Another good reason to use a firewall with an IP address allowlist for SSH.
And now for my next trick: smuggling a backdoor into iptables.
XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
561–570 of 862 posts
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#562Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#563We basically need to analyse dependencies used in critical code paths (e.g. network attached services like sshd) and then start a process to add more rigorous controls around them. Some kind of enhanced scrutiny, certification and governance instead of relying on repos with individual maintainers and no meaningful code reviews, branch protection, etc.
And by we I mean at international/governmental level. Free software needs to stop being $free.
Society needs to start paying for the critical foundations upon which we all stand.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#564EDIT: Here's some more RE work on the matter. Has some symbol remapping information that was extracted from the prefix trie the backdoor used to hide strings. Looks like it tried to hide itself even from RE/analysis, too. https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9... Full list of decoded strings here: https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01 -- For someone unfamiliar with openssl…
Mind boggling. How do you even decide what to do with privileges on a billion computers?
There aren’t a billion computers running ssh servers and the ones that do should not be exposed to the general internet. This is a stark reminder of why defense in depth matters.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#565What I’d like to understand is it’s proven intentional? My understanding is it was a few added characters in a header file. I can’t tell you the number of times I was tired and clicked an extra key before committing, or my cat walked across the keyboard while I was out of the room.
It was a few added characters in a header file to make it possible to deliver the actual payload: 80+ kilobytes of machine code. There's no way to actually tell, but I'd estimate the malware source code to be O(10000) lines in C.
It's actually pretty sophisticated. You don't accidentally write a in-memory ELF program header parser.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#566Earlier quoted context omitted.
This was the backdoor we found. We found the backdoor with performance issues. Whats more likely - that this is the only backdoor like this in linux, or that there are more out there and this is the one we happened to find? I really hope someone is out there testing for all of this stuff in linux: - Look for system() calls in compiled binaries and check all of them - Look for uses of IFUNC - specifically when a libra…
All of this was obfuscated. None of this will be detectable with current static analysis techniques.
IFUNC and landlock could be debugged pretty easily at runtime, just by adding some instrumentation.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#567God the amount of damage this would've caused, nightmarish, we are so unbelievably lucky. In a few months it would've been in every deb&rpm distribution. Thank God we found it early!
Found it early?.. I found the backdoor on five of my Vultr servers as well as my MacBook Pro this evening. I certainly didn’t catch it early. So if that’s the state of it, it could very well be too late for many many companies. Not to mention folks who rely on TOR for their safety - there could be entire chains of backdoored entry, middle and exit nodes exposing vast numbers of TOR users over the past month or so (sp…
Which Distro did you use on the affected devices?
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#568Earlier quoted context omitted.
Have to admit I've never understood why password auth is considered so much worse than using a cert - surely a decent password (long, random, etc) is for all practical purposes unguessable, and so you're either using a private RSA key that no-one can guess, or a password that no-one can guess, and then what's the difference? With the added inconvenience of having to pass around a certificate if you want to login to t…
One of the biggest differences is that if you're using password auth, and you are tricked into connecting to a malicious server, that server now has your plaintext password and can impersonate you to other servers. If you use a different strong random password for every single server, this attack isn't a problem, but that adds a lot of management hassle compared to using a single private key. (It's also made more dif…
Not a rhetorical question: couldn't the malicious server relay the challenge from a valid server for to you to sign, and impersonate you that way?
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#569Earlier quoted context omitted.
It certainly isn't just America, though we're probably certainly the most infamous example. I was in France for business once in the countryside (southern France), and the host took everyone (me, their employees, etc.) out to lunch. Far as I could tell it was just an everyday thing. Anyway, we drove about an hour to a nearby village and practically partied for a few hours. Wine flowed like a river. Then we drove back…
> Even Americans usually don't drink that hard; the French earned my respect that day. Is drinking hard something so deserving of respect? Is working while impaired? To me this reads as "I like to fuck off and be irresponsible and man did these French guys show me how it's done!"
Except they weren't irresponsible. We all drove back just fine, and we all went back to work just as competently as before like nothing happened.
It takes skill and maturity to have a good time but not so much that it would impair subsequent duties. The French demonstrated to me they have that down to a much finer degree than most of us have in America, so they have my respect.
This isn't to say Americans are immature, mind you. For every drunk driving incident you hear on the news, hundreds of thousands if not millions of Americans drive home drunk without harming anyone for their entire lives. What I will admit is Americans would still refrain from drinking so much during lunch when we still have a work day left ahead of us, that's something we can take lessons from the French on.
Life is short, so those who can have more happy hours without compromising their duties are the real winners.
Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."
#570Earlier quoted context omitted.
Dynamic linking was a mistake and should be eliminated
That this was dynamically linked is the least interesting thing about it IMO. It was a long term I filtration where they got legitimate commit access to a well used library. If xz was statically linked in some way, or just used as an executa Le to compress something (like the kernel), the same problems exist and no dynamic linking would need to be involved.
Not true, it would be much harder to hook into openssl functions if the final executable was static [1], the only way is that if the openssl function this attack targeted, actually called a function from libxz.
[1] https://sourceware.org/glibc/wiki/GNU_IFUNC
Dynamic loading is relic of the past and cause of many headaches in linux ecosystem, in this case it also just obfuscates the execution path of the code more so you can't really rely on the code you are reading. Unfortunately I don't think it's possible to completely get rid of dynamic loading as some components such as GPU drivers require it, but it should be reduced to minimum.