Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

161–170 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#161

Post by kelnos »

lucb1e wrote: post #92
vsnf wrote: post #47

Earlier quoted context omitted.

> arguably bigger than that That’s a stretch. Stuxnet was the first acknowledged state cyber attack, utilized multiple zero days, and destroyed nuclear weapons manufacturing facilities. Bigger in scope sure, but bigger unconditionally? I don’t know about that.

From my point of view, from what we know today, it is bigger than Stuxnet because: Stuxnet : aimed to delay one nuclear facility that was still being built SSH pre-auth RCE : root access to most servers on the planet, impacting everyone from hobbyist self-hosters (that's me) to large businesses (of every type imaginable) to probably even some of the security agencies around the world. With SSH's track record, a lot o…

> SSH pre-auth RCE: root access to most servers on the planet, impacting everyone from hobbyist self-hosters (that's me) to large businesses (of every type imaginable) to probably even some of the security agencies around the world.

No, absolutely not; that didn't actually happen. Most servers on the planet that are running x86_64 Linux are probably not running a rolling-release distro based on .deb or .rpm. Rolling-release (or a beta version of the next OS release) is required because I can't imagine one of them updating to a new version of a library like this until the next major release of their OS, and .deb/.rpm because those are the only build environments where the backdoor would get built into the library. (And on top of that, only systems where sshd is patched to link to libsystemd.)

Also: while I will admit that there are many businesses with abysmal security practices, most will not have ssh exposed to the public internet; that'll require access to the corporate VPN as well. You note this, but fail to recognize the impact.

Even hobbyists probably aren't hit by this in large numbers. I run a VPS for a variety of things, and it runs Debian stable. Assuming this backdoor attempt was never found, it wouldn't get installed on it until mid-/late-2025, when Debian trixie is likely to be released (plus some time for me to get around to upgrading it).

I did have the affected package on my laptop, which runs Debian testing. But I don't have sshd enabled on it all the time, and even if I did, my laptop is rarely on a network without NAT (and I usually opt to tether to my phone when in public rather than use public WiFi). All the other machines on my home network are also running Debian stable, and were unaffected.

I suspect that precious few systems even had the backdoor installed on them, and of those, even fewer were accessible directly on the public internet.

Now this could have been bigger than Stuxnet, if the backdoor had remained secret for -- and I think I'm being generous here -- another year or so.

Re: XZ Backdoor: Times, damned times, and scams

#162

Post by qsi »

delta_p_delta_x wrote: post #158
qsi wrote: post #123

Earlier quoted context omitted.

In the few commits from Jia Tan that I've seen, the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English. Obviously, this is a very small sample so one cannot read too much into it. Almost 10% of Singaporeans share the family name Tan. [1] [1] https://en.wikipedia.org/wiki/File:Singaporean_surnames_by_f...

> the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English Singapore is an Anglophone country. Many Singaporeans are perfectly capable of writing (idiomatic) BrE or NAmE, given the medium of instruction in Singaporean education from kindergarten to university is English. Example: me.

That is certainly true, I did not mean to imply this is not the case. I have noticed however that in the Singaporean English acrolect certain words and phrases are used differently than they would be in BrE or NAmE ("I'll send him to the airport.") In less formal registers the differences become larger, which is what I was looking for.

Re: XZ Backdoor: Times, damned times, and scams

#164

Post by someotherperson »

Maybe something that can be done if it hasn't been done already: semantic analysis across the different platforms they communicated on, to determine if it was the same person. Also semantic analysis on the same platforms using different cohorts of time (days of the week, months of the year, quarters, whatever).

Also: analysis on the email chains they interacted with. It's a possibility that they may have responded to their own emails in their mailing lists with fix suggestions/requests for clarification etc.

Re: XZ Backdoor: Times, damned times, and scams

#165

Post by kelnos »

transpute wrote: post #79
vsnf wrote: post #47

Earlier quoted context omitted.

> arguably bigger than that That’s a stretch. Stuxnet was the first acknowledged state cyber attack, utilized multiple zero days, and destroyed nuclear weapons manufacturing facilities. Bigger in scope sure, but bigger unconditionally? I don’t know about that.

Depends on the set of global resources, including development, CI/CD and production systems, reachable by compromised sshd.

And that would likely be precious few, at least today. Only a teeny tiny percentage of servers out there were updated to a vulnerable version. And an even smaller percentage likely had their sshd port exposed to the public internet.

Sure, if the backdoor hadn't been found for a couple more years, the impact would have been much higher, as the backdoored version would have made it into actual current releases of the popular server distros, and companies gradually upgraded.

Re: XZ Backdoor: Times, damned times, and scams

#166

Post by lrasinen »

mik1998 wrote: post #32

I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.

Noticed a 4-week empty block in August. This lines up with European holiday schedules. Less common in Finland though, we prefer July.

Re: XZ Backdoor: Times, damned times, and scams

#167

Post by akira2501 »

DrTung wrote: post #150
akira2501 wrote: post #114

Earlier quoted context omitted.

It's not clear that the distribution mechanism and many of the other requirements would be so broadly met that "access to most servers on the internet" is a correct description of the scope. Or that, once in the wild, that the author would have their pick of the litter when choosing targets. It's also true that the exploit has several kill switches in it, and so even vulnerable servers could be protected by simply se…

Since they would have "their pick of the litter" why did they then include kill switches? A scary scenario is a rerun of the Viasat hack https://en.wikipedia.org/wiki/Viasat_hack I.e. wipe all servers worldwide at the morning of an attack, but before that you install the kill switches on your servers and those of your allies.

To make it harder to detect and reverse engineer. There's a plethora of disabling functionality in the exploit. This is bad, but the original post is being hyperbolic.

Re: XZ Backdoor: Times, damned times, and scams

#168

Post by someotherperson »

Maybe a consideration: this isn't necessarily a nation state. It could literally just be one or more individuals trying to set up some sort of crypto heist. At this point we need some sort of new adage to the effect of "never attribute to nation states what can be attributed to crypto"

Re: XZ Backdoor: Times, damned times, and scams

#169

Post by Delk »

cozzyd wrote: post #101
broknbottle wrote: post #73

Why not include the timestamps for their replies to the mailing list? https://www.mail-archive.com/xz-devel@tukaani.org/

Do you understand the time format there? It lists things as -700 or -800 for me, is that because of my local time zone (Chicago) vs. the mailing list (Finland?).

I think mail-archive.com just shows time stamps in UTC-0700 or UTC-0800 regardless of where you are. That's how time stamps appear on all of the few mailing lists I checked out there, regardless of the sender of the message.
Post reply on HN