This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.
How do they get around the account/resource limits?
The xz sshd backdoor rabbithole goes quite a bit deeper
51–60 of 310 posts
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#52The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…
I thought performance was actually fine? It only dragged when using valgrind, hence the rhetoric that it took some really unlikely circumstances for it to be detected that quickly.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#53Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#54The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."
Yet most murders go unsolved.
Depends on locale. In Germany something like 90% of murder cases are solved/cleared.
In the U.S., I suspect a majority of the murders technically unsolved by police are cases where the identity of the perpetrators is somewhat of an open secret within communities that don't trust law enforcement (and LE similarly has little interest in working with them either.)
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#55Earlier quoted context omitted.
Yet most murders go unsolved.
Then most murderers are geniuses. Or most murder investigations are (by definition) incompetent. Or (more likely): The old idiom quoted above is stupid and useless. (That it presumes that murdering and getting away with it is somehow a noble or esteemed deed should be damning enough.)
Wrong.
There’s no money or benefits in solving crimes. It could be done easily in many cases but nobody cares about certain people like gang members. Lots of cases where the murderer tells everyone but nobody cares.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#56The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…
I read somewhere that some recent changes in systems would've made the backdoor useless so they had to rush out, which caused them to be reckless and get discovered
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#57Earlier quoted context omitted.
> Choosing ignorance over knowledge If there's some piece of knowledge that's absolutely, positively critical to my life, it will exist somewhere that actually matters, not on Twitter.
Sure, but almost no knowledge that is interesting, valuable, useful, etc., is absolutely, positively critical to your life. Almost nothing on HN has that level of importance, but you are here learning interesting things, and unfortunately the first place some of those things appear is still Twitter.
Where does it end, fellow person? What is going to be the excuse/defense/workaround whenever Nitter instances are completely suffocated? Just suck it up and sign up so you can continue to participate on a increasingly hostile, toxic, manipulated platform in service of a narcasists deranged ego? Because Joe Bob Expert is too lazy to post elsewhere? No, I'm sorry, but when is enough, enough?
I know I'm missing out on good content, and I don't care. I have _some_ self-respect.
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#58Has anybody done a writeup of the obfuscation in the backdoor itself (not the build script that installs it)? I threw the binary into Ghidra and looked thru the functions it found, but having no familiarity with the ifunc mechanism it uses to intercept execution I have up and set it aside for others. I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Since it shipped as an opa…
No full dissemination of the backdoor itself has been done yet, as for the anti-debug, sure you can avoid things like that with flags. But this was done at compile level so its a bit more tricky. > I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Not really, as above it was done at build time.. So you have already set your home up. It's shown the problems with package manage…
So ifunc is a link-time thing and not a runtime thing, then? (My background, when it comes to linking, is DOS and Windows.)
Re: The xz sshd backdoor rabbithole goes quite a bit deeper
#59The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…
Events can happen to anyone, even competent state-sponsored organisations. And intelligence agencies are sometimes rather less ruthlessly competent than imagined (Kremlin assisinations in the UK have been a comedy of errors [1]).
Maybe another backdoor, or alternative access mechanism they were using, got closed and they wanted another one in a hurry.
[1] https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...