Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

131–140 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#131

Post by ilvez »

ericpruitt wrote: post #104
manquer wrote: post #87

Earlier quoted context omitted.

Why do we assume the person building the trust is the attacker ? Is not possible the attacker simply took over the account of some one genuinely getting involved in the community either hacked or just with $5 wrench and then committed the malicious code ?

> Is not possible the attacker simply took over the account of some one genuinely getting involved in the community either hacked or just with $5 wrench and then committed the malicious code ? Given the behavior of the accounts that applied pressure on the original xz maintainer, this seems unlikely to me.

Or they just bought the guy at one point, because I understood the malicious behaviour started quite recently.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#132

Post by Jasper_ »

orbital-decay wrote: post #119
ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

You probably have too high expectations when you hear the "state-sponsored" part. Every large organization will inevitably end up like any other. They also have bureaucracy, deadlines, production cycle, poor communication between teams, the recent iOS "maybe-a-backdoor" story also shows that they don't always care about burning the vulnerabilities because they amassed a huge pile of them.

Eh. Take a look at other state-sponsored attackers. We know they have 0-days for iOS, we know they've been used, but even Apple doesn't know what they are since they are so good at hiding their tracks. I don't think a state-sponsored attack would upload their payload to the git repo and tarball for all to stare at after it's been found out, which only took about a month.

NSO Group built a turing-complete VM out of a use-after-free exploit in some JBIG2 decompression code. Uploading a payload to the world wide web and calling it bad-3-corrupt_lzma2.xz is clownshoes by comparison.

My best guess as to what this is is an amateur hacker ring, possibly funded by a ransomware group.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#134

Post by dralley »

tw04 wrote: post #95
ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

The fact that the guys developing the code weren't also simultaneously running valgrind and watching performance isn't hard to believe. They were targeting servers and appliances, how many servers and appliances do you know of that are running valgrind in their default image? Sure, in hindsight that's a "duh, why didn't we think of that" - but also it's not very hard at all to see why they didn't think of that. They…

In theory they should probably be testing against the CI pipelines of Debian and Fedora / CentOS, as that's the moat their backdoor has to cross.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#135

Post by [deleted] »

atomicnumber3 wrote: post #94
anamax wrote: post #23

Earlier quoted context omitted.

> "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius." Does "think of half" apply to the folks trying to solve murders?

Nah, it applies to the person trying to get away with the murder. People will do really, really intricate jobs of trying to cover up, then slip up because like, they leave a receipt in their car that accidentally breaks their alibi.

[deleted]

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#136

Post by orbital-decay »

Jasper_ wrote: post #132
orbital-decay wrote: post #119

Earlier quoted context omitted.

You probably have too high expectations when you hear the "state-sponsored" part. Every large organization will inevitably end up like any other. They also have bureaucracy, deadlines, production cycle, poor communication between teams, the recent iOS "maybe-a-backdoor" story also shows that they don't always care about burning the vulnerabilities because they amassed a huge pile of them.

Eh. Take a look at other state-sponsored attackers. We know they have 0-days for iOS, we know they've been used, but even Apple doesn't know what they are since they are so good at hiding their tracks. I don't think a state-sponsored attack would upload their payload to the git repo and tarball for all to stare at after it's been found out, which only took about a month. NSO Group built a turing-complete VM out of a…

That's why I mentioned the recent story. [0] [1] "Apple doesn't know" when the chain uses an internal backdoor in Apple hardware is a... stretch. And the chain gives the strong vibes of corporate-style development, with all its redundancy and mismatch between two parts. It's not alchemy, really.

[0] https://securelist.com/operation-triangulation-the-last-hard...

[1] https://news.ycombinator.com/item?id=38783112 - HN discussion

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#137

Post by qarl »

db48x wrote: post #129
chrismartin wrote: post #100

Earlier quoted context omitted.

There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdo... .) A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".

Like I said, we don't know anything worth having a real discussion about. Maybe he was in the +03 time zone, and pretending to be in +08, but that's not enough to base a discussion on.

You're discussing it.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#138

Post by ssl-3 »

withinboredom wrote: post #112
ssl-3 wrote: post #70

Earlier quoted context omitted.

Wrong? Which part is wrong? Only 2/3 of these to choices can be wrong. The remaining one must be correct.

Technically, all 3 could be wrong and an unknown 4th option could be correct. That seems to be what they are proposing here. In both cases, the premise is unclear so good luck!

Eh, good call I guess. I didn't see that aspect.

The 4th option they may appear to propose suggests that murder investigators don't get paid -- neither in money, nor in benefits.

So, to that end: As far as I know, that's not usually the case with government employees, and it is always actionable when it does happen to be the case.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#139

Post by rlt »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

This doesn’t seem too surprising to me.

Any moderately competent developer could gain maintainership of a huge percentage of open source projects if they’re being paid to focus solely on that goal… after all, they’re competing mostly against devs working on it part side or as a hobby.

If this is state sponsored, they likely have similar programs in a large number of other projects.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#140

Post by mr_mitm »

aeyes wrote: post #40
bilekas wrote: post #20

Without having a Twitter account I have a really hard time following these threads. Is there some write up? Edit : Check comments. Yes, the backdoor hasn't been decompiled/reverse engineered yet. But it feels like clickbait to say : "It goes deeper"... Obviously. Nobody knows what it fully does yet. There was no assumption of knowing what it did.

Short summary is that it allows auth bypass, not just RCE.

RCE as root is already the worst case though. The auth bypass is basically just a convenience feature of the backdoor. So yeah it's mildly interesting but not really a new development of the story.
Post reply on HN