Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

github.com

Post reply on HN
Print view View original

491–500 of 500 posts

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#491

Post by acdha »

saagarjha wrote: post #472
acdha wrote: post #274

Earlier quoted context omitted.

Guard Duty does have some ptocees level monitoring with some recent additions: https://aws.amazon.com/blogs/aws/amazon-guardduty-ec2-runtim... The main thing I was thinking is that the audit hooking and especially runtime patching across modules (liblzma5 patching functions in the main sshd code block) seems like the kind of thing a generic behavioral profile could get but especially one driven by the fact that sshd…

This kind of thing is quite difficult to do generally, because it is very easy to bypass, has significant performance impact, and has low reliability to boot.

I’m not saying it’s trivial, but in this case couldn’t you basically do W^X and watch process startup for anomalous behavior? Monkey-patching other libraries’ code should be pretty uncommon.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#492

Post by pama »

int_19h wrote: post #487
greyface- wrote: post #288

Earlier quoted context omitted.

> Laws can be made retroactively Not in the United States. https://constitution.congress.gov/browse/article-1/section-9...

Ex post facto criminal liability is prohibited either constitutionally or by strong custom in most jurisdictions, and this is generally considered a fundamental part of having rule of law and due process. This is also spelled out in UDHR, ECHR, and several other similar documents.

Not sure it is worth spending any effort on this subject, however a ton of existing laws in almost any juristiction could be applied to this particular crime. I doubt the perpetrators would be caught, but I also doubt the punishment would be established via a legal system in a public setting anyways. Depending on what jurisdiction it is and who feels most compelled to punish them or not, it is possible they could be used as spies again for a different government. I wish I would be able to read the story behind the story eventually but I very much doubt it. The existence of a public key means there was in principle a way to verify the identity beyond doubt, though I don’t know how much longer this will be the case.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#493

Post by cookiengineer »

dxthrwy856 wrote: post #467
cookiengineer wrote: post #401

Earlier quoted context omitted.

Careful, APT28 is pretty dangerous. They are merging their ops with APT29 these days, and I wouldn't wake the cozy bear if I were you.

So it was a state level actor that organized the doxxing campaign?

Well, I've pivoted to cyber defense for a reason. The executives are hopelessly overwhelmed with anything related to APTs. In their minds, criminals want money and if there's no money to follow, they can't do squat about it.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#494

Post by saagarjha »

acdha wrote: post #491
saagarjha wrote: post #472

Earlier quoted context omitted.

This kind of thing is quite difficult to do generally, because it is very easy to bypass, has significant performance impact, and has low reliability to boot.

I’m not saying it’s trivial, but in this case couldn’t you basically do W^X and watch process startup for anomalous behavior? Monkey-patching other libraries’ code should be pretty uncommon.

That's not what liblzma is doing, it's patching GOT entries which are pure data.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#496

Post by account42 »

bed99 wrote: post #459
justinclift wrote: post #323

Earlier quoted context omitted.

That doesn't seem correct: If they determine the vulnerability is only exploitable by the NSA for reasons such as computational resources, budget, or skill set, they label it as NOBUS and will not move to patch it, but rather leave it open to exploit against current or future targets. If (!) the NSA regards ssh keys as secure, then from that article it sounds like the NOBUS thing would fit.

Is it legal and possible for the NSA to socially attack someone with mental health issues this way? I'd like to rule-out some state actors by the mere heartbreaking act of socially engineering and targeting a person in pain. Not even considering the original maintainer may be a US citizen (idk).

You do realize that plenty of state actors have no qualms with physically torturing and killing people in the most gruesome ways possible, right? Online bullying is peanuts in that context.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#497

Post by account42 »

NarcissistDev wrote: post #430
j16sdiz wrote: post #405

Earlier quoted context omitted.

By whom? The attacker have assumed the maintainer role. Nobody is reviewing.

There’s a severe and dangerous lack of paranoia in this dev space. If I was letting someone maintain my codebase, I would 1 Billion percent be reviewing everything… if there was a binary added, I’d be building it myself and comparing the checksums. Trust absolutely no-one. If you can give a close friend or a loved one a loan of money and it is so easy for them to never pay you back, it should be a reminder that devs…

I think it's pretty pointless to speculate what you would have done considering the only reason "Jia Tan" was able to gain the access he did was because the original maintainer was burned out / busy with life / otherwise not able to dedicate the time needed for the project. If he can't maintain it himself he will be even less likely to adequately review his replacement. You can claim to have perfect opsec as much as you want but life has a way of screwing that up that no one is invulnerable against.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#498

Post by account42 »

shp0ngle wrote: post #236
kstrauser wrote: post #62

Earlier quoted context omitted.

Yes. This would surely be prosecutable under the CFAA. Honestly, if I were involved in this, I'd hope that it was, say, the FBI that caught me. I think that'd be the best chance of staying out of the Guantanamo Bay Hilton, laws be damned.

CIA didn't put anyone new into gitmo for years. The 30 remaining gitmo prisoners are all W Bush holdovers that all subsequent administrations forgot.

"forgot" lmao

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#499

Post by account42 »

infamouscow wrote: post #486
gowld wrote: post #203

Earlier quoted context omitted.

A software license has never been a protection against malicious criminal activity. They'd have to prove that the "feature" had a legitimate non-nefarious purpose, or was accidental, neither of which apply here.

In the US, you are innocent until proven guilty. In the US, you are innocent until proven guilty. In the US, you are innocent until proven guilty. Apologies for having to be obnoxious about it, but it deserves repeating. If you take a approach of presumed guilty where the accused have to prove their innocence: you have a problem. You'd have a very difficult time proving your innocence after being accused of a crime.…

Proven here is not in the same sense of a mathematical proof. "But your honor, technically you can't prove my client was going to use this exploit carefully hidden behind layers of obfuscation for malicious intent" is not a legal defense.

Re: Xzbot: Notes, honeypot, and exploit demo for the xz backdoor

#500

Post by account42 »

gghffguhvc wrote: post #119
gghffguhvc wrote: post #97

Earlier quoted context omitted.

Even with the MIT disclaimer and the author not being the distributor or have any relationship with the distributor. Publishing vulnerable open source software to GitHub with a disclaimer that says it isn’t fit for any purpose seems like a bit of an oversight of using MIT license in distros to me.

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR TH…

BY READING THIS COMMENT YOU AGREE THAT THE AUTHOR CAN TAKE ALL YOUR WORDLY POSSESSIONS. YOU ALSO INDEMNYFY THE AUTHOR FOR ANY HARM THEY MIGHT CAUSE YOU AT ANY TIME.

I own you now. Sucks to be you I guess. Or maybe that's not how things work a) limits to what licenses can allow you to do and b) limits to who is bound by the license at all.

Post reply on HN