The xz sshd backdoor rabbithole goes quite a bit deeper

Post by readyplayernull » Sun, Apr 07, 2024, 3:32 AM UTC

rgmerk wrote: post #59

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

Events can happen to anyone, even competent state-sponsored organisations. And intelligence agencies are sometimes rather less ruthlessly competent than imagined (Kremlin assisinations in the UK have been a comedy of errors [1]). Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry. [1] https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine..…

Post by est » Sun, Apr 07, 2024, 3:39 AM UTC

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

Post by nick238 » Sun, Apr 07, 2024, 3:47 AM UTC

asveikau wrote: post #98

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

Modifying the sshd behavior without crashes seems by itself pretty difficult. I mean, conceptually it isn't hard, if you are in the same process and can patch various functions, but I think doing so and having it be "production ready" to ship in multiple linux distros all the time is a challenge. This thing wasn't around for very long but yet another thing to consider would be to keep it working across multiple versi…

Post by bee_rider » Sun, Apr 07, 2024, 4:11 AM UTC

est wrote: post #103

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

> super professional in some ways, and rather amateur in others so this has to be a coordinaed teamwork instead of a single hacker, right?

Post by rav » Sun, Apr 07, 2024, 4:24 AM UTC

sho_hn wrote: post #88

richin13 wrote: post #56

Earlier quoted context omitted.

I read somewhere that some recent changes in systems would've made the backdoor useless so they had to rush out, which caused them to be reckless and get discovered

This refers to the fact that systemd was planning to drop the dependency on liblzma (the conpression library installed by xz), and instead dlopen it at runtime when needed. Not for security reasons, but to avoid pulling the libs into initramfs images. The backdoor relies on sshd being patched to depend on libsystemd to call sd_notify(), which several distros had done. OpenSSH has since merged a new patch upstream tha…

  import os, socket
  
  def notify(state=b"READY=1"):
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
    addr = os.getenv('NOTIFY_SOCKET')
    if addr[0] == '@':
     addr = '\0' + addr[1:]
    sock.connect(addr)
    sock.sendall(state)