Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

bsky.app

Post reply on HN
Print view View original

81–90 of 862 posts

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#81

Post by nemothekid »

BoardsOfCanada wrote: post #59
jeroenhd wrote: post #16

Earlier quoted context omitted.

I already felt like this was way too sophisticated for a random cybercriminal. It's not like making up fake internet identities is very difficult, but someone has pretended to be a good-faith contributor for ages, in a surprisingly long-term operation. You need some funding and a good reason to pull off something like that. This could also be a ransomware group hoping to break into huge numbers of servers, though. Ra…

I would expect a nation state to have better sock puppet accounts though.

>better sock puppet accounts though.

Seems like to me they had perfectly good enough sock puppet accounts. It wasn't at all obvious they were sock puppets until someone detected the expliot.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#82

Post by polio »

StefanBatory wrote: post #50
nocoiner wrote: post #28

Earlier quoted context omitted.

I felt really bad for the original maintainer getting dog-piled by people who berated him for not doing his (unpaid) job and basically just bring shame and discredit to himself and the community. Definitely cruel. Though… do we know that the maintainer at that point was the same individual as the one who started the project? Goes deep, man.

Even if it's not his fault the maintainer at this point won't be trusted at all. I feel for him, I think even finding a job at this moment for him would be impossible. Why would you hire someone that could be suspected for that?

This could've happened to anybody, frankly. The attacker was advanced and persistent. I cannot help but feel sympathetic for the original maintainer here.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#83

Post by icegreentea2 »

TheBlight wrote: post #40
dralley wrote: post #32

Earlier quoted context omitted.

I don't know that they had a singular target necessarily. Much like Solarwinds, they could take their pick of thousands of targets if this had gone undetected.

I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice. I think the attacker had a target in mind…

> Something so valuable it's worth dedicating ~3 years of your life to it?

This isn't the right mindset if you want to consider a state actor, particularly for something like contributing to an open source project. It's not like you had to physically live your cover life while trying infiltrate a company or something.

Yes, this is a lot of resources to spend, but at the same, even dedicating one whole FTE 3 years isn't that much resources. It's just salary at that point.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#85

Post by qudat »

codetrotter wrote: post #29
joshcryer wrote: post #21

Earlier quoted context omitted.

They also used social engineering to disable fuzzing which would have caught the discrepancy: https://github.com/google/oss-fuzz/pull/10667

It’s pretty funny how a bunch of people come piling reaction emojis onto the comments in the PR, after it has all become publicly known. I’m like.. bro, adding reaction emojis after the fact as if that makes any sort of difference to anything.

Feels almost like tampering with evidence at a crime scene

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#86

Post by ceejayoz »

sneak wrote: post #80
ndriscoll wrote: post #69

Earlier quoted context omitted.

If more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).

The criminal conspiracy laws don’t apply to the organizations that write this kind of code, just like murder laws don’t.

Sure they do. Getting the perpetrator into your jurisdiction is the tough part.

Putin is, for example, unlikely to go anywhere willing to execute an ICC arrest warrant.

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#89

Post by sneak »

The questions this backdoor raises:

- what other ones exist by this same team or similar teams?

- how many such teams are operating?

- how many such dependencies are vulnerable to such infiltration attacks? what is our industry’s attack surface for such covert operations?

I think making a graph of all major network services (apache httpd, postgres, mysql, nginx, openssh, dropbear ssh, haproxy, varnish, caddy, squid, postfix, etc) and all of their dependencies and all of the committers to all of those dependencies might be the first step in seeing which parts are the most high value and have attracted the least scrutiny.

This can’t be the first time someone attempted this - this is just the first unsuccessful time. (Yes, I know about the attempted/discovered backdoor in the linux kernel - this is remote and is a horse of a different color).

Re: XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

#90

Post by sebiw »

paolomainardi wrote: post #79

I am wondering if reinstalling the entire Archlinux installation would be a wise choice.

Arch Linux uses a native/unpatched version of OpenSSH without dependency on libsystemd and thus without dependency on xz-utils, resulting in no exploitable code path. This means that at least the currently talked about vulnerability/exploit via SSH did presumably not work on Arch. Disclaimer: This is my understanding of the currently circulating facts. Additional fallout might be possible, as the reverse engineering of the backdoor is ongoing.
Post reply on HN