It’s wild that days later it still hasn’t been unravelled. For something with so many global eyes on it & in theory the key pieces being available that is quite an achievement in obfuscation
The xz sshd backdoor rabbithole goes quite a bit deeper
281–290 of 310 posts
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#282I often wonder with these sort of things, where there are lots of write-ups by geeks who dive-deep into the details, why do people say "This has to be state sponsored!", "Look at the timestamps! Irrefutable proof!" Yes this was sneaky and yes this was a "slow burn" but is there really anything in the xz case that requires more than just a single competent person? Anything that requires state-level of sponsorship? The…
> "...Irrefutable proof!"
Cite, on that? I have seen a lot of speculation from people in the know, but not this.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#283Earlier quoted context omitted.
So this whole thread is based on the premise that the OP was using the formal definition of "discuss" rather than the informal one? Which is almost certainly not true? Ya'll must be super fun at parties.
Either kind of discussion is useless since the "evidence" (timezone IDs in strings that are not required to have any relation whatsoever with reality) is flimsy to begin with.
LOL. You continue to discuss it.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#284The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…
Events can happen to anyone, even competent state-sponsored organisations. And intelligence agencies are sometimes rather less ruthlessly competent than imagined (Kremlin assisinations in the UK have been a comedy of errors [1]). Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry. [1] https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine..…
Russia wants everyone to know when they do assassinations abroad, that's why they use obviously-Russian methods like polonium and novichok. It's designed to send a message to other Russian dissidents and remind them that they aren't safe
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#285Earlier quoted context omitted.
Change "twitter" to "twiiit" to get a random nitter instance: https://twiiit.com/bl4sty/status/1776691497506623562
No thanks, I support an open web.
The really stupid thing is you have to know you’re missing stuff.
If you’re sent a random link you can’t tell if it’s a one-off or a 45 tweet thread.
It looks open but it’s clearly not.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#286Earlier quoted context omitted.
This refers to the fact that systemd was planning to drop the dependency on liblzma (the conpression library installed by xz), and instead dlopen it at runtime when needed. Not for security reasons, but to avoid pulling the libs into initramfs images. The backdoor relies on sshd being patched to depend on libsystemd to call sd_notify(), which several distros had done. OpenSSH has since merged a new patch upstream tha…
> The backdoor relies on sshd being patched to depend on libsystemd to call sd_notify I remember when we added sd_notify support to our services at work, I was wondering why one would pull in libsystemd as a dependency for this. I mean, there's a pure-Python library [1] that basically boils down to: import os, socket def notify(state=b"READY=1"): sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM) addr = os.geten…
Frankly, I think it is idiotic to require each program to parse an environment variable, open that named file, write a magic string, and all the error handling that that requires -- all for the purpose of having a backchannel between the daemon and its supervisor?
Compare with how s6 does the same thing: instead of passing a random path via an environment variable, it opens the file descriptor itself before exec()ing the binary. All the binary has to do is write a newline to that fd and close it.
No 50 lines of C code needed.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#287Earlier quoted context omitted.
I would be interested in semantic analysis of the communication from the involved online personas, similar to what was done for Satoshi, to point to a cultural direction. Would also be interesting to see if there were semantic style differences over time pointing to different people acting as the personas. Since it would be quite a lot of code that has been committed as well, would also be interesting to see if code…
I fully agree. Stylometry is surprinsingly accurate (as proven on this very forum corpus) and would be quite involved to hide from.
Has anyone studied yet how well this kind of analysis holds up to simply asking GPT to rephrase your words? The whole thing goes out the window if that kind of attack works nowadays.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#288[flagged]
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#289Earlier quoted context omitted.
Either kind of discussion is useless since the "evidence" (timezone IDs in strings that are not required to have any relation whatsoever with reality) is flimsy to begin with.
LOL. You continue to discuss it.
We are quite far in a meta-discussion. Even less useful.