Timeline of the xz open source attack • Hacker News Board

Re: Timeline of the xz open source attack

#21

Post by progressof » Tue, Apr 02, 2024, 11:49 AM UTC

jhoechtl wrote: post #18

progressof wrote: post #12

Earlier quoted context omitted.

no

Care to enlighten how you come to such a knee-jerk reaction given a highly critivcal observation? What obvous are we missing?

I didn't come to any conclusion... and I don't think you missed anything... I'm just posting links... you think it's better if I didn't post anything because this is stupid? if so then ok...

Re: Timeline of the xz open source attack

#22

Post by swsieber » Tue, Apr 02, 2024, 11:50 AM UTC

thrdbndndn wrote: post #9

How do you get "Jigar Kumar"'s email address? I can't seem to find it in the (web version of) the maillist. Another question: What is the typo exactly in this commit? I can't seem to find it. https://git.tukaani.org/?p=xz.git;a=commitdiff;h=a100f9111c8...

> How do you get "Jigar Kumar"'s email address?

Hit reply

Re: Timeline of the xz open source attack

#23

Post by winkelmann » Tue, Apr 02, 2024, 11:56 AM UTC

progressof wrote: post #10

I have found JiaT75 - Jia Tan mentioned in Microsoft C++, C, and Assembler as an community contributor ... https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp... Also check this... https://www.abuseipdb.com/check/64.23.252.16

Completely benign documentation change to fix a typo: https://github.com/MicrosoftDocs/cpp-docs/pull/4716

I have no idea what that IP address is supposed to be about...

Re: Timeline of the xz open source attack

#24

Post by lukaslalinsky » Tue, Apr 02, 2024, 11:56 AM UTC

The social side of this is really haunting me over the last days. It's surprisingly easy to pressure people to giving up control. I've been there myself. I can't even imagine how devastating this must be to the original author of XZ, especially if he is dealing with other personal issues as well. I hope at least this will serve a strong example to other open source people, to never allow others to pressure them into something they are not comfortable with.

Re: Timeline of the xz open source attack

#25

Post by kevindamm » Tue, Apr 02, 2024, 12:01 PM UTC

Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary).

I believe this means it was unauthorized, not unauthenticated.

Re: Timeline of the xz open source attack

#26

Post by logro » Tue, Apr 02, 2024, 12:05 PM UTC

progressof wrote: post #12

mseepgood wrote: post #11

Earlier quoted context omitted.

So all binaries built with a Microsoft compiler must be considered compromised?

no

[flagged]

Re: Timeline of the xz open source attack

#27

Post by vb-8448 » Tue, Apr 02, 2024, 12:05 PM UTC

I wonder if netflix will make a movie from this story, if you read the timeline it really sounds like a well written thriller.

Re: Timeline of the xz open source attack

#28

Post by hk__2 » Tue, Apr 02, 2024, 12:07 PM UTC

See also "Everything I Know About the XZ Backdoor" submitted 4 days ago but updated since then: https://news.ycombinator.com/item?id=39868673

Re: Timeline of the xz open source attack

#29

Post by tommiegannert » Tue, Apr 02, 2024, 12:14 PM UTC

lukaslalinsky wrote: post #24

The social side of this is really haunting me over the last days. It's surprisingly easy to pressure people to giving up control. I've been there myself. I can't even imagine how devastating this must be to the original author of XZ, especially if he is dealing with other personal issues as well. I hope at least this will serve a strong example to other open source people, to never allow others to pressure them into…

The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned.

I wonder if it would be possible to crowdsource FOSS mailing list moderation.

Re: Timeline of the xz open source attack

#30

Post by acdha » Tue, Apr 02, 2024, 12:19 PM UTC

OJFord wrote: post #15

XorNot wrote: post #8

What stands out to me is this particular justification: > 2024-02-23: Jia Tan merges hidden backdoor binary code well hidden inside some binary test input files. The associated README claims “This directory contains bunch of files to test handling of .xz, .lzma (LZMA_Alone), and .lz (lzip) files in decoder implementations. Many of the files have been created by hand with a hex editor, thus there is no better "source…

Also that when dynamically linking A against B, A apparently gets free reign to overwrite B. It sort of makes sense, since at the end of the day it could just be statically linked or implement B's behaviour itself and do whatever it wants, but it's not really what you expect is it.

Yeah, that part struck me as something we should be able to block - the number of times where you actually want that must be small enough to make it practical do something like write-protect pages with a small exception list.