Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Timeline of the xz open source attack

research.swtch.com

Post reply on HN
Print view View original

291–300 of 482 posts

Re: Timeline of the xz open source attack

#291

Post by npteljes »

johnny22 wrote: post #254
npteljes wrote: post #159

Earlier quoted context omitted.

>I wonder if it would be possible to crowdsource FOSS mailing list moderation. I think this could be a genuine use of an AI: to go through all of the shit, and have it summarized in a fashion that the user wants: distant and objective, friendly, etc. It could provide an assessment on the general tone, aggregate the differently phrased requests, many things like that. Crowdsourcing would works best with the reddit / h…

A big problem is that people allow this sort of thing as part of the culture. I've followed the Fedora and PHP development mailing lists a few different times over the years ans this sort of thing was tolerated across the board. It doesn't matter if you crowdsource the moderation if nobody thinks the behavior is bad in the first place. Trying to do something about it was called censorship.

I'm sorry I don't understand your point clearly. Why is it a big problem, and whose problem it is?

Re: Timeline of the xz open source attack

#292

Post by tamimio »

This attack doesn’t exploit a technical issue or bug, it exploits the open source philosophy, and unless the community will come up with a systematic process to counter it, expect more sophisticated attacks similar to it in the future. This time we got lucky that some smart nerd -I am a nerd too, this is a praise not to be taken in a bad way- noticed and notified the community in less than 20 days of the second backdoor implementation, next time the attack may undergoes more comprehensive “rehearsals” that it will make it impossible to detect.

Re: Timeline of the xz open source attack

#293

Post by qerti »

gregwebs wrote: post #203

I think this can be made much more difficult by enforcing a policy of open builds for open source. It shouldn't be possible to inject build files from a local machine. All build assets should come from the source repository. Artifacts should come from Github Actions or some other tool that has a clear specification of where all inputs came from. Perhaps Github could play a role in helping to automate any inconvenienc…

Wasn’t the payload in a blob in the tests, which is in the source repo? If you were to clone the repo then build from source, you’d have the backdoor, right? Surely distros aren’t using binaries sent by maintainers

Re: Timeline of the xz open source attack

#294

Post by Hackbraten »

maerF0x0 wrote: post #255
Hackbraten wrote: post #152

Earlier quoted context omitted.

On top of that: A newly-introduced security issue tends to have very limited exploitability, because it's valuable, not-yet well understood, and public exploits are yet to be developed. Compare to that a similar vulnerability in an older package: chances are that everything about it has been learned and is publicly known. Exploits have become a commodity and are now part of every offensive security distro on the plan…

> valuable, not-yet well understood, and public exploits Except in the scenario that is this exact case: Supply chain attacks that are developed with the exploit in mind.

I agree in principle. But even if the backdoor is deliberate (as is the case here), there’s limited risk for the average person. Nobody in their right mind is going to attack Jane Doe and risk burning their multi-million dollar exploit chain.

For an old vulnerability, however, any unpatched system is a target. So the individual risk for the average unpatched system is still orders of magnitude higher than in the former scenario.

Re: Timeline of the xz open source attack

#295

Post by ngruhn »

azemetre wrote: post #204
kibwen wrote: post #197

Earlier quoted context omitted.

That's a great first step, but ready your pitchforks for this next take, because the next step is to completely eliminate Turing-complete languages and arbitrary I/O access from standard build systems. 99.9% of all projects have the capability to be built with trivial declarative rulesets.

Can you explain more in-depth what you mean? I'm also unaware of how you could have declarative rulesets in a non turing-complete language. Sounds like it would be impossible but maybe my thinking is just enclosed and not free.

Haven’t used it much but Dhall is a non Turing complete configuration language: https://dhall-lang.org/

Re: Timeline of the xz open source attack

#296

Post by orkj »

doakes wrote: post #280
nebulous1 wrote: post #278

Earlier quoted context omitted.

Completely conclusive proof? No, but it seems unlikely that there ever would be conclusive proof of such. They don't seem to exist outside of this incident and things related to this. There were multiple people who also don't seem to exist outside of their posts to the xz mailing list applying pressure for the original maintainer to bring Jia on board. This occurred around the time that Jia was first making contact w…

What's your source for the IP addresses?

It's mentioned in one of the first references in this article:

https://boehs.org/node/everything-i-know-about-the-xz-backdo...

IRC activity

Re: Timeline of the xz open source attack

#297

Post by nebulous1 »

doakes wrote: post #280
nebulous1 wrote: post #278

Earlier quoted context omitted.

Completely conclusive proof? No, but it seems unlikely that there ever would be conclusive proof of such. They don't seem to exist outside of this incident and things related to this. There were multiple people who also don't seem to exist outside of their posts to the xz mailing list applying pressure for the original maintainer to bring Jia on board. This occurred around the time that Jia was first making contact w…

What's your source for the IP addresses?

I can't remember where I read that but it would likely have been from a HN link or possibly a comment.

I just found this: https://news.ycombinator.com/item?id=39868773 which is definitely not where I originally read it, but libera is probably ultimately the source

Re: Timeline of the xz open source attack

#298

Post by glitchcrab »

__float wrote: post #230
deathanatos wrote: post #198

> Evan Boehs observes that Jigar Kumar and Dennis Ens both had nameNNN@mailhost email addresses This is the second time I've read this "observation", but this observation is just wrong? Jigar's email is "${name}${number}@${host}", yes, but Dennis's is just "${name}@${host}" — there's not a suffixed number. (There's a 3, but it's just a "leetcode" substitution for the E, i.e., it's semantically a letter.) (They could…

Where are the email addresses visible? I've also seen this a few times, but never the actual addresses.

I couldn't spot email addresses directly in plaintext for those who weren't submitting patches (e.g. Jigar), however if you look at one of the links to his (?) responses then there's a mailto link with the text 'Reply via email'

Re: Timeline of the xz open source attack

#300

Post by [deleted] »

gawa wrote: post #47

Excellent summary of the events, with all the links in one place. This is the perfect resource for anyone who want to catch up, and also to learn about how such things (especially social engineering) unfold in the wild, out in the open. One thing that could be added, for the sake of completeness: in the part "Attack begins", toward the end, when they are pushing for updating xz in the major distros, Ubuntu and Debian…

[deleted]
Post reply on HN