Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

761–770 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#761

Post by neustradamus »

0xthr0w4 wrote: post #339

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

Dear @0xthr0w4, do you attack me because I have requested the XZ update?

Do not mix, I am not linked to the XZ project.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#762

Post by ColonelPhantom »

c_rrodriguez wrote: post #281

Everybody here In jumping into the pure malice bandwagon, I have a better hypothesis. Abandonment and inaction, the actual developers of these tools are elsewhere, oblivious to this drama, trying to make living because most of the time you are not compensated nor any corporation cares about making things sustainable at all. This is the default status of everything your fancy cloud depends on underneath. An attacker t…

Well, yeah. The attacker, operating largely under the name Jia Tan, has successfully manipulated the original author (Lasse Collin) to become a maintainer.

The attacker indeed laid dormant for two years, pretending to just be maintaining xz.

I really don't see any way how this wasn't malice on Jia's part. But I do think your hypothesis applies to Lasse, who was just happy someone could help him maintain xz.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#763

Post by yreg »

javajosh wrote: post #653
NotPractical wrote: post #251

Earlier quoted context omitted.

> If you're not on a rolling release distro, your version is probably older. Ironic considering security is often advertised as a feature of rolling release distros. I suppose in most instances it does provide better security, but there are some advantages to Debian's approach (stable Debian, that is).

>Ironic considering security is often advertised as a feature of rolling release distros. Security is a feature of rolling release. But supply-chain attacks like this are the exception to the rule.

Isn't that what security-updates-only is for?

This particular backdoor is not shipped inside of a security patch, right?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#765

Post by Randalthorro »

Since GitHub disabled the repos.. I uploaded all GitHub Events from the two suspected users and from their shared project repo as easy to consume CSV files:

https://github.com/emirkmo/xz-backdoor-github

For those who want to see the GitHub events (commits, comments, pull_requets, diffs, etc.)

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#766

Post by WesolyKubeczek »

arp242 wrote: post #47

I've long since said that if you want to hide something nefarious you'd do that in the GNU autoconf soup (and not in "curl | sh" scripts). Would be interesting to see what's going on here; the person who did the releases has done previous releases too (are they affected?) And has commits going back to 2022 – relatively recent, but not that recent. Many are real commits with real changes, and they have commits on some…

> I've long since said that if you want to hide something nefarious you'd do that in the GNU autoconf soup

If I recall correctly, xz can be built with both autoconf and cmake, are cmake configs similarly affected?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#767

Post by kzrdude »

nialv7 wrote: post #452
Aissen wrote: post #179

Looks like one of the backdoor authors even went and disabled the feature the exploit relied on directly on oss-fuzz to prevent accidental discovery: https://social.treehouse.systems/@Aissen/112180302735030319 https://github.com/google/oss-fuzz/pull/10667 But luckily there was some serendipity: "I accidentally found a security issue while benchmarking postgres changes." https://mastodon.social/@AndresFreundTec/112180…

This in of itself can be legitimate. ifunc has real uses and it indeed does not work when sanitizer is enabled. Similar change in llvm: https://github.com/llvm/llvm-project/commit/1ef3de6b09f6b21a...

Because of the exploit, so, why should we use configurations in production that were not covered by these tests?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#768

Post by cypress66 »

zamalek wrote: post #764
kzrdude wrote: post #726

Jia Tan "cleaned up" in all their ZSTD branches some hours ago, probably hiding something https://github.com/JiaT75/zstd/branches/all

Bad move. Destroying evidence is a felony.

If you are this deep into it, it doesn't matter.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#769

Post by jwilk »

Phenylacetyl wrote: post #693
junon wrote: post #514

Earlier quoted context omitted.

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

The alpine patch includes gettext-dev which is likely also exploited as the same authors have been pushing gettext to projects where their changes have been questioned

What do you mean?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#770

Post by aerhardt »

anarazel wrote: post #118
cf100clunk wrote: post #7

I am *not* a security researcher, nor a reverse engineer. There's lots of stuff I have not analyzed and most of what I observed is purely from observation rather than exhaustively analyzing the backdoor code. I love this sort of technical writing from contributors outside the mainstream debugging world who might be averse to sharing. What an excellently summarized report of his findings that should be seen as a templ…

FWIW, it felt intimidating as hell. And I'm fairly established professionally. Not sure what I'd have done earlier in my career (although I'd probably not have found it in the first place).

This story is an incredible testament to how open-source software can self-regulate against threats, and more broadly, it reminds us that we all stand on the shoulders of contributors like you. Thank you!
Post reply on HN