Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

881–890 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#881

Post by hypnagogic »

junon wrote: post #514
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

Asking this here too: why isn't there an automated A/B or diff match for the tarball contents to match the repo, auto-flag with a warning if that happens? Am I missing something here?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#882

Post by 77pt77 »

CableNinja wrote: post #41
lpapez wrote: post #20

So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet it takes a developer debugging performance issues to find an actual compromise. I worked in the software supply chain field and cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the bl…

Thats basically the whole point actually... A company pays for insurance for the business. The insurance company says sure we will insure you, but you need to go through audits A B and C, and you need certifications X and Y to be insured by us. Those audits are often industry dependent, mostly for topics like HIPAA, PCI, SOC, etc. Insurance company hears about supply chain attacks. Declares that insured must have sup…

> And the company gets to wash their hands of liability (most of the time).

Certification theater.

It's completely performative.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#883

Post by 77pt77 »

dfgdfg34545456 wrote: post #730

chmod u+x running detect_sh script just runs with no output on my arch linux box? https://www.openwall.com/lists/oss-security/2024/03/29/4

remove the -e option on the script and run it.

Anyway, arch is not affected because they don't modify openssh to link against any of this nonesense.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#885

Post by mikolajw »

junon wrote: post #514
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

I've posted an earlier WHOWAS of jiatan here: https://news.ycombinator.com/item?id=39868773

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#886

Post by andrepd »

pmarreck wrote: post #820
jnxx wrote: post #477

Earlier quoted context omitted.

And, Joey Hess has counted at least 750 commits to xz from that handle. https://hachyderm.io/@joeyh/112180715824680521 This does not look trust-inspiring. If the code is complex, there could be many more exploits hiding.

I have some questions. 1) Are there no legit code reviews from contributors like this? How did this get accepted into main repos while flying under the radar? When I do a code review, I try to understand the actual code I'm reviewing. Call me crazy I guess! 2) Is there no legal recourse to this? We're talking about someone who managed to root any linux server that stays up-to-date.

>How did this get accepted into main repos while flying under the radar? When I do a code review, I try to understand the actual code I'm reviewing. Call me crazy I guess!

And? You never do any mistakes? Google "underhanded C contest"

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#887

Post by nolist_policy »

hypnagogic wrote: post #881
junon wrote: post #514

Earlier quoted context omitted.

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

Asking this here too: why isn't there an automated A/B or diff match for the tarball contents to match the repo, auto-flag with a warning if that happens? Am I missing something here?

The tarballs mismatching from the git tree is a feature, not a bug. Projects that use submodules may want to include these and projects using autoconf may want to generate and include the configure script.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#888

Post by junon »

junon wrote: post #514
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of poking. xz-embedded was touched by Jia as well and it appears to be used in the linux kernel. I did quick look and it doesn't appear Jia touched anything of interest in there. I also checked the…

It appears to be an RCE, not a public key bypass: https://news.ycombinator.com/item?id=39877312

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#889

Post by heresWaldo »

rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

[flagged]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#890

Post by megous »

rpigab wrote: post #361

I'd love to be at Microsoft right now and have the power to review this user's connection history to Github, even though VPN exists, many things can be learned from connection habits, links to ISPs, maybe even guess if VPNs were used, roundtrip time on connections can give hints. I really don't think some random guy wants to weaken ssh just to extract some petty ransomware cash from a couple targets.

Oh my, another reason not to use github. :D So many reasons poping up just in this comment section alone.
Post reply on HN