Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who rooted kernel.org servers two years ago?

arstechnica.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Who rooted kernel.org servers two years ago?

#41

Post by SimHacker »

rgbrenner wrote: post #15
jeresig wrote: post #14

Earlier quoted context omitted.

There was a discussion about this recently saying that it was highly unlikely. All the source was in Git and every git commit references the previous commit, making it highly challenging to modify an old commit without also modifying the commit id. More details: http://archive.is/Khq7R

Yes, it's unlikely they modified the source in git.. But it's possible they were able to download a copy and modify it locally... Possibly adding comments to document certain blocks of code.. Or adding unofficial patches for zfs support... Or worse..

Like enabling ReiserFS??!

Re: Who rooted kernel.org servers two years ago?

#42

Post by woah »

rgbrenner wrote: post #7
nlh wrote: post #2

So let's speculate about what the article almost-but-doesn't-quite propose: The NSA, or related parties, was responsible for the breach. There was an investigation and postmortem, but because of an NSL or other gag-type order, they couldn't accurately publish what they discovered. So they figured that not releasing a report was better than releasing a report that either intentionally misled or pretended not to have f…

What are the ramifications if this is what happened? I strongly suspect they were able to get a copy of the kernel source code... They could be doing anything with it.. Porting it to a new platform.. Compiling it with unsafe GCC flags.. Or worse..

The people need an answer. Does the NSA have a copy of the linux source code or not??!

Re: Who rooted kernel.org servers two years ago?

#43

Post by Aldo_MX »

marcosdumay wrote: post #26
brudgers wrote: post #24

A feature of civilian security is that "It was restored from Git" is doesn't immediately spark a concern that Git could be compromised. I'm not saying that it is, but compromising Git is certainly the sort of thing which would occur to a state sponsored espionage agency. And if one were seeking to compromise the Linux toolchain, it would certainly be a very attractive link. So attractive that not including it in a mu…

Version control systems are a bad target. They are too simple , too deterministic, and too networked. You can steal their data, but if you insert something, you will get caught. Yeah, there are exceptions, all of them proprietrary. There is no reason to trust GIT less just because some companies can make even version control hard.

You still need to check the contents of the first commit.

Re: Who rooted kernel.org servers two years ago?

#44

Post by joeyh »

jeresig wrote: post #14
rgbrenner wrote: post #7

Earlier quoted context omitted.

What are the ramifications if this is what happened? I strongly suspect they were able to get a copy of the kernel source code... They could be doing anything with it.. Porting it to a new platform.. Compiling it with unsafe GCC flags.. Or worse..

There was a discussion about this recently saying that it was highly unlikely. All the source was in Git and every git commit references the previous commit, making it highly challenging to modify an old commit without also modifying the commit id. More details: http://archive.is/Khq7R

Here's how to do it:

1. Contribute a driver to the kernel. A network driver would be ideal, but any driver will do. Include a binary firmware blob, because including binary firmware blobs in drivers is how linux kernel devs roll (or how they used to roll). When creating the binary firmware blob, use a SHA1 preimage attack to actually create two versions with the same SHA. One is benign, and one runs your back door.

2. Root git server. Replace object containing firmware blob with the alternate version.

This attack should be detectable by comparing blobs from old git clones with blobs from new ones, using a hash that has better preimage resistance than does SHA1.

There are other ways to get your SHA1 colliding binary blob into a git commit in ways that are unlikely to be noticed. I demonstrated one (without actual SHA1 preimage attack) here: http://github.com/joeyh/supercollider But a binary firmware blob is pretty much ideal.

Re: Who rooted kernel.org servers two years ago?

#45

Post by rgbrenner »

joeyh wrote: post #44
jeresig wrote: post #14

Earlier quoted context omitted.

There was a discussion about this recently saying that it was highly unlikely. All the source was in Git and every git commit references the previous commit, making it highly challenging to modify an old commit without also modifying the commit id. More details: http://archive.is/Khq7R

Here's how to do it: 1. Contribute a driver to the kernel. A network driver would be ideal, but any driver will do. Include a binary firmware blob, because including binary firmware blobs in drivers is how linux kernel devs roll (or how they used to roll). When creating the binary firmware blob, use a SHA1 preimage attack to actually create two versions with the same SHA. One is benign, and one runs your back door. 2…

except there are no practical preimage attacks on sha1

Re: Who rooted kernel.org servers two years ago?

