Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor in upstream xz/liblzma leading to SSH server compromise

openwall.com

Post reply on HN
Print view View original

991–1000 of 1001 posts

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#991

Post by account42 »

JonChesterfield wrote: post #534
wood_spirit wrote: post #124

A lot of eyes will be dissecting this specific exploit, and investigating this specific account, but how can we find the same kind of attack in a general way if it’s being used in other projects and using other contributor names?

The Guix full source bootstrap is looking less paranoid as time goes on

I haven't looked at Guix but in the discussions around this exploit for NixOS they mentioned that regenerating autoshit for xz-utils would not be something they can/want to do because that would add a lot more dependencies to the bootstrap before other packages can be build. Kind of funny how a requirement for bootstrapped builds can add a requirement for trusting not-quite-binaries-but-also-not-really-source blobs.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#992

Post by account42 »

dzaima wrote: post #623
CGamesPlay wrote: post #582

Why has Github disabled the (apparently official) xz repository, but left the implicated account open to the world? It makes getting caught up on the issue pretty difficult, when GitHub has revoked everyone's access to see the affected source code. https://github.com/tukaani-project/xz vs https://github.com/JiaT75

The account has been suspended for a while, but for whatever reason that's not displayed on the profile itself (can be seen at https://github.com/Larhzu?tab=following ). Repo being disabled is newer, and, while annoying and realistically likely pointless, it's not particularly unreasonable to take down a repository including a real backdoor.

Taking down the repo prevents more people inadvertendly pulling and building the backdoor so that makes sense. They should have immediately rehosted and archived the state at a different URL which makes it clear to not use it.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#993

Post by account42 »

acdha wrote: post #816
jaromilrojo wrote: post #806

This is another proof that systemd is an anti-pattern for security: with its crawling and ever growing web of dependencies, it extends the surface of vulnerability to orders of magnitude, and once embraced not even large distro communities can defend you from that. A malware code injection in upstream xz-tools is a vector for remote exploitation of the ssh daemon due to a dependency on systemd for notifications and d…

Please take the systemd trolling to Reddit. They likely targeted xz specifically because it’s so widely used but there are dozens of other libraries which are potential candidates for an attack on sshd, much less everything else which has a direct dependency unrelated to systemd (e.g. dpkg). Rather than distracting, think about how the open source projects you use would handle an attack like this where someone volunt…

Those other libraries dependend on by sshd are hopefully more closely monitored. The upstream sshd developers probably did not even consider that liblzma could end up being loaded in the process.

Make excuses for systemd all you want but loading multiple additional libraries into crytical system deamons just to write a few bytes into a socket is inexcusable and directly enabled this attack vector.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#994

Post by account42 »

LeoPanthera wrote: post #206

xz is just a horribly designed format, and always has been. If you use it, please switch to Lzip. Same compression level, but designed by someone competent. https://www.nongnu.org/lzip/ https://www.nongnu.org/lzip/xz_inadequate.html

Someone competent? More like a drama queen butthurt that his pet project did not win the popularity contest. Not the kind of person I want to rely on for important tools.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#995

Post by account42 »

byearthithatius wrote: post #613

I hope mainstream news cover this so the general population can understand the issue with our software ecoysystems reliance on unpaid open-source maintainers

I worry the mainstream news take would just be "open source bad, microsoft closed source and google cloud good"

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#996

Post by psi-jack »

LeoPanthera wrote: post #206

xz is just a horribly designed format, and always has been. If you use it, please switch to Lzip. Same compression level, but designed by someone competent. https://www.nongnu.org/lzip/ https://www.nongnu.org/lzip/xz_inadequate.html

Be an asshole elsewhere. This makes me LESS want to use lzip because of such aggressive non-useful slander and just plain nonsense.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#997

Post by codear »

5kg wrote: post #146
AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

There is zero web presence for this person and associated email address. Looks more likely a fake identity than compromised account.

i wonder if that avatar, familiarity with C/C++ and Git, and "offering help with open source projects" is just coincidence

https://github.com/JiaT75

https://twitter.com/JiaTan1337/status/1774931375994319244

kind of interesting also to see this account was set up ~2 months ago. if it's a troll, it's a somewhat poor joke.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#998

Post by throw10920 »

PedroBatista wrote: post #77

Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people. My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both ) Getting pun…

> Getting punched in the face is actually a necessary human condition for a healthy civilization.

This is factually false - in fact, it's literally the direct opposite of the truth. "Getting punched in the face" is base violence that is incompatible with a healthy civilization. A good government with a robust justice system is what is actually needed for a healthy civilization.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#999

Post by debianisajoke32 »

stefanor wrote: post #177
blcknight wrote: post #158

Earlier quoted context omitted.

> Debian testing already has a version called '5.6.1+really5.4.5-1' that is really an older version 5.4, repackaged with a newer version to convince apt that it is in fact an upgrade. I'm surprised .deb doesn't have a better approach. RPM has epoch for this purpose http://novosial.org/rpm/epoch/index.html

Debian has epochs, but it's a bad idea to use them for this purpose. Two reasons: 1. Once you bump the epoch, you have to use it forever. 2. The deb filename often doesn't contain the epoch (we use a colon which isn't valid on many filesystems), so an epoch-revert will give the same file name as pre-epoch, which breaks your repository. So, the current best practice is the +really+ thing.

Stop the cap your honor. There is not a single filesystem that prevents you from using colons in filenames except exfat, I went ahead and checked and ext4, xfs, btrfs, zfs, and even reiserfs let you use any characters you want except \0 and /.

And I fail to see why bumping the epoch would ever be a problem. Using the epoch not a reason why its bad.

Re: Backdoor in upstream xz/liblzma leading to SSH server compromise

#1000

Post by source_inform »

AdmiralAsshat wrote: post #52

Yikes! Do you have any info on the individual's background or possible motivations?

An Indian with the name, Jigar (meaning heart) would never address himself as Jigar, as seen in the citation. This would be culturally a bit weird. Unless he is being sarcastic or writing this on some comic note.

Secondly, the use of English is not consistent in what should be from typical Indian. He should be from a foreign background or a very reputed English medium.

The language though seemingly simple for a native English speaker but it seems in this case; a person whose first language: likely is not English.

It is possible that Grammarly or auto correct could have been used to write these. But can't be certain of anything stated above.

I do think that this is a sabotage account with 60% chances unless Mr. Kumar comes out clean, publicly. He is likely a state sponsored actor.

Post reply on HN