this post was submitted on 01 Apr 2024
110 points (96.6% liked)

Linux

48220 readers
629 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
110
Best article about XZ backdoor? (discuss.tchncs.de)
submitted 7 months ago by [email protected] to c/[email protected]
16 comments fedilink hide all child comments
 

Hey, I've been hearing a LOT about the xz backdoor. Crazy story, but rather than reading 10 different articles about it from 3 days ago when the story was quite new, does anybody know a high quality write-up that has all the juicy details and facts? I really like in-depth guides that cover every aspect of the story.

Thanks in advance guys!

top 16 comments
sorted by: hot top controversial new old
[–] [email protected] 12 points 7 months ago

Sam Jones's FAQ is by far the best single source, links to other solid sources for more in-depth technical details and also lightly debunks a few things.

The main thing sources online disagree on are which distros are affected. That's because it's not a simple yes/no and some distros are taking a nuanced approach in their public communication, while others have chosen the sledgehammer in an attempt to get people to upgrade their systems but keep/kept the nuance in the back room where the audience understood not everything was known yet. Some distros are underselling how vulnerable they were, others are overselling it.

[–] [email protected] 9 points 7 months ago

I read a few articles. I think Andres Freund's announcement gave me the best context for the exploit itself. https://www.openwall.com/lists/oss-security/2024/03/29/4

The most helpful source I saw on which systems are affected was this Lemmy post, https://beehaw.org/post/12813772

[–] [email protected] 54 points 7 months ago* (last edited 7 months ago) (1 children)

Original Mastodon post by Andres Freund about discovery

Original Openwall thread

Update by @[email protected]

JFrog article

Bluesky post by another person

Hacker News article

Update by the original maintainer

Wikipedia Article

Original Mailing history

[–] [email protected] 7 points 7 months ago (1 children)

That's way more steps than I thought

I wonder if something so complex makes it easier to potentially detect than something slightly simpler.

Btw what does the .o file do, is that the one running inside ssh through system d?

[–] [email protected] 4 points 7 months ago (2 children)

I am by far an expert, but imo it seems it needed to be complex to achieve its goals, and to get that level of change in without notice required breaking it down and sneaking pieces in over time.

Happy to be corrected of course if this is a wrong interpretation

[–] [email protected] 1 points 7 months ago

That's my take as well

[–] [email protected] 9 points 7 months ago (1 children)

You're correct. Right now many experts are scrambling all those small pieces together as to how this could happen in the first place, as a lot of it was public too: the social pressure on maintainers, random software changes that now seem suspicious, and the absence of a real identity of the perpetrators. Every expert who's onto this seems to be a real person, with a real identity and a real face to the name.

Prior to the first commits, there must have been months if not years of planning too.

But just the fact that some of the code those perpetrators wrote took +0.5 seconds more for something that would normally only take 0.2-0.3 seconds is what gave them away.

0.5 seconds of CPU time vs. years of planning.

It's an intriguing story.

They tried so hard, they got so far, but in the end, it didn't even matter.

[–] [email protected] 1 points 7 months ago

I wonder exactly why ssh was taking so long more. Perhaps the bits that scan ssh logs with a regex to extract IP address and username?

Whatever it is, that particular bit should be easy to deactivate since somehow a full fledged binary file with executable code was being bundled. I can imagine it only being active under a toggle that would make it harder to detect, such as a specific time of day.

[–] [email protected] 25 points 7 months ago* (last edited 7 months ago) (1 children)

Not everything is known yet, so you won't find a comprehensive summary. The latest news I've seen: https://www.openwall.com/lists/oss-security/2024/03/30/36

I'm watching some folks reverse engineer the xz backdoor, sharing some preliminary analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.

All the technical details that are widely known (and some that aren't yet) seem to be in that thread, including the original report from Andres Freund. For rumours about who might be behind it and high-level speculation about what it all means, you'd have to look elsewhere.

[–] [email protected] 3 points 7 months ago

thx :)

[–] [email protected] 9 points 7 months ago (1 children)

Best coverage I've seen so far has been on Ars Technica.

[–] [email protected] 11 points 7 months ago (1 children)

Yeah, their original coverage was good, but they also had a really good follow up today.

[–] [email protected] 5 points 7 months ago

thanks!

[–] [email protected] 19 points 7 months ago (1 children)

https://boehs.org/node/everything-i-know-about-the-xz-backdoor gives a good overview with links to further reads.

[–] [email protected] 1 points 7 months ago

awesome, thanks!

[–] [email protected] 7 points 7 months ago

It's still ongoing and still being reverse engineered, so I would expect the good writeups to come in a couple days.