Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

111–120 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#111

Post by ball_of_lint »

anamax wrote: post #23
atomicnumber3 wrote: post #4

The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."

> "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius." Does "think of half" apply to the folks trying to solve murders?

Even if you can think of 10 relatively uncorrelated reasons, that lets you catch the genius murderer 1-(1/2^10) of the time, which is quite good.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#112

Post by withinboredom »

ssl-3 wrote: post #70
graphe wrote: post #55

Earlier quoted context omitted.

Wrong. There’s no money or benefits in solving crimes. It could be done easily in many cases but nobody cares about certain people like gang members. Lots of cases where the murderer tells everyone but nobody cares.

Wrong? Which part is wrong? Only 2/3 of these to choices can be wrong. The remaining one must be correct.

Technically, all 3 could be wrong and an unknown 4th option could be correct. That seems to be what they are proposing here.

In both cases, the premise is unclear so good luck!

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#113

Post by timschmidt »

nick238 wrote: post #105
asveikau wrote: post #98

Earlier quoted context omitted.

Modifying the sshd behavior without crashes seems by itself pretty difficult. I mean, conceptually it isn't hard, if you are in the same process and can patch various functions, but I think doing so and having it be "production ready" to ship in multiple linux distros all the time is a challenge. This thing wasn't around for very long but yet another thing to consider would be to keep it working across multiple versi…

I picture some division in [nation-state] where they're constantly creating personas, slowly working all sorts of languishing open source packages with few maintainers (this is the actual hard, very slow part), then once they have a bit of an in, they could recruit more technical expertise. The division is run by some evil genius who knows this could pay off big, but others are skeptical, so their resources are prett…

Moxie's reasons for disallowing Signal distribution via F-droid always rang a little flat to me ( https://github.com/signalapp/Signal-Android/issues/127 ). Lots of chatter about the supposedly superior security model of Google Play Store, and as a result fewer eyes independently building and testing the Signal code base. Everyone is entitled to their opinions, but independent and reproducible builds seem like a net positive for everyone. Always struggled to understand releasing code as open source without taking advantage of the community's willingness to build and test. Looking at it in a new light after the XZ backdoor, and Jia Tan's interactions with other FOSS folk.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#114

Post by akira2501 »

rdtsc wrote: post #32
atomicnumber3 wrote: post #4

The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."

I can believe it’s because it was a team behind the account. Someone developed the feature and another more careless or less experienced one integrated it. Another one possibly managing sock puppets and interacting in comments and PRs.

I wonder what the web admin control panel for the "fake human" looks like, or if it even rises to that level of sophistication yet.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#115

Post by m3kw9 »

pquki4 wrote: post #76
UncleOxidant wrote: post #49

This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.

I'd say the original author should just post something as an article instead of tweets. A blog post. Github md file. Github gist. Even pastebin. I don't care its format or where it is hosted, it does not need to be well formatted and could be as casual as it could be -- I don't expect to read a well-written article, and I know that would take a lot of effort. I just want to see something that is not a series of tweet…

Then how will he gain followers?

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#117

Post by timschmidt »

justusthane wrote: post #102
jpalawaga wrote: post #65

it's a rather good thing that this was found before it made it out broadly. Not just for obvious reason of not wanting an unknown party to have RCE on your infrastructure. I think as people keep digging they will eventually formulate a payload which will allow the backdoor to be used by anyone. As bad as it is for a single party to have access, it's much worse for any (every?) party to have access.

Isn’t that more or less impossible since the payload is a private RSA key?

See https://en.wikipedia.org/wiki/Dual_EC_DRBG for another backdoor requiring a private key, in which the key was simply replaced in a subsequent supply chain attack(!) with a key known to the attacker:

"In December 2015, Juniper Networks announced[55] that some revisions of their ScreenOS firmware used Dual_EC_DRBG with the suspect P and Q points, creating a backdoor in their firewall. Originally it was supposed to use a Q point chosen by Juniper which may or may not have been generated in provably safe way. Dual_EC_DRBG was then used to seed ANSI X9.17 PRNG. This would have obfuscated the Dual_EC_DRBG output thus killing the backdoor. However, a "bug" in the code exposed the raw output of the Dual_EC_DRBG, hence compromising the security of the system. This backdoor was then backdoored itself by an unknown party which changed the Q point and some test vectors.[56][57][58] Allegations that the NSA had persistent backdoor access through Juniper firewalls had already been published in 2013 by Der Spiegel.[59] The kleptographic backdoor is an example of NSA's NOBUS policy, of having security holes that only they can exploit."

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#118

Post by pvg »

UncleOxidant wrote: post #49

This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.

The site conventions are to post original sources and workarounds in the thread. And to avoid gumming up threads with annoyances-of-everyday-web-life meta.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#119

Post by orbital-decay »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

You probably have too high expectations when you hear the "state-sponsored" part. Every large organization will inevitably end up like any other. They also have bureaucracy, deadlines, production cycle, poor communication between teams, the recent iOS "maybe-a-backdoor" story also shows that they don't always care about burning the vulnerabilities because they amassed a huge pile of them.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#120

Post by pflenker »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

We could be faced with a form of Survivorship Bias here[0]. I find that thought rather chilling.

[0] https://en.wikipedia.org/wiki/Survivorship_bias

Post reply on HN