Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

41–50 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#41

Post by lyu07282 »

xorvoid wrote: post #7
atomicnumber3 wrote: post #4

The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."

Maybe I’m just being naive or too trusting, but this is sort of what I think when folks are getting worried about other backdoors like this in the wild. Is it that they just got unlucky to get caught, or is this type of attack just too hard to pull off in practice? I’d like to think the later. But, we really don’t know.

One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane technical details.

This may be confirmed by regular vulnerabilities that are found in sometimes many decades old software, since vulnerabilities are much harder to find than backdoors. For example shellshock was 30 year old code, PwnKit 12 and log4j was ~10 ish.

So if backdoors were commonplace, we probably would've found more by now.

Perhaps that's changing now, the xz backdoor will for sure attract many copycats.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#43

Post by bilekas »

aeyes wrote: post #40
bilekas wrote: post #20

Without having a Twitter account I have a really hard time following these threads. Is there some write up? Edit : Check comments. Yes, the backdoor hasn't been decompiled/reverse engineered yet. But it feels like clickbait to say : "It goes deeper"... Obviously. Nobody knows what it fully does yet. There was no assumption of knowing what it did.

Short summary is that it allows auth bypass, not just RCE.

Yes, I understand.. It's just not a surprise.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#44

Post by ssl-3 »

TheDudeMan wrote: post #39
atomicnumber3 wrote: post #4

The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."

Yet most murders go unsolved.

Then most murderers are geniuses.

Or most murder investigations are (by definition) incompetent.

Or (more likely): The old idiom quoted above is stupid and useless. (That it presumes that murdering and getting away with it is somehow a noble or esteemed deed should be damning enough.)

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#45

Post by ufmace »

braiamp wrote: post #28
ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

There are thousands of ways that performance can be impacted. No matter how good you are at developing, there will be a workload that would have a performance hit. Phoronix has been several times reporting issues to the Linux kernel because performance regression with their test suite. Performance tests tend to take more time than correctness tests.

Not seeing that as a point. It's probably not possible to have no performance hit whatsoever when you're checking the exact nanosecond count of every little thing. But usually nobody is doing that. It shouldn't be hard to not cause a substantial enough performance regression in SSHD logins that somebody who wasn't already monitoring that would notice and decide to dig into what's going on.

I'm not sure if it's been revealed yet what this thing actually does, but it seems like all it really needs to do is to check for some kind of special token in the auth request or check against another keypair.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#46

Post by mkl »

kibwen wrote: post #35
mkl wrote: post #24

Earlier quoted context omitted.

Ignoring the closed web is not the same as supporting the open web. I support whatever mirrors and tools get closed knowledge into the open. (Edited to remove snark.)

> Choosing ignorance over knowledge If there's some piece of knowledge that's absolutely, positively critical to my life, it will exist somewhere that actually matters, not on Twitter.

Sure, but almost no knowledge that is interesting, valuable, useful, etc., is absolutely, positively critical to your life. Almost nothing on HN has that level of importance, but you are here learning interesting things, and unfortunately the first place some of those things appear is still Twitter.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#47

Post by k8svet »

kibwen wrote: post #35
mkl wrote: post #24

Earlier quoted context omitted.

Ignoring the closed web is not the same as supporting the open web. I support whatever mirrors and tools get closed knowledge into the open. (Edited to remove snark.)

> Choosing ignorance over knowledge If there's some piece of knowledge that's absolutely, positively critical to my life, it will exist somewhere that actually matters, not on Twitter.

I don't even know if that's true, but I don't care. Twitter, at this point, is far more egregious than reddit, and I swore months ago I'd never contribute there. It blows my mind that people still play in Elon's piss-filled sandbox because they love the dopamine hits of bot-inflated engagement metrics.

Yes, you casual reader that keeps posting on Twitter due to laziness and momemtum, I'm absolutely talking about you. Your laziness is hurting everyone. And I'm not alone, you're limiting your audience and prioritizing, well, people too lazy to get off Twitter, and ignoring the technical, prescient (observant, at this point?), informed crowd that have left for elsehwhere. /shrug

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#48

Post by EvanAnderson »

Has anybody done a writeup of the obfuscation in the backdoor itself (not the build script that installs it)? I threw the binary into Ghidra and looked thru the functions it found, but having no familiarity with the ifunc mechanism it uses to intercept execution I have up and set it aside for others.

I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Since it shipped as an opaque binary I assumed at least some of the code would be encrypted with keys we don't have (similar to parts of the STUXNET payload).

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#50

Post by bilekas »

EvanAnderson wrote: post #48

Has anybody done a writeup of the obfuscation in the backdoor itself (not the build script that installs it)? I threw the binary into Ghidra and looked thru the functions it found, but having no familiarity with the ifunc mechanism it uses to intercept execution I have up and set it aside for others. I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Since it shipped as an opa…

No full dissemination of the backdoor itself has been done yet, as for the anti-debug, sure you can avoid things like that with flags. But this was done at compile level so its a bit more tricky.

> I'd have to assume since there's anti-debug functionality that the code is also obfuscated.

Not really, as above it was done at build time.. So you have already set your home up.

It's shown the problems with package managers not taking source from the right place.

Post reply on HN