Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

781–790 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#781

Post by unethical_ban »

jethro_tell wrote: post #142
bawolff wrote: post #80

Earlier quoted context omitted.

I mean, a backdoor at this scale (particularly if it wasn't noticed for a while and got into stable distros) could be worth millions. Maybe hundreds of millions (think of the insider trading possibilities alone, not to mention espionage). 2 years doesn't seem like that much work relative to the potential pay off. This is the sort of case where america's over the top hacking laws make sense.

And what law would you use to target someone who wrote some code and posted it for free on the internet that was willingly consumed?

Are you suggesting intent is impossible to determine?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#782

Post by Lockal »

circusfly wrote: post #351

Waiting for the new YouTube videos on this. "Woah! Linux has a back door dudes!". My distribution, Ubuntu (now Kubuntu) 2022 isn't affected.

Still better than TwoMinuteToiletPapers and other AI-bamboozled channels hyping over proprietary OpenAI crap (text/photo/video), what a time to be alive!

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#784

Post by cbolton »

Epa095 wrote: post #710

I hope Lasse Collin is doing OK! Here is a older message from him [1] "I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. It's also good to keep in mind that this is an unpaid hobby project. " Gi…

In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offer to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#785

Post by hulitu »

szundi wrote: post #257
move-on-by wrote: post #87

Fascinating. Just yesterday the author added a `SECURITY.md` file to the `xz-java` project. > If you discover a security vulnerability in this project please report it privately. *Do not disclose it as a public issue.* This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released. Reading that in a different light, it says giv…

How many of people like this one exist?

> How many of people like this one exist?

I guess every 3 letter agency has at least one. You can do the math. They havent't learned anything after Solar Winds.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#786

Post by Sebb767 »

reisse wrote: post #775
junon wrote: post #514

Earlier quoted context omitted.

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

> EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. Why? Isn't it better to freeze them and let as many people as possible analyze the code?

You can still find the source everywhere, if you look for it. Having a fine-looking page distribute vulnerable source code is a much bigger threat.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#787

Post by junon »

reisse wrote: post #775
junon wrote: post #514

Earlier quoted context omitted.

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

> EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. Why? Isn't it better to freeze them and let as many people as possible analyze the code?

Good question, though I can imagine they took this action for two reasons:

1. They don't have the ability to freeze repos (i.e. would require some engineering effort to implement it), as I've never seen them do that before.

2. Many distros (and I assume many enterprises) were still linking to the GitHub releases to source the infected tarballs for building. Disabling the repo prevents that.

The infected tarballs and repo are still available elsewhere for researchers to find, too.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#789

Post by Decabytes »

So when are we going to stop pretending that OSS maintainers/projects are reaping what they sow when they "work for free" and give away their source code away using OSS licensed software, while large companies profit off of them? If they were paid more (or in some cases even actually paid), then they could afford to quit their day jobs, reducing burn out, they could actually hire a team of trusted vetted devs instead of relying on the goodwill of strangers who step up "just to help them out" and they could pay security researchers to vet their code.

Turns out burned out maintainers are a great attack vector and if you are willing to play the long game you can ingratiate yourself with the community with your seemingly innocuous contributions.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#790

Post by Bulat_Ziganshin »

juliusdavies wrote: post #634
yieldcrv wrote: post #105

Earlier quoted context omitted.

I wonder who the target was!

Every Linux box inside AWS, Azure, and GCP and other cloud providers that retains the default admin sudo-able user (e.g., “ec2”) and is running ssh on port 22. I bet they intended for their back door to eventually be merged into the base Amazon Linux image.

my understanding is that any Debian/RPM-based Linux running sshd would become vulnerable in a year or two. The best equivalent of this exploit is the One Ring.

So the really strange thing is why they put so little effort into making this undetectable. All they needed was to make it use less time to check each login attempt.

Post reply on HN