Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

401–410 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#401

Post by AnonymousPlanet »

zeroCalories wrote: post #333
port443 wrote: post #313

I think its much more likely this was not a bad actor, given their long history of commits. It's a known fact that China will "recruit" people to operate them. A quote: > They talk to them, say my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you have family back there? Would you like your family to stay alive? Is your loyalty to this temporary employer or is your loyalty to…

I think we should seriously consider something like a ts clearance as mandatory for work on core technologies. Many other projects, both open and closed, are probably compromised by foreign agents.

That's a very US centric view and would practically split the open source community along the atlantic at best and fracture it globally at worst. Be careful what you wish for.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#402

Post by ang_cire »

cjbprime wrote: post #354
ncr100 wrote: post #258

Earlier quoted context omitted.

Security Researchers : Is this request-for-private-disclosure + "90-days before public" reasonable? It's a SEVERE issue, to my mind, and 90 days seems too long to me.

In this particular case, there is a strong reason to expect exploitation in the wild to already be occurring (because it's an intentional backdoor) and this would change the risk calculus around disclosure timelines. But in the general case, it's normal for 90 days to be given for the coordinated patching of even very severe vulnerabilities -- you are giving time not just to the project maintainers, but to the users…

As someone in security who doesn't work at a major place that get invited to the nice pre-notification notifications, I hate this practice.

My customers and business are not any less important or valuable than anyone else's, and I should not be left being potentially exploited, and my customers harmed, for 90 more days while the big guys get to patch their systems (thinking of e.g. Log4J, where Amazon, Meta, Google, and others were told privately how to fix their systems, before others were even though the fix was simple).

Likewise, as a customer I should get to know as soon as someone's software is found vulnerable, so I can then make the choice whether to continue to subject myself to the risk of continuing to use it until it gets patched.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#403

Post by [deleted] »

Johnny555 wrote: post #331
port443 wrote: post #313

I think its much more likely this was not a bad actor, given their long history of commits. It's a known fact that China will "recruit" people to operate them. A quote: > They talk to them, say my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you have family back there? Would you like your family to stay alive? Is your loyalty to this temporary employer or is your loyalty to…

Isn't that still a "bad actor" even if they are coerced into it?

[deleted]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#404

Post by masklinn »

leosanchez wrote: post #382
returningfory2 wrote: post #305

Another interesting data point: about 2 years ago there was a clear pressure campaign to name a new maintainer: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... At the time I thought it was just rude, but maybe this is when it all started.

How many people are involved in this ?

Could be just a single person with a bunch of identities.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#405

Post by treffer »

jwilk wrote: post #370
treffer wrote: post #99

Earlier quoted context omitted.

Ubuntu still ships 5.4.5 on 24.03 (atm). I did a quick diff of the source (.orig file from packages.ubuntu.com) and the content mostly matched the 5.4.5 github tag except for Changelog and some translation files. It does match the tarball content, though. So for 5.4.5 the tagged release and download on github differ. It does change format strings, e.g. +#: src/xz/args.c:735 +#, fuzzy +#| msgid "%s: With --format=raw,…

"#, fuzzy" means the translation is out-of-date and it will be discarded at compile time.

I tried to get the translation to trigger by switching to french and it does not show. You are right.

So it's just odd that the tags and release tarballs diverge.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#406

Post by rom1v »

alright2565 wrote: post #111

https://github.com/tukaani-project/tukaani-project.github.io... > Note: GitHub automatically includes two archives Source code (zip) and Source code (tar.gz) in the releases. These archives cannot be disabled and should be ignored. The author was thinking ahead! Latest commit hash for this repo: 8a3b5f28d00ebc2c1619c87a8c8975718f12e271

Btw, this is not the only project providing a source tarball different from the git repo, for example libusb also does this (and probably others):

- https://github.com/libusb/libusb/issues/1468#issuecomment-19...

- https://github.com/orgs/community/discussions/6003

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#407

Post by ikmckenz »

MaximilianEmel wrote: post #311

Has this affected OpenBSD at all?

Seems the backdoor relied on Debian and others patching their copies of openssh to support systemd notifications, and this would obviously not be the case on OpenBSD.

To be sure the current ports version of xz is 5.4.5: https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/a...

Although the maintainer was working on updating to 5.6.1, but this news broke before the diff was landed: https://marc.info/?l=openbsd-ports&m=171174441521894&w=2

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#408

Post by rany_ »

Zigurd wrote: post #400

"Lasse Collin," as other posters here have found, does not seem to exist as an experienced coder. Oddly, there is a Swedish jazz musician named Lasse Collin, which would otherwise be one of those names, especially the last name, that would stick out. Instead it is buried under a lot of mentions of a musician.

Searching for my real name on Google doesn't return anything either, I don't think this means anything.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#409

Post by yabones »

vasili111 wrote: post #367

Could anyone please tell me if current stable version of Debian has that backdoor or not?

Debian stable has 5.4.1, the backdoored versions are 5.6.0-5.6.1

https://packages.debian.org/bookworm/xz-utils

https://packages.debian.org/bookworm/liblzma5

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#410

Post by Terr_ »

Johnny555 wrote: post #331
port443 wrote: post #313

I think its much more likely this was not a bad actor, given their long history of commits. It's a known fact that China will "recruit" people to operate them. A quote: > They talk to them, say my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you have family back there? Would you like your family to stay alive? Is your loyalty to this temporary employer or is your loyalty to…

Isn't that still a "bad actor" even if they are coerced into it?

For the purposes of security discussions, I would say yes. You often don't know their real identity let alone their motivations and tribulations.

However if we were critiquing characters in a book-- especially ones where narrative voice tells us exactly their true motivations--then maybe not, and they get framed as a "dupe" or "manipulated" etc.

Post reply on HN