Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

191–200 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#191

Post by OJFord »

TheBlight wrote: post #73
kybernetyk wrote: post #68

Earlier quoted context omitted.

>In Germany something like 90% of murder cases are solved You must watch out when reading the German crime statistics. "Solved" which is marked as "aufgeklärt" in those statistics just means that a suspect has been named. Not that someone actually did it/has been sentenced for the crime. > https://de.wikipedia.org/wiki/Aufkl%C3%A4rungsquote#Deutschl... 2nd sentence

Is it reasonable to assume a material number of cleared murders in Germany result in no charges and/or no conviction? (Genuinely curious.)

Surely it's pretty common everywhere to have at some point a suspect ('solved!') who is then released, because you lack evidence, realise it's not them, whatever. A suspect isn't necessarily convicted even if you do ultimately convict someone.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#192

Post by setgree »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

If Google could release Gemini with a straight face, is it so hard to believe that this shadowy org might fail in an even subtler way?

Patrick McKenzie observes elsewhere that criminal orgs operate more or less like non-criminal ones — by committee and by consensus. By that light, it’s not so hard to fathom why this ship could have been sunk by performance degradation arising from feature bloat. Companies I’ve worked at have made more amateurish mistakes.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#193

Post by formerly_proven »

cjbprime wrote: post #99
lyu07282 wrote: post #41

Earlier quoted context omitted.

One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane technical details. This may be confirmed by regular vulnerabilities that are found in sometimes many decades old software, since vulnerabilities are much harder to find than backdoors. For example shellshock was 30 year old code, PwnKit 12 and log4j was ~10 ish. So…

Doesn't your data prove the opposite point? There are so many vulnerabilities and so few people looking for them that even the thirty year old ones have barely been found. A healthy feedback loop would have trended the average age of each vulnerability at the time of detection to be *short".

Most backdoors that are found are really obvious garbage. Like hardcoded credentials or keys in appliances.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#194

Post by [deleted] »

glibg10b wrote: post #149
sureglymop wrote: post #96

Does anyone have a good explanation or introduction into the performance testing that was done to find this? And how to get started? Actually measuring performance always seemed to be a very hard task and I'd like to be able to do similar testing as the person which found this backdoor.

https://www.openwall.com/lists/oss-security/2024/03/29/4 > == Observing Impact on openssh server == > > With the backdoored liblzma installed, logins via ssh become a lot slower. > > time ssh nonexistant@...alhost > > before: > nonexistant@...alhost: Permission denied (publickey). > > before: > real 0m0.299s > user 0m0.202s > sys 0m0.006s > > after: > nonexistant@...alhost: Permission denied (publickey). > > real 0m0…

[deleted]

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#195

Post by tdudhhu »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

Sometimes I think it could be someone who was forced to embed the backdoor but was smart enough to make it detectable by others without raising suspicion by the entity that was forcing him.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#196

Post by 1over137 »

vinay_ys wrote: post #177
orbital-decay wrote: post #172

Earlier quoted context omitted.

I don't believe it's intentional for the reason you mentioned. Although it could theoretically be like that for plausible deniability, Apple's reputation is definitely more valuable than one patchable backdoor of god knows how many others. But debug backdoor is still a backdoor.

Very large companies are definitely at the mercy of governments. Just look at how they are bending over backwards to comply with DMA etc. So, it is not at all inconceivable that they are forced to put backdoors into their product by the governments.

>Very large companies are definitely at the mercy of governments.

Thankfully! At least in a democracy, the government is chosen, megacorps are accountable to no one else.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#198

Post by threeseed »

gitaarik wrote: post #148
pflenker wrote: post #120

Earlier quoted context omitted.

We could be faced with a form of Survivorship Bias here[0]. I find that thought rather chilling. [0] https://en.wikipedia.org/wiki/Survivorship_bias

Which would mean that we have all kinds of active backdoors in our systems without us knowing it. But wouldn't they be detected at some point by someone? Or would they be silently removed again after some time so the attackers are not revealed?

NSO Pegasus has existed for years without all of their exploits being detected.

You have to remember there is a lot of code in our systems. And almost every developer is inadequately trained on how to write secure software.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#199

Post by ThePowerOfFuet »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

On 2024-02-29, a PR was sent to stop linking liblzma into libsystemd [0].

Kevin Beaumont speculated [1] that "Jia Tan" saw this and immediately realized it would have neutered the backdoor and thus began to rush to avoid losing the very significant amount of work that went into this exploit; I think he's right. That rush caused the crashing seen in 5.6.0 and the lack of polish which could have eliminated or reduced the performance regressions which were the entire reason this was caught in the first place; they simply didn't have the time because the window had started to close and they didn't want all their work to be for nothing.

[0]: https://github.com/systemd/systemd/pull/31550

[1]: https://doublepulsar.com/inside-the-failed-attempt-to-backdo...

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#200

Post by lozenge »

orbital-decay wrote: post #172
ThePowerOfFuet wrote: post #159

Earlier quoted context omitted.

Re the secret knock in the Apple silicon, a friend of mine once said "that's how you lose the NOBUS on a backdoor", and I think they were absolutely right. The one thing which most leads me to believe this was an intentional backdoor? The S-boxes.

I don't believe it's intentional for the reason you mentioned. Although it could theoretically be like that for plausible deniability, Apple's reputation is definitely more valuable than one patchable backdoor of god knows how many others. But debug backdoor is still a backdoor.

Intentional doesn't mean Apple approved. It could be a couple of compromised employees on the right teams.
Post reply on HN