Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

71–80 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#71

Post by bannable »

bilekas wrote: post #50
EvanAnderson wrote: post #48

Has anybody done a writeup of the obfuscation in the backdoor itself (not the build script that installs it)? I threw the binary into Ghidra and looked thru the functions it found, but having no familiarity with the ifunc mechanism it uses to intercept execution I have up and set it aside for others. I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Since it shipped as an opa…

No full dissemination of the backdoor itself has been done yet, as for the anti-debug, sure you can avoid things like that with flags. But this was done at compile level so its a bit more tricky. > I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Not really, as above it was done at build time.. So you have already set your home up. It's shown the problems with package manage…

What do you mean by "package managers not taking source from the right place"?

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#72

Post by dabbledabble »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

It’s also possible that this could be a change in personnel. Maybe the one who earned trust and took over was no more working for them. And an amateur took over with tight deadlines that lead to this gaffe for them.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#73

Post by TheBlight »

kybernetyk wrote: post #68
TheBlight wrote: post #54

Earlier quoted context omitted.

Depends on locale. In Germany something like 90% of murder cases are solved/cleared. In the U.S., I suspect a majority of the murders technically unsolved by police are cases where the identity of the perpetrators is somewhat of an open secret within communities that don't trust law enforcement (and LE similarly has little interest in working with them either.)

>In Germany something like 90% of murder cases are solved You must watch out when reading the German crime statistics. "Solved" which is marked as "aufgeklärt" in those statistics just means that a suspect has been named. Not that someone actually did it/has been sentenced for the crime. > https://de.wikipedia.org/wiki/Aufkl%C3%A4rungsquote#Deutschl... 2nd sentence

Is it reasonable to assume a material number of cleared murders in Germany result in no charges and/or no conviction? (Genuinely curious.)

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#76

Post by pquki4 »

UncleOxidant wrote: post #49

This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.

I'd say the original author should just post something as an article instead of tweets. A blog post. Github md file. Github gist. Even pastebin. I don't care its format or where it is hosted, it does not need to be well formatted and could be as casual as it could be -- I don't expect to read a well-written article, and I know that would take a lot of effort. I just want to see something that is not a series of tweets.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#78

Post by joshmanders »

pquki4 wrote: post #76
UncleOxidant wrote: post #49

This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.

I'd say the original author should just post something as an article instead of tweets. A blog post. Github md file. Github gist. Even pastebin. I don't care its format or where it is hosted, it does not need to be well formatted and could be as casual as it could be -- I don't expect to read a well-written article, and I know that would take a lot of effort. I just want to see something that is not a series of tweet…

> I don't care its format or where it is hosted

Except not formatted as a tweet thread nor hosted on Twitter, right?

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#79

Post by wrs »

pquki4 wrote: post #76
UncleOxidant wrote: post #49

This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.

I'd say the original author should just post something as an article instead of tweets. A blog post. Github md file. Github gist. Even pastebin. I don't care its format or where it is hosted, it does not need to be well formatted and could be as casual as it could be -- I don't expect to read a well-written article, and I know that would take a lot of effort. I just want to see something that is not a series of tweet…

I agree with you 200%, especially because now it’s not only an idiotic format, reading it lends support to Elon’s X (and I no longer have an X account for that reason so can’t read it). But I’m afraid this sentiment long since reached the point of “yelling at clouds”.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#80

Post by creato »

joshmanders wrote: post #78
pquki4 wrote: post #76

Earlier quoted context omitted.

I'd say the original author should just post something as an article instead of tweets. A blog post. Github md file. Github gist. Even pastebin. I don't care its format or where it is hosted, it does not need to be well formatted and could be as casual as it could be -- I don't expect to read a well-written article, and I know that would take a lot of effort. I just want to see something that is not a series of tweet…

> I don't care its format or where it is hosted Except not formatted as a tweet thread nor hosted on Twitter, right?

Twitter is literally unusable if not logged in. All I see is the first tweet, and every link I can find that might reveal the rest of the thread takes me to a login page.
Post reply on HN