There has been a lot said to not throw shit at Lasse Collin. This post is reassuring.
It was said he is on an internet break at the moment, so I hope this doesn't ruin weeks for him. It's thankless enough to maintain something like xz.
XZ Utils Backdoor
11–20 of 20 posts
Re: XZ Utils Backdoor
#12When all this is over and Collin is in the right state of mind, I'd appreciate if they could shed some light on the social engineering side of this exploit. i.e. the process by which the intruder introduced themselves, gained and exploited their trust, any warning signs or red flags, etc.
Their experience could make for a valuable lesson and prevent future occurrences.
Re: XZ Utils Backdoor
#13How do we know this is real Lasse Collin and not the same person behind Jia Tan persona, who now tries to deescalate and make it look like original maintainer is back in charge?
Re: XZ Utils Backdoor
#14You really have to feel for the author. Stepping aside for personal reasons and having someone else take up the mantle of a project is supposed to be a success story of open source - I myself have been on both sides of that process before. For it to turn out like this is incredibly disappointing
Well, at least it was detected pretty early, and is contained. Extremely wicked backdoor, but he only lost the main maintainer and github. Github will be reactivated soon for him, so others can take over.
Is it that easy? I figured he'd face an uphill battle himself - people might not trust him either, by association, or by fear that his accounts have been compromised (and are now impersonating him.)
Re: XZ Utils Backdoor
#15What can one do after having this installed? What's the consequences for a machine with this installed but not connected to the WAN?
No known consequence, assuming... (1) changing the RSA decrypt function in OpenSSH is all the code hidden in crc64 does: that's the only known behavior, but we don't know what the changed function does besides letting some authentication through, nor do we know if there are other things it does (2) there's no malicious machine in your LAN exploiting the RSA decrypt to log onto your sshd: nobody has seen one yet, but…
Well, I am skeptical about (2).
It is unclear what exploiting means. The backdoor is doing _something_ for 0.5s if RSA key exchange happens.
So even a valid login might trigger not yet known side effects. It might just tunnel commands over dns for example (DNS being a well known side effect of ssh anyway).
So "exploiting" might mean as little as "used ssh".
Re: XZ Utils Backdoor
#16When all this is over and Collin is in the right state of mind, I'd appreciate if they could shed some light on the social engineering side of this exploit. i.e. the process by which the intruder introduced themselves, gained and exploited their trust, any warning signs or red flags, etc. Their experience could make for a valuable lesson and prevent future occurrences.
From what I read, it looks it was not really social engineering per se but the good old way of earning trust, just like any ordinary engineer: the intruder joined the project three years ago and started to contributed patches. He also made good suggestions on design changes. Eventually he became a committer because he consistently made value contributions to the project.
P.S., this does not look like an individual behavior. It's hard to imagine that an individual would spend three years just to plant a backdoor in sshd.
Re: XZ Utils Backdoor
#17When all this is over and Collin is in the right state of mind, I'd appreciate if they could shed some light on the social engineering side of this exploit. i.e. the process by which the intruder introduced themselves, gained and exploited their trust, any warning signs or red flags, etc. Their experience could make for a valuable lesson and prevent future occurrences.
From what I read, it looks it was not really social engineering per se but the good old way of earning trust, just like any ordinary engineer: the intruder joined the project three years ago and started to contributed patches. He also made good suggestions on design changes. Eventually he became a committer because he consistently made value contributions to the project. P.S., this does not look like an individual be…
It looks like he made multiple sock puppet accounts talking to himself on the mailing lists:
https://boehs.org/node/everything-i-know-about-the-xz-backdo...
He made a sock puppet asking debian to update the package in 'unstable'. (along with other package update requests so it wouldn't look suspicious).
Re: XZ Utils Backdoor
#18When all this is over and Collin is in the right state of mind, I'd appreciate if they could shed some light on the social engineering side of this exploit. i.e. the process by which the intruder introduced themselves, gained and exploited their trust, any warning signs or red flags, etc. Their experience could make for a valuable lesson and prevent future occurrences.
From what I read, it looks it was not really social engineering per se but the good old way of earning trust, just like any ordinary engineer: the intruder joined the project three years ago and started to contributed patches. He also made good suggestions on design changes. Eventually he became a committer because he consistently made value contributions to the project. P.S., this does not look like an individual be…
given how widespread sshd is, i'd think it is realistic because the payoff would just be worth it if successful. the whole thing is also complex enough that it would take a while to develop. the attacker starts learning the internals of xz and in the process they develop the skills to contribute patches. so development of the attack and gaining trust go hand in hand.
Re: XZ Utils Backdoor
#19Earlier quoted context omitted.
No known consequence, assuming... (1) changing the RSA decrypt function in OpenSSH is all the code hidden in crc64 does: that's the only known behavior, but we don't know what the changed function does besides letting some authentication through, nor do we know if there are other things it does (2) there's no malicious machine in your LAN exploiting the RSA decrypt to log onto your sshd: nobody has seen one yet, but…
Well, I am skeptical about (2). It is unclear what exploiting means. The backdoor is doing _something_ for 0.5s if RSA key exchange happens. So even a valid login might trigger not yet known side effects. It might just tunnel commands over dns for example (DNS being a well known side effect of ssh anyway). So "exploiting" might mean as little as "used ssh".
Presumably they wanted this backdoor hidden, so they wouldn't want it doing things that could expose it. I'm under the impression it simply modifies memory when sshd loads the xz library, adding its own hooks and just waiting for the proper login signal. I doubt it "phones home" as this could expose its existence, but we'll have to wait until it is analyzed thoroughly.
Re: XZ Utils Backdoor
#20When all this is over and Collin is in the right state of mind, I'd appreciate if they could shed some light on the social engineering side of this exploit. i.e. the process by which the intruder introduced themselves, gained and exploited their trust, any warning signs or red flags, etc. Their experience could make for a valuable lesson and prevent future occurrences.
From what I read, it looks it was not really social engineering per se but the good old way of earning trust, just like any ordinary engineer: the intruder joined the project three years ago and started to contributed patches. He also made good suggestions on design changes. Eventually he became a committer because he consistently made value contributions to the project. P.S., this does not look like an individual be…
I mean that is still social engineering, it is just really long-game social engineering.
And IDK that we've entirely ruled out that Jia Tan didn't wind up being blackmailed or coerced or something -- although if they were really running sockpuppets to get themselves added to the project up front that is probably less likely.