Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

451–460 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#451

Post by mongol »

rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

Interesting that one of the commits commented on update of the test file that it was for better reproducibility for having been generated by a fixed random seed (although how goes unmentioned). For the future, random test data better be generated as part of the build, rather than being committed as opaque blobs...

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#452

Post by nialv7 »

Aissen wrote: post #179

Looks like one of the backdoor authors even went and disabled the feature the exploit relied on directly on oss-fuzz to prevent accidental discovery: https://social.treehouse.systems/@Aissen/112180302735030319 https://github.com/google/oss-fuzz/pull/10667 But luckily there was some serendipity: "I accidentally found a security issue while benchmarking postgres changes." https://mastodon.social/@AndresFreundTec/112180…

This in of itself can be legitimate. ifunc has real uses and it indeed does not work when sanitizer is enabled. Similar change in llvm: https://github.com/llvm/llvm-project/commit/1ef3de6b09f6b21a...

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#453

Post by akyuu »

Zigurd wrote: post #400

"Lasse Collin," as other posters here have found, does not seem to exist as an experienced coder. Oddly, there is a Swedish jazz musician named Lasse Collin, which would otherwise be one of those names, especially the last name, that would stick out. Instead it is buried under a lot of mentions of a musician.

Lasse Collin has been working on xz for decades: https://sourceforge.net/p/sevenzip/discussion/45797/thread/0...

Now, whether his GitHub account is currently being controlled by him is another question.

Also, for some more context: In 2022, Lasse said he was struggling to work on xz and was looking for maintainers, and mentioned Jia Tan: https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#454

Post by weinberg »

buildbot wrote: post #86
PedroBatista wrote: post #77

Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people. My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both ) Getting pun…

In the article it says CISA was notified - that sounds like it's going to be a federal investigation if nothing else. If I was this person, I wouldn't be in the USA (or any US friendly nation) ASAP.

And I bet if it ended up on a NATO system, things escalate quickly for the person / nation states being scrutinized (https://www.nato.int/cps/en/natohq/topics_78170.htm)

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#455

Post by EthanHeilman »

progbits wrote: post #413
PedroBatista wrote: post #77

Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people. My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both ) Getting pun…

> Getting punched in the face is actually a necessary human condition for a healthy civilization. Aside from signed commits, we need to bring back GPG key parties and web of trust. When using a project you would know how many punches away from the committers you are.

The web of punches?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#456

Post by threeseed »

port443 wrote: post #313

I think its much more likely this was not a bad actor, given their long history of commits. It's a known fact that China will "recruit" people to operate them. A quote: > They talk to them, say my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you have family back there? Would you like your family to stay alive? Is your loyalty to this temporary employer or is your loyalty to…

It's also a known fact that China will coerce people by threatening family and friends.

Seen this happen to friends here in Australia who were attending pro-Taiwan protests.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#457

Post by Nathanba »

jamespo wrote: post #391
returningfory2 wrote: post #305

Another interesting data point: about 2 years ago there was a clear pressure campaign to name a new maintainer: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... At the time I thought it was just rude, but maybe this is when it all started.

"Jigar Kumar" seems to have disappeared

true, that is suspicious as well. A person that hasn't even created any bugs or issues suddenly has a big problem with the speed of development? Especially the way this was phrased: "You ignore the many patches bit rotting away on this mailing list. Right now you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs?"

"Why delay what your repo needs?" This sounds like scammer lingo

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#458

Post by jchoksi »

The two active maintainers seem to be: Lasse Collin and Jia Tan

Searching DDG for "jiat0218" I came across a blog post which I found weird. Seems to be dated: 2006-05-03

Blog post: "Kuso拍賣．有靈氣的筷子 - 闕小豪" https://char.tw/blog/post/24397301>

Internet Archive link: https://web.archive.org/web/20240329182713/https://char.tw/b...>

The contents of the page when translated seems to be about jiat0218 auctioning a pair of spiritual chopsticks as a prank.

The blog entry is basically a QA between jiat0218 and various other people about these chopsticks.

If Jia Tan does turn out to be a compromised maintainer working for a state actor then some of the content on the blog page can be viewed in a more sinister way (i.e. spycraft / hacks for sale etc.).

Example question 38:

    Question 38
    accounta066 (3): Are these chopsticks really that good? I kind of want to buy
    them! But I recently sent money for online shopping but didn’t receive anything.
    It’s very risky; currently jiat0218 you don’t have any reviews, you can
    interview me. Do you want to hand it over?! … A sincere buyer will keep it.
    
    Reply to
    jiat0218 (4): First of all, I would like to express my condolences to you for
    your unfortunate experience! What can I say about this kind of thing...My little
    sister has always been trustworthy. What’s more, this is a pair of spiritual 
    chopsticks, so I hope to have a good one. It’s the beginning! As you can see,
    my little sister is very careful and takes her time when answering your
    questions. Except for the two messages that were accidentally deleted by her,
    she always answers your questions. If this still doesn’t reassure you, then I
    can only say that I still have room to work hard. You are still welcome
    to bid... ^_^
Note however, it could all just be what it purports to be which is a prank auction of spiritual chopsticks.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#459

Post by decoy78 »

ncr100 wrote: post #258
move-on-by wrote: post #87

Fascinating. Just yesterday the author added a `SECURITY.md` file to the `xz-java` project. > If you discover a security vulnerability in this project please report it privately. *Do not disclose it as a public issue.* This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released. Reading that in a different light, it says giv…

Security Researchers : Is this request-for-private-disclosure + "90-days before public" reasonable? It's a SEVERE issue, to my mind, and 90 days seems too long to me.

imho it depends on the vuln. I've given a vendor over a year, because it was a very low risk vuln. This isn't a vuln though - this is an attack.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#460

Post by fragmede »

jchoksi wrote: post #458

The two active maintainers seem to be: Lasse Collin and Jia Tan Searching DDG for "jiat0218" I came across a blog post which I found weird. Seems to be dated: 2006-05-03 Blog post: "Kuso拍賣．有靈氣的筷子 - 闕小豪" https://char.tw/blog/post/24397301 > Internet Archive link: https://web.archive.org/web/20240329182713/https://char.tw/b... > The contents of the page when translated seems to be about jiat0218 auctioning a pair of sp…

Chopsticks could also be a codeword for something. Maybe some sort a backdoor into a system somewhere.
Post reply on HN