191–200 of 862 posts
Is there a git diff which shows this going in?
Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.
Based on the level of sophistication being alluded to, I'm personally inclined to assume this is a state actor, possible even some arm of the U.S. govt.
Possible. But why mention U.S. specifically? Is it more likely than Russia, Iran, China, France ... ?
Earlier quoted context omitted.
I can't blame anyone who has missed that dot dissimulated at the beginning of the line. https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd...
For people like me whose C knowledge is poor, can you explain why this dot is significant? What does it do in actuality?
Earlier quoted context omitted.
> However, since this is an RCE in the context of e.g. an sshd process itself, this means that sshd running as root would allow the payload to itself run as root. With the right sandboxing techniques, SELinux and mitigations could prevent the attacker from doing anything with root permissions. However, applying a sandbox to an SSH daemon effectively is very difficult.
Could you explain how SELinux could ever sandbox against RCE in sshd? Its purpose is to grant login shells to arbitrary users, after all.
by default sshd has access to all files in /home/$user/.ssh/, but that could be prevented by giving private keys a new unique file context, etc.
SELinux would not prevent all attacks, but it can mitigate quite a few as part of a larger security posture
Earlier quoted context omitted.
Based on the level of sophistication being alluded to, I'm personally inclined to assume this is a state actor, possible even some arm of the U.S. govt.
> possible even some arm of the U.S. govt. Possible. But why mention U.S. specifically? Is it more likely than Russia, Iran, China, France ... ?
Earlier quoted context omitted.
Is it illegal to distribute malware? I see security researchers doing it all the time for analysis purposes.
No, it is not illegal to distribute malware by itself, but it is illegal to trick people into installing malware. The latter was the goal of the XZ contributor.
Earlier quoted context omitted.
Think whatever you shall about systemd of course, but please stop with the blind belief mud slinging: - systemd didn't create the patch to include libsystemd, distros did - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though - you can implement notify in standalone code in about the same effort as it takes to use the dependency, there wasn…
> - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though The affected distros aren't behind on systemd updates, the change to systemd you describe has been merged but not yet released.
Unpopular opinion, but I cannot but admire the whole operation. Condemn it of course, but still admire it. It was a piece of art! From conception to execution, masterful! We got extremely lucky that it was caught so early.
If the payload didn't have a random .5 second hang during SSH login, it would probably not have been found for a long time. The next time, the attackers probably manage to build a payload that doesn't cause weird latency spikes on operations that people wait on. (For some reason this brings to mind how Kim Dotcom figured out he was the target of an illegal wiretap... because he suddenly had a much higher ping in MW3.…
Ironic, how an evil actor failed for a lack of premature optimization :D
Earlier quoted context omitted.
Except had we been doing that they would have put guards in place to detect it - as they already had guards to avoid the code path when a debugger is attached, to avoid building the payload in when it's not one of the target systems, and so on. Their evasion was fairly extensive, so we'd need many novel dynamic systems to stand a chance, and we'd have to guard those systems extremely tightly - the author got patches…
I broadly agree, but I think we can draw a parallel with the arms race of new exploit techniques versus exploit protection. People still manage to write exploits today, but now you must find an ASLR leak, you must chain enough primitives to work around multiple layers of protection, it's generally a huge pain to write exploits compared to the 90s. Today the dynamic detection that we have for Linux packages seems thin…