Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

861–870 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#861

Post by maerF0x0 »

cbolton wrote: post #784
Epa095 wrote: post #710

I hope Lasse Collin is doing OK! Here is a older message from him [1] "I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. It's also good to keep in mind that this is an unpaid hobby project. " Gi…

In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offer to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.

or > Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see.

Is actually Jia Tan has him tied up in a basement and is posing as him. State actors can do that kind of thing.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#863

Post by jwilk »

the_errorist wrote: post #818

Looks like Lasse Collin has commented on LKML: https://lkml.org/lkml/2024/3/30/188 Also, some info here: https://tukaani.org/xz-backdoor/

Or if you can't stand the lkml.org UI:

https://lore.kernel.org/lkml/20240330144848.102a1e8c@kaneli/

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#864

Post by sn »

supriyo-biswas wrote: post #647
sn wrote: post #574

For bad-3-corrupt_lzma2.xz, the claim was that "the original files were generated with random local to my machine. To better reproduce these files in the future, a constant seed was used to recreate these files." with no indication of what the seed was. I got curious and decided to run 'ent' https://www.fourmilab.ch/random/ to see how likely the data in the bad stream was to be random. I used some python to split the…

Now to be fair, such an archive could have been created with a “store” level of compression that doesn’t actually perform any compression.

My reading of the commit message is they're claiming the "data" should look random.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#865

Post by Culonavirus »

autoexecbat wrote: post #356

I'm really curious about if the act of injecting a backdoor into OSS software is legal/illegal ? Are they somehow in the clear unless we can show they actively exploited it?

The way I see it: People are being charged for their speech all the time. Especially outside the US, but even in the US. And code is speech.

And that is even before all the hacking/cracking/espionage laws get involved.

There's a reason all the (sane) people doing grey/black hat work take their security and anonymity extremely seriously.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#866

Post by gaucheries »

sroussey wrote: post #426
0xthr0w4 wrote: post #339

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

OMG: look at the other contributions. He is trying to take over projects and pushing some change to sha256 in a hundred projects. Example: https://github.com/duesee/imap-flow/issues/96

I appreciate the way that duesee handled that whole issue.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#868

Post by JackSlateur »

zamalek wrote: post #764
kzrdude wrote: post #726

Jia Tan "cleaned up" in all their ZSTD branches some hours ago, probably hiding something https://github.com/JiaT75/zstd/branches/all

Bad move. Destroying evidence is a felony.

Not everywhere, and only if you can prove that were evidences :)

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#869

Post by treffer »

pmarreck wrote: post #820
jnxx wrote: post #477

Earlier quoted context omitted.

And, Joey Hess has counted at least 750 commits to xz from that handle. https://hachyderm.io/@joeyh/112180715824680521 This does not look trust-inspiring. If the code is complex, there could be many more exploits hiding.

I have some questions. 1) Are there no legit code reviews from contributors like this? How did this get accepted into main repos while flying under the radar? When I do a code review, I try to understand the actual code I'm reviewing. Call me crazy I guess! 2) Is there no legal recourse to this? We're talking about someone who managed to root any linux server that stays up-to-date.

The actual inclusion code was never in the repo. The blobs were hidden as lzma test files.

So you review would need to guess from 2 new test files that those are, decompressed, a backdoor and could be injected which was never in the git history.

This was explicitly build to evade such reviews.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#870

Post by throwaway7356 »

juliusdavies wrote: post #634
yieldcrv wrote: post #105

Earlier quoted context omitted.

I wonder who the target was!

Every Linux box inside AWS, Azure, and GCP and other cloud providers that retains the default admin sudo-able user (e.g., “ec2”) and is running ssh on port 22. I bet they intended for their back door to eventually be merged into the base Amazon Linux image.

You don't need a "ec2" user. A backdoor can just allow root login even when that is disabled for people not using the backdoor.

It just requires the SSH port to be reachable unless there is also a callout function (which is risky as people might see the traffic). And with Debian and Fedora covered and the change eventually making its way into Ubuntu and RHEL pretty much everything would have this backdoor.

Post reply on HN