Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

341–350 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#341

Post by fullstop »

mrb wrote: post #214
AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it co…

If anyone here happens to know Lasse, it might be good to check up on him and see how he's doing.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#342

Post by cesarb »

zeroCalories wrote: post #333
port443 wrote: post #313

I think its much more likely this was not a bad actor, given their long history of commits. It's a known fact that China will "recruit" people to operate them. A quote: > They talk to them, say my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you have family back there? Would you like your family to stay alive? Is your loyalty to this temporary employer or is your loyalty to…

I think we should seriously consider something like a ts clearance as mandatory for work on core technologies. Many other projects, both open and closed, are probably compromised by foreign agents.

> I think we should seriously consider something like a ts clearance as mandatory for work on core technologies.

Was xz/lzma a core technology when it was created? Is my tiny "constant time equality" Rust crate a core technology? Even though it's used by the BLAKE3 crate? By the way, is the BLAKE3 crate a core technology? Will it ever become a core technology?

With free software in general, things do not start a "core technology"; they become a "core technology" over time due to usage. At which point would a maintainer have to get a TS clearance? Would the equivalent of a TS clearance from my Latin America country be acceptable? And how would I obtain it? Is it even available to people outside the military and government (legit question, I never looked)?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#343

Post by fransje26 »

cpach wrote: post #169
fransje26 wrote: post #112

Earlier quoted context omitted.

I did notice that my debian-based system got noticeably slower and unresponsive at times the last two weeks, without obvious reasons. Could it be related? I read through the report, but what wasn't directly clear to me was: what does the exploit actually do? My normal internet connection has such an appalling upload that I don't think anything relevant could be uploaded. But I will change my ssh keys asap.

Are you on stable/testing/unstable? With our current knowledge, stable shouldn’t be affected by this.

Stable, luckily. Thank you for the information.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#344

Post by offmycloud »

buildbot wrote: post #86
PedroBatista wrote: post #77

Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people. My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both ) Getting pun…

In the article it says CISA was notified - that sounds like it's going to be a federal investigation if nothing else. If I was this person, I wouldn't be in the USA (or any US friendly nation) ASAP.

CISA Advisory: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-...

Note that it say "Fedora 41" in the CISA page link to Red Hat, but Red Hat changed the blog title to "Fedora 40" and left the HTML page title as "Fedora 41".

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#345

Post by fransje26 »

anarazel wrote: post #151
fransje26 wrote: post #112

Earlier quoted context omitted.

I did notice that my debian-based system got noticeably slower and unresponsive at times the last two weeks, without obvious reasons. Could it be related? I read through the report, but what wasn't directly clear to me was: what does the exploit actually do? My normal internet connection has such an appalling upload that I don't think anything relevant could be uploaded. But I will change my ssh keys asap.

> I did notice that my debian-based system got noticeably slower and unresponsive at times the last two weeks, without obvious reasons. Could it be related? Possible but unlikely. > I read through the report, but what wasn't directly clear to me was: what does the exploit actually do? It injects code that runs early during sshd connection establishment. Likely allowing remote code execution if you know the right magi…

Thank you for the explanation.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#348

Post by Delk »

mrb wrote: post #214
AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it co…

> I wouldn't be surprised if the state actor interfered with Lasse somehow

People could also just get tired after years of active maintainership or become busier with life. Being the sole maintainer of an active open source project on top of work and perhaps family takes either a lot of enthusiasm or a lot of commitment. It's not really a given that people want to (or can) keep doing that forever at the same pace.

Someone then spots the opportunity.

I have no idea what the story is here but it might be something rather mundane.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#349

Post by mikolajw »

Tukaani website states "jiatan" as the nickname of the malicious code committer on Libera Chat.

WHOWAS jiatan provided me the following information:

jiatan ~jiatan 185.128.24.163 * :Jia Tan jiatan 185.128.24.163 :actually using host jiatan jiatan :was logged in as jiatan tungsten.libera.chat :Fri Mar 14:47:40 2024

WHOIS yields nothing, the user is not present on the network at the moment.

Given that 185.128.24.163 is covered with a range-block on the English Wikipedia, it appears this is a proxy.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#350

Post by bombcar »

soneil wrote: post #282
weinzierl wrote: post #189

The backdoor is not in the C source directly, but a build script uses data from files in the test dir to only create the backdoor in the release tars. Did I summarize that correctly?

That's how I understand it. A build script that's in the releases tarballs but not the git repo, checks to see if it's being run as part of the debian/build or rpm build processes, and then injects content from one of the "test" files.

I could imagine another similar attack done against an image processing library, include some "test data" of corrupted images that should "clean up" (and have it actually work!) but the corruption data itself is code to be run elsewhere.
Post reply on HN