Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#621

Post by [deleted] »

arp242 wrote: post #137
returningfory2 wrote: post #93

A couple of years ago I wrote a Go library that wraps the xz C code and allows you to do xz compression in Go: https://github.com/jamespfennell/xz About a week ago I received the first PR on that repo, to upgrade to 5.6.1. I thought it was odd to get such a random PR...it's not the same GitHub account as upstream though.

As a bit of an aside, I would never accept a PR like this, and would always update $large_vendored_dependency myself. This is unreviewable, and trivial to insert any backdoor (unless you go through the motions of updating it yourself and diffing, at which point the PR becomes superfluous). I'd be wary even from a well-known author unless I knew them personally on some level (real-life or via internet). Not that I wou…

[deleted]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#622

Post by mhh__ »

qecez wrote: post #526
rpigab wrote: post #361

I'd love to be at Microsoft right now and have the power to review this user's connection history to Github, even though VPN exists, many things can be learned from connection habits, links to ISPs, maybe even guess if VPNs were used, roundtrip time on connections can give hints. I really don't think some random guy wants to weaken ssh just to extract some petty ransomware cash from a couple targets.

> I really don't think some random guy wants to weaken ssh just to extract some petty ransomware cash from a couple targets. Which is why there's probably nothing remotely interesting in them logs.

Intelligence agencies get caught red handed all the time so I wouldn't be too sure.

If it was an organised group I'm sure they were careful, of course, but it only takes one fuckup.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#623

Post by dzaima »

CGamesPlay wrote: post #582

Why has Github disabled the (apparently official) xz repository, but left the implicated account open to the world? It makes getting caught up on the issue pretty difficult, when GitHub has revoked everyone's access to see the affected source code. https://github.com/tukaani-project/xz vs https://github.com/JiaT75

The account has been suspended for a while, but for whatever reason that's not displayed on the profile itself (can be seen at https://github.com/Larhzu?tab=following). Repo being disabled is newer, and, while annoying and realistically likely pointless, it's not particularly unreasonable to take down a repository including a real backdoor.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#624

Post by dang »

AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

We detached this subthread from https://news.ycombinator.com/item?id=39866275. (It's fine; I'm just trying to prune the top-heavy subthread.)

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#625

Post by w4ffl35 »

jonathanspw wrote: post #154
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

Yesterday sure was fun wasn't it :p Thanks for all your help/working with me on getting this cleaned up in Fedora.

Is it normal that when I try to uninstall xz it is trying to install lzma?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#626

Post by snvzz »

formerly_proven wrote: post #132
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

I think this has been in the making for almost a year. The whole ifunc infrastructure was added in June 2023 by Hans Jansen and Jia Tan. The initial patch is "authored by" Lasse Collin in the git metadata, but the code actually came from Hans Jansen: https://github.com/tukaani-project/xz/commit/ee44863ae88e377... > Thanks to Hans Jansen for the original patch. https://github.com/tukaani-project/xz/pull/53 There were…

>Hans Jansen and Jia Tan

Are they really two people conspiring?

Unless proven otherwise, it is safe to assume one is just a pseudonym alias of the other.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#627

Post by gowthamgts12 »

sroussey wrote: post #426
0xthr0w4 wrote: post #339

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

OMG: look at the other contributions. He is trying to take over projects and pushing some change to sha256 in a hundred projects. Example: https://github.com/duesee/imap-flow/issues/96

reported the account to github, just in case.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#628

Post by [deleted] »

rdtsc wrote: post #334
oxymoron290 wrote: post #301

Jai Tan's commit history on his github profile suggests he took off for Christmas, new years, and spring break. I smell an American.

Sometimes you smell an American because someone wanted you to smell an American. Operating on a target region schedule doesn't seem particularly sophisticated, at least compared to the all the efforts put into this exploit.

[deleted]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#629

Post by BobbyTables2 »

Why doesn’t GitHub force “releases” to be a simple repo tarball for sources and with binaries from GitHub actions or such…

I find it incredibly ironic that a “version control” site gives no assurance of reproducible builds (nor reproducible source!!)

The real villain is not the perpetrator, it is Microsoft, and it is all of us.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#630

Post by kaliqt »

gopher_space wrote: post #152
eigenvalue wrote: post #129

Earlier quoted context omitted.

Every single commit this person ever did should immediately be rolled back in all projects.

It's weird and disturbing that this isn't the default perspective.

You can't just go and rip out old code, it'll break everything else, you have to review each commit and decide what to do with each.
Post reply on HN