#47

Post by meowface »

rgbrenner wrote: post #45
joeyh wrote: post #44

Earlier quoted context omitted.

Here's how to do it: 1. Contribute a driver to the kernel. A network driver would be ideal, but any driver will do. Include a binary firmware blob, because including binary firmware blobs in drivers is how linux kernel devs roll (or how they used to roll). When creating the binary firmware blob, use a SHA1 preimage attack to actually create two versions with the same SHA. One is benign, and one runs your back door. 2…

except there are no practical preimage attacks on sha1

Right.

His comment reads as "ok, do all these simple things then just put in your backdoor but make sure it has the same SHA1 hash as something benign, and that's it!"

Re: Who rooted kernel.org servers two years ago?

#49

Post by contingencies »

ris wrote: post #33
spangled wrote: post #12

Earlier quoted context omitted.

This reminds me of a friend's response to the idea that the TouchID in the new iphone could be a way for the NSA to get your fingerprints: "Just imagine the shitstorm if they put a camera in there. Or a microphone."

There's no good way yet to uniquely identify a person based on a (dodgy) picture of them or sample of their voice. Whereas fingerprints are used for this daily* and a quickly searchable database of these (or just their "hashes") would be incredibly useful to _somebody_. *I'm not raising the issue of whether they _should_ be or not here, just that they are.

There's no good way yet to uniquely identify a person based on a (dodgy) picture of them or sample of their voice

Surely this is sarcastic. We can easily identify with great certainty from a relevant set... as Facebook does, for instance. You have a relevant set if you are many governments (the local government, and in many cases Israel via AMDOCS and its intelligence allies - primarily the US, but in some cases possibly their intelligence allies) or a motivated attacker (eg. with an insider, or hiring an insider via a private investigation firm), because you have the device call/messaging/physical location records from which to cross-match. Even if it's a land-line. You also have easy access to additional voice data (voicemail recording, 'this call may be recorded' records at large companies such as banks or wings of government, etc.). Public data sets on non-secret government telephone interception frequency even in 'free-ish' countries like Australia suggest extremely broad cultures around acceptable collection. (For .au I read a raw statistics report I can't seem to relocate recently, but http://www.smh.com.au/technology/technology-news/be-careful-... is a good overview.)

Re: Who rooted kernel.org servers two years ago?

#50

Post by bdonlan »

fnordfnordfnord wrote: post #29
nlh wrote: post #2

So let's speculate about what the article almost-but-doesn't-quite propose: The NSA, or related parties, was responsible for the breach. There was an investigation and postmortem, but because of an NSL or other gag-type order, they couldn't accurately publish what they discovered. So they figured that not releasing a report was better than releasing a report that either intentionally misled or pretended not to have f…

It's not a big leap. The report hasn't been disclosed because they are under legal obligation not to disclose. The report hasn't been disclosed because they are corrupt. The report hasn't been disclosed because they are embarrassed. The report hasn't been disclosed because they are lazy. The report hasn't been disclosed because they are incompetent. What other possibilities exist? Which one is most likely?

How about:

The report hasn't been disclosed because they are busy with normal operations.

The report hasn't been disclosed because they were pulled away from it to do some more urgent business, and since then it has been forgotten and/or important evidence has been lost.

The report hasn't been released due to turnover in whatever group would be responsible for producing the report, which has caused the loss of important tribal knowledge regarding the event.

As an outside observer, it's hard to say which it would be. However, I do find it unlikely that there would be a gag order - there is little surveillance data to be directly obtained from kernel.org, and attempting to backdoor the kernel itself would have a high risk of exposure and an extremely high risk of blowback from other governments who use Linux. Even if the NSA or CIA or some other TLA were behind it, they would have taken steps to ensure their identity would not be exposed in any investigation in the aftermath of a successful backdooring; there's no sense then effectively telling people who they are with a gag order (and then risking that someone might choose to violate the gag order).

Post reply on HN