Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

981–990 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#981

Post by account42 »

rathermucker wrote: post #913
bonyt wrote: post #48

For those panicking, here are some key things to look for, based on the writeup: - A very recent version of liblzma5 - 5.6.0 or 5.6.1. This was added in the last month or so. If you're not on a rolling release distro, your version is probably older. - A debian or RPM based distro of Linux on x86_64. In an apparent attempt to make reverse engineering harder, it does not seem to apply when built outside of deb or rpm p…

Tumbleweed has a package: liblzma5-5.6.1.revertto5.4-3.2.x86_64 FYI

revertto probably just means "revert to" but it does sound quite italian lol.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#982

Post by account42 »

cbolton wrote: post #784
Epa095 wrote: post #710

I hope Lasse Collin is doing OK! Here is a older message from him [1] "I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. It's also good to keep in mind that this is an unpaid hobby project. " Gi…

In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offer to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.

> what looks like a tangential attack

Does it? I expect that finding someone vulnerable was the more likely approach rather than messing with the life of a stable maintainer, but it does seem very much like the attacker was acting with malicious intent from the start of his interaction with the xz project.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#983

Post by account42 »

maerF0x0 wrote: post #861
cbolton wrote: post #784

Earlier quoted context omitted.

In a movie his mental health issues would likely have been caused intentionally by the attacker, setting the stage for the mole to offer to step in just at the right time. Seems a bit far fetched in this case though for what looks like a tangential attack.

or > Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. Is actually Jia Tan has him tied up in a basement and is posing as him. State actors can do that kind of thing.

In that case why bother with the Jia Tan persona at all instead of just pushing the malware as Lasse Collin.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#984

Post by account42 »

baxtr wrote: post #646
returningfory2 wrote: post #93

A couple of years ago I wrote a Go library that wraps the xz C code and allows you to do xz compression in Go: https://github.com/jamespfennell/xz About a week ago I received the first PR on that repo, to upgrade to 5.6.1. I thought it was odd to get such a random PR...it's not the same GitHub account as upstream though.

Suddenly anything like that becomes super suspicious. I wonder how this will affect the OS community in general.

More caution might not be a bad thing.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#985

Post by account42 »

_cenw wrote: post #689
0xthr0w4 wrote: post #339

Out of curiosity I looked at the list of followers of the account who committed the backdoor. Randomly picked https://github.com/Neustradamus and looked at all their contributions. Interestingly enough, they got Microsoft to upgrade ([0],[1]) `vcpkg` to liblzma 5.6.0 3 weeks ago. [0] https://github.com/microsoft/vcpkg/issues/37197 [1] https://github.com/microsoft/vcpkg/pull/37199

Hey, I remember this guy! Buddy of someone who tried to get a bunch of low quality stuff into ifupdown-ng, including copying code with an incompatible license and removing the notice. He's in every PR, complaining the "project is dead". He even pushes for the account to be made "team member". https://github.com/ifupdown-ng/ifupdown-ng/pulls/easynetdev He follows 54k accounts though, so it may indeed just be coinciden…

The PR + angry user pushing for the PR author to gain commit access spiel is definitely suspiciously similar to what happened with xz-utils. Possible coincidence but worth investigating further.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#986

Post by landownersubgrp »

CableNinja wrote: post #41
lpapez wrote: post #20

So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet it takes a developer debugging performance issues to find an actual compromise. I worked in the software supply chain field and cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the bl…

Thats basically the whole point actually... A company pays for insurance for the business. The insurance company says sure we will insure you, but you need to go through audits A B and C, and you need certifications X and Y to be insured by us. Those audits are often industry dependent, mostly for topics like HIPAA, PCI, SOC, etc. Insurance company hears about supply chain attacks. Declares that insured must have sup…

What you describe is a normal process in order to minimise damage from attacks. The damage of hacking is ultimately property damage. The procedures you've described allow you to minimise it.

And that's a good thing.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#987

Post by landownersubgrp »

bawolff wrote: post #32
lpapez wrote: post #20

So many security companies publishing daily generic blog posts about "serious supply chain compromises" in various distros on packages with 0 downloads, and yet it takes a developer debugging performance issues to find an actual compromise. I worked in the software supply chain field and cannot resist feeling the entire point of that industry is to make companies pay for a security certificate so you can shift the bl…

> the entire point of that industry is to make companies pay for a security certificate so you can shift the blame onto someone else when things go wrong. That is actually a major point of a lot of corporate security measures (shifting risk)

And that's a good thing.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#988

Post by account42 »

waynesonfire wrote: post #556
jnxx wrote: post #477

Earlier quoted context omitted.

And, Joey Hess has counted at least 750 commits to xz from that handle. https://hachyderm.io/@joeyh/112180715824680521 This does not look trust-inspiring. If the code is complex, there could be many more exploits hiding.

750 commits... is xz able to send e-mails yet?

750 is not that many commits if you follow a commit style where each independent change gets its own commit.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#989

Post by account42 »

EasyMark wrote: post #648
hangonhn wrote: post #255

Earlier quoted context omitted.

I imagine it might be easier to just compromise a weakly protected account than to actual put in a 2 years long effort with real contributions. If we mandated MFA for all contributors who contribute to these really important projects then we can know with greater certainty if it was really a long con vs. a recently compromised account.

they might not have been playing the long con. maybe approached by actors willing to pay them a lot of money to try and slip in a back door. I'm sure a deep dive into code contributions would clear that up for anyone familiar with the code base and some free time.

Using sockpuppets to pressure the original maintainer into granting commit access in the first place backs the long con theory.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#990

Post by account42 »

beginner_ wrote: post #698
hangonhn wrote: post #255

Earlier quoted context omitted.

I imagine it might be easier to just compromise a weakly protected account than to actual put in a 2 years long effort with real contributions. If we mandated MFA for all contributors who contribute to these really important projects then we can know with greater certainty if it was really a long con vs. a recently compromised account.

Not MFA but git commit signing. I don't get why such core low-level projects don't mandate it. MFA doesn0t help if a github access token is stolen and I bet most of use such a token for pushing from an IDE. Even if an access token to github is stolen, the sudden lack of signed commit should raise red flags. github should allow projects to force commit signing (if not already possible). Then the access token plus the…

Git signing would not have helped here. In fact, the tags and release archives were signed.
Post reply on HN