Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

631–640 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#631

Post by tw04 »

hangonhn wrote: post #255
pfortuny wrote: post #159

Unfortunately, this is how good bad actors work: with a very long-term point of view. There is no “harmless” project any more.

I imagine it might be easier to just compromise a weakly protected account than to actual put in a 2 years long effort with real contributions. If we mandated MFA for all contributors who contribute to these really important projects then we can know with greater certainty if it was really a long con vs. a recently compromised account.

For some random server, sure. For a state sponsored attack? Having an embedded exploit you can use when convenient, or better yet an unknown exploit affecting every linux-based system connected to the internet that you can use when war breaks out - that's invaluable.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#632

Post by yogorenapan »

nullifidian wrote: post #575
stephc_int13 wrote: post #472

I guess that rewriting liblzma in Rust would not have prevented this backdoor. But would have likely increased the confidence in its safety. Using the build system (and potentially the compiler) to insert malicious backdoors is far from a new idea, and I don't see why this example would the only case.

It would have made it worse, because there would be 300 crates with 250 different maintainers, all pulled in by several trivial/baseline dependencies. More dependencies = higher the probability that a malicious maintainer has gotten maintainer's rights for one of them, especially because many original authors/maintainers of rust style microdepencency crates move on with their lives and eventually seek to exit their m…

Why is rust beginning to sound like JavaScript?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#633

Post by Gelob »

indigodaddy wrote: post #580
jnxx wrote: post #477

Earlier quoted context omitted.

And, Joey Hess has counted at least 750 commits to xz from that handle. https://hachyderm.io/@joeyh/112180715824680521 This does not look trust-inspiring. If the code is complex, there could be many more exploits hiding.

Anyone have any level of confidence that for example EL7/8 would not be at risk even if more potential exploits at play?

RedHat blog says no versions of RHEL are affected.

https://www.redhat.com/en/blog/urgent-security-alert-fedora-...

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#634

Post by juliusdavies »

yieldcrv wrote: post #105
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

I wonder who the target was!

Every Linux box inside AWS, Azure, and GCP and other cloud providers that retains the default admin sudo-able user (e.g., “ec2”) and is running ssh on port 22.

I bet they intended for their back door to eventually be merged into the base Amazon Linux image.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#635

Post by gowthamgts12 »

A1kmm wrote: post #577
A1kmm wrote: post #573

Looks like GitHub has suspended access to the repository, which while it protects against people accidentally compiling and using the code, but certainly complicates forensic analysis for anyone who doesn't have a clone or access to history (which is what I think a lot of people will be doing now to understand their exposure).

It looks like git clone https://git.tukaani.org/xz.git still works for now (note: you will obviously be cloning malware if you do this) - that is, however, trusting the project infrastructure that compromised maintainers could have had access to, so I'm not sure if it is unmodified. HEAD (git rev-parse HEAD) on my result of doing that is currently 0b99783d63f27606936bb79a16c52d0d70c0b56f, and it does have commits peo…

> https://git.tukaani.org/xz.git

it's throwing 403 now.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#636

Post by quinncom »

keepamovin wrote: post #39
lpapez wrote: post #20

So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet it takes a developer debugging performance issues to find an actual compromise. I worked in the software supply chain field and cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the bl…

If you installed xz on macOS using brew, then you have xz (XZ Utils) 5.6.1 liblzma 5.6.1 which are within the release target for the vuln. As elsewhere in these comments, people say macOS effect is uncertain. If concerned you can revert to 5.4.6 with brew upgrade xz

Thank you for this tip. `brew upgrade xz` worked.

I was going to uninstall but it's used by so many things…

     brew uninstall xz
    Error: Refusing to uninstall /opt/homebrew/Cellar/xz/5.6.1
    because it is required by aom, composer, curl, ffmpeg, gcc, gd, ghostscript, glib, google-cloud-sdk, grc, harfbuzz, httpie, img2pdf, jbig2enc, jpeg-xl, leptonica, libarchive, libavif, libheif, libraw, libtiff, libzip, little-cms2, numpy, ocrmypdf, openblas, openjpeg, openvino, php, pillow, pipx, pngquant, poppler, python@3.11, python@3.12, rsync, tesseract, tesseract-lang, unpaper, webp, wp-cli, yt-dlp and zstd, which are currently installed.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#637

Post by ta8645 »

bananapub wrote: post #548
mik1998 wrote: post #392

Personally, I use lzip ever since I read https://www.nongnu.org/lzip/xz_inadequate.html Seems like the complexity of XZ has backfired severely, as expected.

> Seems like the complexity of XZ has backfired severely, as expected. this is a very bad reading of the current situation.

This kind of shallow dismissal is really unhelpful to those of us trying to follow the argument. You take a tone of authoritative expert, without giving any illuminating information to help outsiders judge the merit of your assertion. Why is it a very bad reading of the current situation? What is a better reading?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#638

Post by arp242 »

sroussey wrote: post #426
0xthr0w4 wrote: post #339

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

OMG: look at the other contributions. He is trying to take over projects and pushing some change to sha256 in a hundred projects. Example: https://github.com/duesee/imap-flow/issues/96

What? They're just asking for some features there?

Ya'll need to calm down; this is getting silly. Half the GitHub accounts look "suspicious" if you start scrutinizing everything down the the microscopic detail.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#639

Post by thayne »

rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

Do you know if it was actually the commit author, of if their commit access was compromised?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#640

Post by hgs3 »

sylware wrote: post #195

This is why the less the better... even if it means less comfortable... to a certain point obviously. And that includes SDKs...

I don't understand why you were downvoted. Having fewer moving parts does make it easier to catch issues.
Post reply on HN