Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Timeline of the xz open source attack

research.swtch.com

Post reply on HN
Print view View original

41–50 of 482 posts

Re: Timeline of the xz open source attack

#41

Post by resource_waste »

mseepgood wrote: post #7

Never allow yourself to be bullied or pressured into action. As a maintainer, the more a contributor or user nags, the less likely I am to oblige.

That sounds nice.

I did an engineering/program manager role for 8 years and people pretty much always did what I asked if I showed up at their desk or bothered their boss.

"Squeaky wheel gets the grease?"

But I too like to think that I prioritize my children on merit rather than fuss level. For some reason they continue to cry despite me claiming I don't react to it.

Re: Timeline of the xz open source attack

#42

Post by kevindamm »

mcpherrinm wrote: post #35
kevindamm wrote: post #25

Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary). I believe this means it was unauthorized, not unauthenticated.

I think it is unauthenticated from the point of view of SSH’s own authentication. The backdoor has its own credential, but the RCE is accessible if you don’t have an account on the system.

That's the basis for my preferring the term relating to authorization. The two terms have distinct and well-defined meanings in the domain. They're both critical aspects of security but for different reasons.

Re: Timeline of the xz open source attack

#43

Post by asvitkine »

exacube wrote: post #38

Is the real identity of Jia Tan known, even by Lasse Collin? I would think a "real identity" should be required by linux distros for all /major/ open source projects/library committers which are included in the distro, so that we can hold folks legally accountable

How would that even work? Are distros expected to code their own alternative versions of open source libraries where they can't get the maintainers to send their IDs? Or what stops from forged IDs being used?

Re: Timeline of the xz open source attack

#44

Post by gquere »

exacube wrote: post #38

Is the real identity of Jia Tan known, even by Lasse Collin? I would think a "real identity" should be required by linux distros for all /major/ open source projects/library committers which are included in the distro, so that we can hold folks legally accountable

This will never be accepted by the community.

Re: Timeline of the xz open source attack

#45

Post by rsc »

exacube wrote: post #38

Is the real identity of Jia Tan known, even by Lasse Collin? I would think a "real identity" should be required by linux distros for all /major/ open source projects/library committers which are included in the distro, so that we can hold folks legally accountable

Open source fundamentally does not work that way. There are many important open source contributors who work pseudonymously.

Google's Know, Prevent, Fix blog post floated the idea of stronger identity for open source in https://security.googleblog.com/2021/02/know-prevent-fix-fra... and there was very significant pushback. We learned a lot from that.

The fundamental problem with stronger identity is that spy agencies can create very convincing ones. How are distros going to detect those?

Re: Timeline of the xz open source attack

#46

Post by kevindamm »

rsc wrote: post #32
kevindamm wrote: post #25

Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary). I believe this means it was unauthorized, not unauthenticated.

"unauthenticated remote code execution" is a fairly standard term for this kind of access. ( https://www.google.com/search?q=%22unauthenticated+remote+co... )

Fairly standard term for a kind of access similar to this, but the distinction is important.

Consider the impact if anybody else, not just this attacker, could have exploited it -- on the other hand, it may have been discovered sooner (had it also not been discovered by accident first).

Re: Timeline of the xz open source attack

#47

Post by gawa »

Excellent summary of the events, with all the links in one place. This is the perfect resource for anyone who want to catch up, and also to learn about how such things (especially social engineering) unfold in the wild, out in the open.

One thing that could be added, for the sake of completeness: in the part "Attack begins", toward the end, when they are pushing for updating xz in the major distros, Ubuntu and Debian are mentioned but not Fedora.

Looks like the social engineering/pressuring for Fedora started at least weeks before 2024 March 04, according to a comment by @rwmj on HN [1]. I also found this thread on Fedora's devel list [2], but didn't dig too much.

[1] https://news.ycombinator.com/item?id=39866275

[2] https://lists.fedoraproject.org/archives/list/devel@lists.fe...

Re: Timeline of the xz open source attack

#48

Post by meowface »

jrochkind1 wrote: post #31

This seems very difficult to defend against. What is a project with a single burnt-out committer to do?

As a burnt out creator of open source projects with thousands of GitHub stars who's received numerous questionable maintainership requests: either very carefully vet people or let it stagnate. I chose the latter and just waited until others forked it, in large part because I didn't want to be responsible for someone hijacking the project to spread malware.

If I had ever received a request from a well-known figure with a longstanding reputation, who's appeared in-person at talks and has verifiable employment, I might've been more receptive. But all the requests I got were from random internet identities that easily could've been fabricated, and in any case had no previous reputation. "Jia Tan" and their other sockpuppets very likely are not their real identities.

Re: Timeline of the xz open source attack

#49

Post by goku12 »

tommiegannert wrote: post #29
lukaslalinsky wrote: post #24

The social side of this is really haunting me over the last days. It's surprisingly easy to pressure people to giving up control. I've been there myself. I can't even imagine how devastating this must be to the original author of XZ, especially if he is dealing with other personal issues as well. I hope at least this will serve a strong example to other open source people, to never allow others to pressure them into…

The Jigar Kumar nudges are so incredibly rude. I would have banned the account, but perhaps they contributed something positive as well that isn't mentioned. I wonder if it would be possible to crowdsource FOSS mailing list moderation.

There is a good chance that everyone in that thread except the original maintainer is in on the act. It's likely that all those accounts are managed by a single person or group. Targeting just one account for rudeness isn't going to help, if that's true.

Re: Timeline of the xz open source attack

#50

Post by Denvercoder9 »

arrowsmith wrote: post #39
wufocaculura wrote: post #14

Earlier quoted context omitted.

There's a single dot in a line between #include and void my_sandbox(void). It is easy to miss, but makes the compile to fail, thus resulting in HAVE_LINUX_LANDLOCK to be never enabled.

Can someone explain to n00bs like me: what's "landlock" anyway and why is it significant here?

It's a Linux Security Module that allows to sandbox processes: https://docs.kernel.org/userspace-api/landlock.html
Post reply on HN