Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

911–920 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#911

Post by joveian »

throwaway7356 wrote: post #800
Roark66 wrote: post #743

Sadly this is exactly one of the cases where open source is much more vulnerable to a state actor sponsored attack than proprietary software. (it is also easier to find such backdoors in OS software but that's BTW) Why? Well, consider this, to "contribute" to a proprietary project you need to get hired by a company, go through their he. Also they have to be hiring in the right team etc. Your operative has to be in a…

> Well, consider this, to "contribute" to a proprietary project you need to get hired by a company, go through their he. Or work for a third-party company that gets access to critical systems without any checks. See for example the incident from 2022 here: https://en.wikipedia.org/wiki/Okta,_Inc . Or a third-party that rents critical infrastructure to the company (Cloud, SaaS solutions).

Or exactly this kind of backdoor in open source but target proprietary software. I don't know of any survey but I'd be surprised if less than half of proprietary software used open source software one way or another and not surprised if it was quite a bit more than that.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#912

Post by croemer »

Which nation state (if any) is most likely behind this? China based on name, or is this a red herring?

The perpetrator did most GitHub actions between 10 and 18 UTC, which sort of rules out US based, unless the messages were scheduled. Consistent with Europe to Asia.

See clickhouse for data: https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPT...

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#913

Post by rathermucker »

bonyt wrote: post #48

For those panicking, here are some key things to look for, based on the writeup: - A very recent version of liblzma5 - 5.6.0 or 5.6.1. This was added in the last month or so. If you're not on a rolling release distro, your version is probably older. - A debian or RPM based distro of Linux on x86_64. In an apparent attempt to make reverse engineering harder, it does not seem to apply when built outside of deb or rpm p…

Tumbleweed has a package: liblzma5-5.6.1.revertto5.4-3.2.x86_64 FYI

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#914

Post by [deleted] »

bonyt wrote: post #48

For those panicking, here are some key things to look for, based on the writeup: - A very recent version of liblzma5 - 5.6.0 or 5.6.1. This was added in the last month or so. If you're not on a rolling release distro, your version is probably older. - A debian or RPM based distro of Linux on x86_64. In an apparent attempt to make reverse engineering harder, it does not seem to apply when built outside of deb or rpm p…

[deleted]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#915

Post by sapiogram »

alpb wrote: post #687
rpigab wrote: post #361

I'd love to be at Microsoft right now and have the power to review this user's connection history to Github, even though VPN exists, many things can be learned from connection habits, links to ISPs, maybe even guess if VPNs were used, roundtrip time on connections can give hints. I really don't think some random guy wants to weaken ssh just to extract some petty ransomware cash from a couple targets.

That’d be illegal for an employee to do.

Why?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#916

Post by darkelder »

cozzyd wrote: post #794
api wrote: post #475

Earlier quoted context omitted.

I’m surprised there isn’t way more of this stuff. The supply chain is so huge and therefore represents so much surface area.

Imagine if sshd was distributed by PyPI or cargo or npm instead of by a distro.

[dead]

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#917

Post by perryizgr8 »

Why are projects like xz and sshd still active? Just freeze it, it works fine. Only changes should be fixes for vulnerabilities. None of this complicated new functionality. If you want something like that make a new project. If it is truly better people will use it.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#919

Post by nodesocket »

rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

Can legal action be taken against the author if it's found he maliciously added the backdoor?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#920

Post by delfinom »

Decabytes wrote: post #789

So when are we going to stop pretending that OSS maintainers/projects are reaping what they sow when they "work for free" and give away their source code away using OSS licensed software, while large companies profit off of them? If they were paid more (or in some cases even actually paid), then they could afford to quit their day jobs, reducing burn out, they could actually hire a team of trusted vetted devs instead…

OSS maintainers aren't reaping anything. Most OSS licenses say the software is provided without warranty.
Post reply on HN