Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

541–550 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#541

Post by pyrolistical »

mrb wrote: post #214
AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it co…

Literally this https://xkcd.com/2347/

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#542

Post by groby_b »

jnxx wrote: post #528
moritonal wrote: post #499

Earlier quoted context omitted.

Warning, drunk brain talking. But a LLM driven email based "collaborator" could play a very long gMw adding basic features to a code made whilst earning trust backed by a generated online presence. My money is on a resurgance in the Web of Trust.

The web of trust is a really nice idea, but it works badly against that kind of attacks. Just consider that in the real world, most living people (all eight billions) are linked by only six degrees of separation. It really works, for code and for trusted social relations (like "I lend you 100 bucks and you pay me them back when you get your salary") mostly when you know the code author in person. This is also not a n…

IIRC, kuro5hin and others all left out a crucial step in the web-of-trust approach: There were absolutely no repercussions when you extended trust to somebody who later turned out to be a bad actor.

It considers trust to be an individual metric instead of leaning more into the graph.

(There are other issues, e.g. the fact that "trust" isn't a universal metric either, but context dependent. There are folks whom you'd absolutely trust to e.g. do great & reliable work in a security context, but you'd still not hand them the keys to your car)

At least kuro5hin modeled a degradation of trust over time, which most models still skip.

It'd be a useful thing, but we have a long way to go before there's a working version.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#543

Post by alwayslikethis »

jchoksi wrote: post #458

The two active maintainers seem to be: Lasse Collin and Jia Tan Searching DDG for "jiat0218" I came across a blog post which I found weird. Seems to be dated: 2006-05-03 Blog post: "Kuso拍賣．有靈氣的筷子 - 闕小豪" https://char.tw/blog/post/24397301 > Internet Archive link: https://web.archive.org/web/20240329182713/https://char.tw/b... > The contents of the page when translated seems to be about jiat0218 auctioning a pair of sp…

This is likely just a coincidence. 0218 looks like a birthday and jiat is probably the name + initial. 18 years is also too long of a time horizon for this.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#544

Post by pornel »

agwa wrote: post #18
asveikau wrote: post #10

That's completely crazy, the backdoor is introduced through a very cryptic addition to the configure script. Just looking at the diff, it doesn't look malicious at all, it looks like build script gibberish.

Thanks to autoconf, we're now used to build scripts looking like gibberish. A perfect place to hide a backdoor.

Maybe it's time to dramatically simplify autoconf?

How long do we need to (pretend to) keep compatibility with pre-ANSI C compilers, broken shells on exotic retro-unixes, and running scripts that check how many bits are in a byte?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#545

Post by jaredallard2 »

returningfory2 wrote: post #93

A couple of years ago I wrote a Go library that wraps the xz C code and allows you to do xz compression in Go: https://github.com/jamespfennell/xz About a week ago I received the first PR on that repo, to upgrade to 5.6.1. I thought it was odd to get such a random PR...it's not the same GitHub account as upstream though.

Hey all, I’m the author of that PR. Just posted to Github with additional context: https://github.com/jamespfennell/xz/pull/2#issuecomment-2027...

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#546

Post by rany_ »

notmysql_ wrote: post #488

Interestingly on of the accounts that the GitHub account who introduced the backdoor follows was suspended very recently [1] who is also part of the org who runs XZ [1] https://github.com/JiaT75?tab=following

That JiaT75 account is also suspended, if you check https://github.com/Larhzu?tab=following you'll see that they're suspended as well. It's pretty weird that it's that hard to find out whether a user is suspended.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#547

Post by bananapub »

dlenski wrote: post #511

A lot of software (including https://gitlab.com/openconnect/openconnect of which I'm a maintainer) uses libxml2, which in turn transitively links to libzma, using it to load and store compressed XML. I'm not *too* worried about OpenConnect given that we use `libxml2` only to read and parse uncompressed XML… But I am wondering if there has been any statement from libxml2 devs (they're under the GNOME umbrella) about p…

> only to read and parse uncompressed XML…

how does libxml2 know to decompress something?

does it require you, as the caller, to explicitly tell it to?

or does it look at the magic bytes or filename or mimetype or something?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#548

Post by bananapub »

mik1998 wrote: post #392

Personally, I use lzip ever since I read https://www.nongnu.org/lzip/xz_inadequate.html Seems like the complexity of XZ has backfired severely, as expected.

> Seems like the complexity of XZ has backfired severely, as expected.

this is a very bad reading of the current situation.

Post reply on HN