Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

921–930 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#921

Post by resonious »

neustradamus wrote: post #761
0xthr0w4 wrote: post #339

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

Dear @0xthr0w4, do you attack me because I have requested the XZ update? Do not mix, I am not linked to the XZ project.

The parent comment doesn't read like an attack to me. Just an observation. Would be curious why you wanted the update though.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#922

Post by bed99 »

Rhea_Karty wrote: post #672

TLDR: Some people have been throwing around “China,” but it seems also quite possible that Jia is from somewhere in Eastern Europe pretending to be from China. In addition, Lasse Collin and Hans Jansen are from the same EET time zone. These are my notes on time stamps/zones. There are a few interesting bits that I haven't fully fleshed out. The following analysis was conducted on JiaT75’s ( https://github.com/JiaT75?…

I asked ChatGPT 4 based on Jia's Github avatar image:

The timezones that ChatGPT thinks the avatar comes from aligns with +2 and +3, see what how it ranked and at the end the description of Jia's avatar:

---

Rank, Score, Country, City, Timezone, Criteria

1, 10, Saudi Arabia, Mecca, AST (UTC+3), Heartland of Islam, deeply rooted calligraphic traditions.

2, 9.5, Iran, Tehran, IRST (UTC+3:30), Integral Persian calligraphy with a distinct style and history.

3, 9, Turkey, Istanbul, TRT (UTC+3), Historical significance of Ottoman calligraphy, actively preserved.

4, 8.5, Egypt, Cairo, EET (UTC+2), Home to Al-Azhar University, with calligraphy in the curriculum.

5, 8, Morocco, Marrakech, WET (UTC+0), Calligraphy integrated into architecture and crafts.

6, 7.5, United Arab Emirates, Abu Dhabi, GST (UTC+4), Promotes Islamic arts through festivals and museums.

7, 7, Syria, Damascus, EET (UTC+2), Historical center of Arabic calligraphy, despite recent conflicts.

8, 6.5, Pakistan, Islamabad, PKT (UTC+5), Rich tradition, hosts several institutions and events dedicated to calligraphy.

9, 6, Indonesia, Jakarta, WIB (UTC+7), Largest Muslim-majority country with calligraphy in art and monuments.

10, 5.5, Spain, Cordoba, CET (UTC+1), Legacy of Islamic culture and appreciation for calligraphy, particularly in Andalusia.

--

GPT4: This image appears to be a stylized representation of the letter 'J' within an intricate border, possibly inspired by the art style of Islamic calligraphy. The ornate background is typical of arabesque patterns, which are characteristic of Islamic art and consist of repeating geometric forms that often echo the shapes of plants, flowers, and sometimes calligraphic writing. The letter 'J' stands out in a vibrant yellow, contrasting with the dark green of the surrounding design.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#923

Post by wtznc »

AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

I found a user who seems suspicious to me.

https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denia...

He understood the software architecture quite early on while working on the following repository. He connected the dots from his other projects and went rogue. (probably to benefit from crypto?). Take a look at his other repositories and code style and recent likes on github. Is he our Jia Tan?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#924

Post by resonious »

demizer wrote: post #517
agwa wrote: post #18

Earlier quoted context omitted.

Thanks to autoconf, we're now used to build scripts looking like gibberish. A perfect place to hide a backdoor.

Maybe the US Government needs to put its line in the sand and mandate the end of autotools. :D

It looks like they are trying to get rid of C, so maybe in luck!

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#925

Post by logicziller »

kapouer wrote: post #423
rwmj wrote: post #42

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo. He has been part of the xz proj…

Github accounts of both xz maintainers have been suspended.

These shouldn't be suspended, and neither should their repositories. People might want to dig through the source code. It's okay if they add a warning on the repository, but suspending _everything_ is a stupid thing to do.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#926

Post by lostmsu »

nialv7 wrote: post #452
Aissen wrote: post #179

Looks like one of the backdoor authors even went and disabled the feature the exploit relied on directly on oss-fuzz to prevent accidental discovery: https://social.treehouse.systems/@Aissen/112180302735030319 https://github.com/google/oss-fuzz/pull/10667 But luckily there was some serendipity: "I accidentally found a security issue while benchmarking postgres changes." https://mastodon.social/@AndresFreundTec/112180…

This in of itself can be legitimate. ifunc has real uses and it indeed does not work when sanitizer is enabled. Similar change in llvm: https://github.com/llvm/llvm-project/commit/1ef3de6b09f6b21a...

Could that commit also be made by a bad actor?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#927

Post by joshhansen »

Is it time to deprecate the ability for code to implement linker symbols in other libraries? Shouldn't there be a strict namespace separation between binaries/libraries? liblzma being to implement openssh symbols seems like a symptom of a much larger problem.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#928

Post by lostmsu »

junon wrote: post #491
pdw wrote: post #352

Earlier quoted context omitted.

Focusing on sshd is the wrong approach. The backdoor was in liblzma5. It was discovered to attack sshd, but it very likely had other targets as well. The payload hasn't been analyzed yet, but _almost everything_ links to libzma5. Firefox and Chromium do. Keepassxc does. And it might have made arbitrary changes to your system, so installing the security update might not remove the backdoor.

From what I'm understanding it's trying to patch itself into the symbol resolution step of ld.so specifically for libcrypto under systemd on x86_64. Am I misreading the report? That's a strong indication it's targeting sshd specifically.

As mentioned many times in other places now, this account had control over xz code for 2 years. The discovered CVE might be just a tip of an iceberg.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#929

Post by joshhansen »

stephc_int13 wrote: post #472

I guess that rewriting liblzma in Rust would not have prevented this backdoor. But would have likely increased the confidence in its safety. Using the build system (and potentially the compiler) to insert malicious backdoors is far from a new idea, and I don't see why this example would the only case.

If it were using Cargo as its build system, it might make such manipulations more obvious / understandable?

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#930

Post by lostmsu »

q3k wrote: post #14

NixOS/Pkgs 23.11 unaffected, unstable contains backdoored implementations (5.6.0, 5.6.1) but their OpenSSH sshd does not seem to link against systemd/liblzma, and the backdoor doesn't get configured in (only happens on .deb/.rpm systems).

Not affected by the latest CVE, but the author had unrestricted access to xz for 2 years, so I would say it is affected until the other contributions are proven safe (never gonna happen) or it reverts to pre-adversarial actor version.
Post reply on HN