This seems very difficult to defend against. What is a project with a single burnt-out committer to do?
Timeline of the xz open source attack
31–40 of 482 posts
Re: Timeline of the xz open source attack
#32Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary). I believe this means it was unauthorized, not unauthenticated.
"unauthenticated remote code execution" is a fairly standard term for this kind of access.
(https://www.google.com/search?q=%22unauthenticated+remote+co...)
Re: Timeline of the xz open source attack
#33This might not be complete because this statement "More patches that seem (even in retrospect) to be fine follow." lacks some more backing facts. There were more patches before the SSH backdoor, e.g.: "Lasse Collin has already landed four of Jia Tan’s patches, marked by “Thanks to Jia Tan”" and the other stuff before and after the 5.4 release. So far I didn't see someone make a list of all patches and gather various…
I get that there is a reason not to trust those Patches, but I would guess they don't contain anything malicious. This early part of the attack seems to only focus on installing Jia Tan as the maintainer, and they probably didn't want anything there that could tip Lasse Collin off that this "Jia" might be up to something.
Re: Timeline of the xz open source attack
#34I have found JiaT75 - Jia Tan mentioned in Microsoft C++, C, and Assembler as an community contributor ... https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp... Also check this... https://www.abuseipdb.com/check/64.23.252.16
Completely benign documentation change to fix a typo: https://github.com/MicrosoftDocs/cpp-docs/pull/4716 I have no idea what that IP address is supposed to be about...
Regarding the AbuseIPDB link: some of the SSH payloads mentioned in the instances of 'attack' contain the username jiat75.
Doesn't necessarily validate anything though. Could be progressof planting misdirection given that the IP address only started being detected basically today (and the VPS was likely only just setup today as well, if the hostname is to be trusted).
... and that progressof's account is about an hour old.
Re: Timeline of the xz open source attack
#35Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary). I believe this means it was unauthorized, not unauthenticated.
I think it is unauthenticated from the point of view of SSH’s own authentication. The backdoor has its own credential, but the RCE is accessible if you don’t have an account on the system.
Re: Timeline of the xz open source attack
#36This might not be complete because this statement "More patches that seem (even in retrospect) to be fine follow." lacks some more backing facts. There were more patches before the SSH backdoor, e.g.: "Lasse Collin has already landed four of Jia Tan’s patches, marked by “Thanks to Jia Tan”" and the other stuff before and after the 5.4 release. So far I didn't see someone make a list of all patches and gather various…
I get that there is a reason not to trust those Patches, but I would guess they don't contain anything malicious. This early part of the attack seems to only focus on installing Jia Tan as the maintainer, and they probably didn't want anything there that could tip Lasse Collin off that this "Jia" might be up to something.
Yes, exactly. I did look at many of them, and they are innocuous. This is all aimed at setting up Jia as a trusted contributor.
Re: Timeline of the xz open source attack
#37I think this analysis is more interesting if you consider these two events in particular: 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking liblzma into libsystemd.[1] (not in the article) 2024-03-20: The attacker is now a co-contributor for a patchset proposed to the Linux kernel, with the patchset adding the attacker as a maintainer and mirroring the attacker's activity with gaining the trust ov…
Thanks for this comment. I've added that LKML patch set to the timeline.
Re: Timeline of the xz open source attack
#38Is the real identity of Jia Tan known, even by Lasse Collin?
I would think a "real identity" should be required by linux distros for all /major/ open source projects/library committers which are included in the distro, so that we can hold folks legally accountable
Re: Timeline of the xz open source attack
#39How do you get "Jigar Kumar"'s email address? I can't seem to find it in the (web version of) the maillist. Another question: What is the typo exactly in this commit? I can't seem to find it. https://git.tukaani.org/?p=xz.git;a=commitdiff;h=a100f9111c8...
There's a single dot in a line between #include and void my_sandbox(void). It is easy to miss, but makes the compile to fail, thus resulting in HAVE_LINUX_LANDLOCK to be never enabled.
Can someone explain to n00bs like me: what's "landlock" anyway and why is it significant here?
Re: Timeline of the xz open source attack
#40This seems very difficult to defend against. What is a project with a single burnt-out committer to do?
lcamtuf's two posts argue that this may simply not be an open-source maintainer's job to defend against. ("The maintainers of libcolorpicker.so can’t be the only thing that stands between your critical infrastructure and Russian or Chinese intelligence services. Spies are stopped by spies.")
That doesn't mean we shouldn't try to help burnt out committers, but the problem seems very hard. As lcamtuf also says, many things don't need maintenance, and just paying people doesn't address what happens when they just don't want to do it anymore. In an alternate universe with different leadership, an organization like the FSF might use donated funds to pay a maintenance staff and an open-source maintainer might be able to lean on them. Of course, that still doesn't address the problem of Jia Tan getting a job with this organization.
https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-ba... https://lcamtuf.substack.com/p/oss-backdoors-the-allure-of-t...