Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

721–730 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#721
post #480
post #443

Kinda relevant, as I saw few comments about how safer languages are the solution. Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1]. [0] - https://github.com/c-skills/rust1 [1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...

I am very concerned about Rust. Rust’s “decision” to have a very slim standard library has advantages, but it severely amplifies some other issues. In Go, I have to pull in zero dependencies to make an HTTP request. In Rust, pulling reqwest pulls in at least 30 distinct packages ( https://lib.rs/crates/reqwest ). Date/time, “basic” base64, common hashing or checksums, etc, they all become supply chain vectors. The Ru…

Or you vendor everything.

You don't automatically download anything at build or install time, you just update your local source copies when you want to. Which to be clear I know means rarely.

It's 1970 all over again!

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#722
Comment from Andres Freund on how and why he found it [0] and more information on the LWN story about the backdoor. Recommend people read this to see how close we came (and think about what this is going to mean for the future).

[0] https://lwn.net/Articles/967194/

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#723

Earlier quoted context omitted.

I imagine it might be easier to just compromise a weakly protected account than to actual put in a 2 years long effort with real contributions. If we mandated MFA for all contributors who contribute to these really important projects then we can know with greater certainty if it was really a long con vs. a recently compromised account.

they might not have been playing the long con. maybe approached by actors willing to pay them a lot of money to try and slip in a back door. I'm sure a deep dive into code contributions would clear that up for anyone familiar with the code base and some free time.

They did fuck up quite a bit though. They injected their payload before they checked if oss-fuzz or valgrind or ... would notice something wrong. That is sloppy and should have been anticipated and addressed BEFORE activating the code.

Anyway. This team got caught. What are the odds that this state-actor that did this, that this was the only project / team / library that they decided to attack?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#724

TLDR: Some people have been throwing around “China,” but it seems also quite possible that Jia is from somewhere in Eastern Europe pretending to be from China. In addition, Lasse Collin and Hans Jansen are from the same EET time zone. These are my notes on time stamps/zones. There are a few interesting bits that I haven't fully fleshed out. The following analysis was conducted on JiaT75’s ( https://github.com/JiaT75?…

This 2011 addition to the XZ Utils Wikipedia page is interesting because a) why is this relevant, b) who is Mike Kezner since he's not mentioned on the Tukaani project page (https://tukaani.org/about.html) under "Historical acknowledgments".

https://en.wikipedia.org/w/index.php?title=XZ_Utils&diff=pre...

Arch Linux played an important role in making this compression software trusted and depended upon. Perhaps not a coincidence, but at the very least, such a big project should more carefully consider the software they distribute and rely on, whether it's worth the risk.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#727
post #514
post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

FWIW, that's mingw-w64-xz (cross-compiled xz utils) in AUR, not ming-w64 (which would normally refer to the compiler toolchain itself).

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#728

TLDR: Some people have been throwing around “China,” but it seems also quite possible that Jia is from somewhere in Eastern Europe pretending to be from China. In addition, Lasse Collin and Hans Jansen are from the same EET time zone. These are my notes on time stamps/zones. There are a few interesting bits that I haven't fully fleshed out. The following analysis was conducted on JiaT75’s ( https://github.com/JiaT75?…

You say yourself that the time data could be tampered. It's trivial to change commit dates in git. So this analysis means nothing by itself, unfortunately.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#729
post #720

Earlier quoted context omitted.

Every single commit this person ever did should immediately be rolled back in all projects.

I don’t thinks that’s necessary: there are enough eyes on this person’s work now.

No one will do it seriously
Post reply on HN