Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

211–220 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#211

Post by kemotep »

ffsm8 wrote: post #171
tux3 wrote: post #119

Earlier quoted context omitted.

I think behavioral analysis could be promising. There's a lot of weird stuff this code does on startup that any reasonable Debian package on the average install should not be doing in a million years. Games and proprietary software will sometimes ship with DRM protection layers that do insane things in the name of obfuscation, making it hard to distinguish from malware. But (with only a couple exceptions) there's no…

> No one wants a Linux antivirus ClamAV has been around for a very long time at this point. It's just not installed on servers, usually

To say nothing of enterprise EDR/XDR solutions that have linux versions. These things aren’t bulletproof but can be 1 layer in your multilayer security posture.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#212

Post by [deleted] »

jeroenhd wrote: post #12
junon wrote: post #3

EDIT: Here's some more RE work on the matter. Has some symbol remapping information that was extracted from the prefix trie the backdoor used to hide strings. Looks like it tried to hide itself even from RE/analysis, too. https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9... Full list of decoded strings here: https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01 -- For someone unfamiliar with openssl…

> However, since this is an RCE in the context of e.g. an sshd process itself, this means that sshd running as root would allow the payload to itself run as root. With the right sandboxing techniques, SELinux and mitigations could prevent the attacker from doing anything with root permissions. However, applying a sandbox to an SSH daemon effectively is very difficult.

[deleted]

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#213

Post by pas »

x0x0 wrote: post #143
wepple wrote: post #99

Earlier quoted context omitted.

I expect a lot of people will be doing a whole lot of thinking along these lines over the next months. Code review? Some kind of behavioral analysis? IMO the call to system() was kind of sloppy, and a binary capabilities scanner could have potentially identified a path to that.

[flagged]

libselinux also links to liblzma (and gets into sshd via PAM)

https://news.ycombinator.com/item?id=39867126

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#214

Post by vbezhenar »

rdtsc wrote: post #105
sega_sai wrote: post #95

One have question on this is, if the backdoor would not been discovered due to performance issue (which was as I understood it purely an oversight/fixable deficiency in the code), what are the chances of discovering this backdoor later, or are there tools that would have picked it up? Those questions are IMO relevant to understand if this kind of backdoor is the first one of the kind, or the first one that was uncove…

At least for some comic relief I'd like to imagine Jia's boss slapping him and saying something like "you idiot, we worked on this for so many years and you couldn't have checked for any perf issues?" But seriously, we could have found ourselves with this in all stable repos: RHEL, Debian, Ubuntu, IoT devices 5 years from now and it would have been a much larger shit show.

> But seriously, we could have found ourselves with this in all stable repos: RHEL, Debian, Ubuntu, IoT devices 5 years from now and it would have been a much larger shit show.

Think about backdoors that are already present and will never be found out.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#215

Post by kstrauser »

noncoml wrote: post #14

Unpopular opinion, but I cannot but admire the whole operation. Condemn it of course, but still admire it. It was a piece of art! From conception to execution, masterful! We got extremely lucky that it was caught so early.

I bet it’s not that unpopular. It’s a very impressive attack in many ways:

- It’s subtle.

- It was built to over several years.

- If the attacker hadn’t screwed up the with the weird performance hit that triggered investigation (my dramatic theory: the attacker was horrified at the infonuclear bomb they were detonating and deliberately messed up), we likely wouldn’t know about it.

You can detest the end result while appreciating the complexity of the attack.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#216

Post by treasy »

asveikau wrote: post #206
saltcured wrote: post #180

Earlier quoted context omitted.

You could refactor sshd so most network payload processing is delegated to sandboxed sub-processes. Then an RCE there has less capabilities to exploit directly. But, I think you would have to assume an RCE can cause the sub-process to produce wrong answers. So if the answers are authorization decisions, you can transitively turn those wrong answers into RCE in the normal login or remote command execution context. But…

I thought that OpenSSH's sshd already separates itself into a privileged process and a low-privilege process. I don't know any details about that. Here's what Google showed me for that: https://github.com/openssh/openssh-portable/blob/master/READ...

If you look at the diagram of privsep, the authentication process is part of the privileged binary, which is where this RCE lives

http://www.citi.umich.edu/u/provos/ssh/priv.jpg

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#217

Post by bdd8f1df777b »

almostnormal wrote: post #126
sneak wrote: post #89

The questions this backdoor raises: - what other ones exist by this same team or similar teams? - how many such teams are operating? - how many such dependencies are vulnerable to such infiltration attacks? what is our industry’s attack surface for such covert operations? I think making a graph of all major network services (apache httpd, postgres, mysql, nginx, openssh, dropbear ssh, haproxy, varnish, caddy, squid,…

Why did they decide to create a backdoor, instead of using a zeroday like everyone else? Why did they implement a fully-featured backdoor and attempted to hide the way it is deployed, instead of deploying something innocent-looking that might as well be a bug if detected? These must have been conscious decisions. The reasons might provide a hint what the goals might have been.

Presumably because other people can also utilize the “bug” they create intentionally but looking inadvertently. This backdoor however is activated by the private key only the attacker has so it’s airtight.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#218

Post by dolmen »

mik1998 wrote: post #113
hnarn wrote: post #106

Earlier quoted context omitted.

based on what?

I did my own research. If you look at the git repository commit log and some mailing list messages, you will see that the author ("Jia Tan", fake name) speaks impeccable English (already lessens the chance of being a Chinese operative), however he commits in the +0800 time zone (Beijing). He works during Chinese holidays and doesn't work during Western holidays. However, the times don't make sense: It looks like he w…

Another analysis locates Jia in Eastern Europe: https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

But I would like to see analysis of timestamp of GitHub events (like PRs and comments timestamps) which are harder to fake.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#219

Post by pas »

martinohansen wrote: post #207

Imagine a future where state actors have hundreds of AI agents fixing bugs, gaining reputation while they slowly introduce backdoors. I really hope open source models succeed.

... if we want security it needs trust anyway. it doesn't matter if it's amazing Code GPT or Chad NSA, the PR needs to be reviewed by someone we trust.

it's the trust that's the problem.

web of trust purists were right just ahead of the time.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#220

Post by sitkack »

colinsane wrote: post #122
chris_wot wrote: post #116

Earlier quoted context omitted.

Surely this is something the FBI should be involved with? Or some authority?

sure. what makes you think they aren't?

Why would the FBI investigate the NSA? We have zero idea who the actors involved are.
Post reply on HN