earlier quoted context omitted.

Moxie's reasons for disallowing Signal distribution via F-droid always rang a little flat to me ( https://github.com/signalapp/Signal-Android/issues/127 ). Lots of chatter about the supposedly superior security model of Google Play Store, and as a result fewer eyes independently building and testing the Signal code base. Everyone is entitled to their opinions, but independent and reproducible builds seem like a net p…

He says the decision not to distribute prebuilt APKs is because: > if you aren't able to build TextSecure from source, you probably aren't capable of managing the risks associated with 3rd party sources. Which is a compelling argument from my perspective. I also think that people who can’t compile code should probably not root their phone.

That seems like a great way to talk down to your end users, which seems like a security smell all by itself. Many users of F-Droid are technology professionals themselves and are quite aware of the security implications of the choices they make for the devices they own, and F-Droid is often a component of that outlook.

Further, I don't think it applies to the F-Droid maintainers, who routinely build hundreds of different Android apps for all our benefit. They even directly addressed his concerns about the signing key(s) and other issues by improving F-Droid and met with continued rejection.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#124

Post by devcpp »

breadwinner wrote: post #62
xorvoid wrote: post #7

Earlier quoted context omitted.

Maybe I’m just being naive or too trusting, but this is sort of what I think when folks are getting worried about other backdoors like this in the wild. Is it that they just got unlucky to get caught, or is this type of attack just too hard to pull off in practice? I’d like to think the later. But, we really don’t know.

They could have covered tracks better. So says Andres Freund, the person who discovered the backdoor: https://news.ycombinator.com/item?id=39923467

Note he's not a cybersecurity researcher, he's mostly a database engineer (a great one, making significant PGSQL contributions), so I'm not sure he's familiar with statistics and variety of backdoor attempts.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#125

Post by asveikau »

nick238 wrote: post #105
asveikau wrote: post #98

Earlier quoted context omitted.

Modifying the sshd behavior without crashes seems by itself pretty difficult. I mean, conceptually it isn't hard, if you are in the same process and can patch various functions, but I think doing so and having it be "production ready" to ship in multiple linux distros all the time is a challenge. This thing wasn't around for very long but yet another thing to consider would be to keep it working across multiple versi…

I picture some division in [nation-state] where they're constantly creating personas, slowly working all sorts of languishing open source packages with few maintainers (this is the actual hard, very slow part), then once they have a bit of an in, they could recruit more technical expertise. The division is run by some evil genius who knows this could pay off big, but others are skeptical, so their resources are prett…

I don't think we should assume a state actor. We don't know.

It's kind of similar to stuxnet but attacking Linux distros is so broad and has such a huge risk of being exposed, as it was within a few weeks of deployment. A good nation state attack would put more effort into not being caught.

But we don't know. So maybe I'm wrong.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#126

Post by ckcheng »

bilekas wrote: post #43
aeyes wrote: post #40

Earlier quoted context omitted.

Short summary is that it allows auth bypass, not just RCE.

Yes, I understand.. It's just not a surprise.

It was surprising because previously we had:

'XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."' [0].

[0]: https://news.ycombinator.com/item?id=39877267 (811 comments)

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#127

Post by hinkley »

versteegen wrote: post #89
dabbledabble wrote: post #72

Earlier quoted context omitted.

It’s also possible that this could be a change in personnel. Maybe the one who earned trust and took over was no more working for them. And an amateur took over with tight deadlines that lead to this gaffe for them.

The abrupt change in time-of-day when commits occurred supports the theory that Jai Tan is more than one person: https://twitter.com/birchb0y/status/1773871381890924872

If the mistakes align with the time of day change, perhaps the author had a distraction that pushed the hours and compromised judgement.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#129

Post by db48x »

chrismartin wrote: post #100
db48x wrote: post #90

Earlier quoted context omitted.

What’s to discuss? Nothing is known about him.

There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdo... .) A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".

Like I said, we don't know anything worth having a real discussion about. Maybe he was in the +03 time zone, and pretending to be in +08, but that's not enough to base a discussion on.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#130

Post by hinkley »

lyu07282 wrote: post #41
xorvoid wrote: post #7

Earlier quoted context omitted.

Maybe I’m just being naive or too trusting, but this is sort of what I think when folks are getting worried about other backdoors like this in the wild. Is it that they just got unlucky to get caught, or is this type of attack just too hard to pull off in practice? I’d like to think the later. But, we really don’t know.

One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane technical details. This may be confirmed by regular vulnerabilities that are found in sometimes many decades old software, since vulnerabilities are much harder to find than backdoors. For example shellshock was 30 year old code, PwnKit 12 and log4j was ~10 ish. So…

I’m not convinced that if I found a bug that I’d notice all the security implications of fixing it. Occasionally yes, but I wonder how many people have closed back doors just by fixing robustness issues and not appreciated how big of a bug they found.
Post reply on HN