Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz sshd backdoor rabbithole goes quite a bit deeper

twitter.com

Post reply on HN
Print view View original

91–100 of 310 posts

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#91

Post by sho_hn »

bannable wrote: post #71
bilekas wrote: post #50

Earlier quoted context omitted.

No full dissemination of the backdoor itself has been done yet, as for the anti-debug, sure you can avoid things like that with flags. But this was done at compile level so its a bit more tricky. > I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Not really, as above it was done at build time.. So you have already set your home up. It's shown the problems with package manage…

What do you mean by "package managers not taking source from the right place"?

I assume they are advocating for package managers to preferably grab signed git tags from repositories rather than download tarballs.

The backdoor relied on the source in the tarballs being different from the git tag, adding additional script code. This is common for projects that uses GNU autotools as build system; maintainers traditionally run autoconf so that users don't have to and ship the results in the tarballs.

I agree that this should be discouraged, and that distros should, when possible, at least verify that tarbal contents are reproducible / match git tags when importing new versions.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#92

Post by manquer »

k8svet wrote: post #67
scubbo wrote: post #61

Earlier quoted context omitted.

Amusing. I was always irritated by the very concept of threadreaderapp and by people's propensity for posting the links (just read it on the website! There's no need to spend extra compute to join up some divs!) - but Elon's ever-increasing breakage of the site now makes it genuinely useful.

"ever increasing"? Twitter is completely, 110% unusable without an account (and dear god, I dare some of you to make a new account and see what the process and default content is. It's gross ). I say 110% not to be hyperbolic -- It shows you non-latest tweets on profiles, it doesn't let you see tweet threads or replies, even from the original poster when they post a chain of tweets. I literally can't read any of this…

> ever increasing

I don’t think it means currently it is reasonable , just that things are continuing to worsen and we have not yet reached a bottom even if a bottom exists.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#93

Post by SAI_Peregrinus »

noman-land wrote: post #77

I haven't been following this story super closely but I find it extremely odd that I've heard zero discussion about the perpetrator of this hack.

There's been lots of speculation. It seems likely to be more than one person, likely either a ransomware group or a national intelligence agency.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#94

Post by atomicnumber3 »

anamax wrote: post #23
atomicnumber3 wrote: post #4

The sophistication here is really interesting. And it all got caught because of a fairly obvious perf regression. It reminds of a quote I heard in one of those "real crime" shows: "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius."

> "There's a million ways to get caught for murder, and if you can think of half of them, you're a genius." Does "think of half" apply to the folks trying to solve murders?

Nah, it applies to the person trying to get away with the murder. People will do really, really intricate jobs of trying to cover up, then slip up because like, they leave a receipt in their car that accidentally breaks their alibi.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#95

Post by tw04 »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

The fact that the guys developing the code weren't also simultaneously running valgrind and watching performance isn't hard to believe. They were targeting servers and appliances, how many servers and appliances do you know of that are running valgrind in their default image?

Sure, in hindsight that's a "duh, why didn't we think of that" - but also it's not very hard at all to see why they didn't think of that. They were likely testing against the system images they were hoping to compromise, not joe-schmoe developer's custom image.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#96

Post by sureglymop »

Does anyone have a good explanation or introduction into the performance testing that was done to find this? And how to get started? Actually measuring performance always seemed to be a very hard task and I'd like to be able to do similar testing as the person which found this backdoor.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#97

Post by swid »

versteegen wrote: post #89
dabbledabble wrote: post #72

Earlier quoted context omitted.

It’s also possible that this could be a change in personnel. Maybe the one who earned trust and took over was no more working for them. And an amateur took over with tight deadlines that lead to this gaffe for them.

The abrupt change in time-of-day when commits occurred supports the theory that Jai Tan is more than one person: https://twitter.com/birchb0y/status/1773871381890924872

The text near the box makes it sound like these are just the fixes - not adding the test files but updating them.

At that point it would have been clear “the race is on” to avoid detection, so it’s not too surprising someone would work late to salvage the operation.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#98

Post by asveikau »

ufmace wrote: post #14

The weird thing about this one is how it seems super professional in some ways, and rather amateur in others. Professional in the sense of spending a long time building up an identity that seemed trustworthy enough to be made maintainer of an important package, of probably involving multiple people in social manipulation attacks, of not leaking the true identity and source of the attack, and the sophistication and ob…

Modifying the sshd behavior without crashes seems by itself pretty difficult. I mean, conceptually it isn't hard, if you are in the same process and can patch various functions, but I think doing so and having it be "production ready" to ship in multiple linux distros all the time is a challenge.

This thing wasn't around for very long but yet another thing to consider would be to keep it working across multiple versions of OpenSSH, libcrypto etc.

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#99

Post by cjbprime »

lyu07282 wrote: post #41
xorvoid wrote: post #7

Earlier quoted context omitted.

Maybe I’m just being naive or too trusting, but this is sort of what I think when folks are getting worried about other backdoors like this in the wild. Is it that they just got unlucky to get caught, or is this type of attack just too hard to pull off in practice? I’d like to think the later. But, we really don’t know.

One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane technical details. This may be confirmed by regular vulnerabilities that are found in sometimes many decades old software, since vulnerabilities are much harder to find than backdoors. For example shellshock was 30 year old code, PwnKit 12 and log4j was ~10 ish. So…

Doesn't your data prove the opposite point? There are so many vulnerabilities and so few people looking for them that even the thirty year old ones have barely been found.

A healthy feedback loop would have trended the average age of each vulnerability at the time of detection to be *short".

Re: The xz sshd backdoor rabbithole goes quite a bit deeper

#100

Post by chrismartin »

db48x wrote: post #90
noman-land wrote: post #77

I haven't been following this story super closely but I find it extremely odd that I've heard zero discussion about the perpetrator of this hack.

What’s to discuss? Nothing is known about him.

There's a lot of metadata about when/how they used git and IRC, and some preliminary analysis on same. Another surname in one of the commits. An apparent LinkedIn account. (See heading "OSINT" in https://boehs.org/node/everything-i-know-about-the-xz-backdo... .)

A lot of these tracks could be intentionally manipulated by a sophisticated actor to disguise their identity, but it's not "nothing".

Post reply on HN