Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

481–490 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#481
post #224

Funny how Lasse Collin started to ccing himself and Jia Tan from 2024-03-20 (that was a day of tons of xz kernel patches), he never did that before. :) https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co...

those pipe usages are quite suspicious https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... pipeing into this shell script which now uses "eval" https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... i guess this will be revisited and removed soon

> pipeing into this shell script which now uses "eval"

I don’t actually see an issue with that `eval`. Why would one consider running `xz` followed by `eval`-ing its output more insecure than just running `xz`? If `xz` wants to do shenanigans with the privileges it already has, then it wouldn’t need `eval`’s help for that.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#483

Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people. My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both ) Getting pun…

In the article it says CISA was notified - that sounds like it's going to be a federal investigation if nothing else. If I was this person, I wouldn't be in the USA (or any US friendly nation) ASAP.

A federal investigation into what, itself? The primary actors doing this type of thing are the US Government.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#484
post #257

Earlier quoted context omitted.

How many of people like this one exist?

If this question had a reliable (and public) answer then the world would be a very different place! That said, this is an important question. We, particularly those us who work on critical infrastructure or software, should be asking ourselves this regularly to help prevent this type of thing. Note that it's also easy (and similarly catastrophic) to swing too far the other way and approach all unknowns with automatic…

Yeah thanks for saying this; I agree. And as cliche as it is to look for a technical solution to a social problem, I also think better tools could help a lot here.

The current situation is ridiculous - if I pull in a compression library from npm, cargo or Python, why can that package interact with my network, make syscalls (as me) and read and write files on my computer? Leftpad shouldn’t be able to install crypto ransomware on my computer.

To solve that, package managers should include capability based security. I want to say “use this package from cargo, but refuse to compile or link into my binary any function which makes any syscall except for read and write. No open - if I want to compress or decompress a file, I’ll open the file myself and pass it in.” No messing with my filesystem. No network access. No raw asm, no trusted build scripts and no exec. What I allow is all you get.

The capability should be transitive. All dependencies of the package should be brought in under the same restriction.

In dynamic languages like (server side) JavaScript, I think this would have to be handled at runtime. We could add a capability parameter to all functions which issue syscalls (or do anything else that’s security sensitive). When the program starts, it gets an “everything” capability. That capability can be cloned and reduced to just the capabilities needed. (Think, pledge). If I want to talk to redis using a 3rd party library, I pass the redis package a capability which only allows it to open network connections. And only to this specific host on this specific port.

It wouldn’t stop all security problems. It might not even stop this one. But it would dramatically reduce the attack surface of badly behaving libraries.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#485

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

[deleted]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#487
Related ongoing threads:

Xz: Disable ifunc to fix Issue 60259 - https://news.ycombinator.com/item?id=39869718

FAQ on the xz-utils backdoor - https://news.ycombinator.com/item?id=39869068

Everything I Know About the XZ Backdoor - https://news.ycombinator.com/item?id=39868673

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#489

I think its much more likely this was not a bad actor, given their long history of commits. It's a known fact that China will "recruit" people to operate them. A quote: > They talk to them, say my friend, I see you like our special menu. Are you from China? Are you here on a VISA? Do you have family back there? Would you like your family to stay alive? Is your loyalty to this temporary employer or is your loyalty to…

A quote from... your arse?

That is what I thought too but it wasn't hard to find:

https://darknetdiaries.com/transcript/21/

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#490
post #480
post #443

Kinda relevant, as I saw few comments about how safer languages are the solution. Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1]. [0] - https://github.com/c-skills/rust1 [1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...

I am very concerned about Rust. Rust’s “decision” to have a very slim standard library has advantages, but it severely amplifies some other issues. In Go, I have to pull in zero dependencies to make an HTTP request. In Rust, pulling reqwest pulls in at least 30 distinct packages ( https://lib.rs/crates/reqwest ). Date/time, “basic” base64, common hashing or checksums, etc, they all become supply chain vectors. The Ru…

You have perfectly put into words, all my thoughts.

I have been thinking about ways to secure myself, as it is exhausting to think about it every time there is an update or some new dependency.

After this attack, I think the only sure way is to unplug the computer and go buy goats.

The next best thing? Probably ephemeral VMs or some Codespaces/"Cloud Dev Env thingy". (except neither would save me in the xz case)

Post reply on HN