13 ms·

Yikes! Do you have any info on the individual's background or possible motivations?

b112 3y ago
Yikes indeed. This fix is being rolled out very fast, but what about the entire rest of the codebase? And scripts? I mean, years of access? I'd trust no aspect of this code until a full audit is done, at least of every patch this author contributed. (note: not referring to fedora here, a current fix is required. But just generally. As in, everyone is rolling out this fix, but... I mean, this codebase is poison in my eyes without a solid audit)
- b112 3y ago
  This seems to be the account, correct me if wrong (linked from the security email commit link): https://github.com/JiaT75 https://github.com/JiaT75 I hope authors of all these projects have been alerted. STest - Unit testing framework for C/C++. Easy to use by simply dropping stest.c and stest.h into your project! libarchive/libarchive - Multi-format archive and compression library Seatest - Simple C based Unit Testing Everything this account has done should be investigated. Woha, is this legit or some sort of scam on Google in some way?: https://github.com/google/oss-fuzz/pull/11587 https://github.com/google/oss-fuzz/pull/11587 edit: I have to be missing something, or I'm confused. The above author seems to be primary contact for xz? Have they just taken over?? Or did the bad commit come from another source, and a legit person applied it? A bit confused here.
  - tux3 3y ago
    The concern about other projects is fine, but let's be careful with attacks directed at the person. Maybe their account is compromised, maybe the username borrows the identity of an innocent person with the same name. Focus on the code, not people. No point forming a mob. (e: post above was edited and is no longer directed at the person. thanks for the edit.)
    - deleted 3y ago
      [deleted]
    - simiones 3y ago
      It's important to focus on people, not just code, when suspecting an adversary. Now, I have no idea if this is the right account, and if it has recently been compromised/sold/lost, or if it has always been under the ownership of the person who committed the backdoor. But IF this is indeed the right account, then it's important to block any further commit from it to any project, no matter how innocuous it seems, and to review thoroughly any past commit. For the most security-conscious projects, it would be a good idea to even consider reverting and re-implementing any work coming from this account if it's not fully understood. An account that has introduced a backdoor is not the same thing as an account who committed a bug.
      - tux3 3y ago
        I agree we should look at the account and its contributions, I make a distinction between the account and the person. Sometimes the distinction is not meaningful, but better safe than sorry.
        tsimionescu 3y ago
        Oh, agreed then.
    - kevin_b_er 3y ago
      They appear to have moved carefully to set this up over the course of weeks by setting up the framework to perform this attack. I would now presume this person to be a hostile actor and their contributions anywhere and everywhere must be audited. I would not wait for them to cry 'but my bother did it', because an actual malicious actor would say the same thing. The 'mob' should be pouring over everything they've touched. Audit now and audit aggressively.
      - b112 3y ago
        My above post shows the primary domain for xz moving from tukaani.org to xz.tukaani.org. While it's hosted on github: $ host xz.tukaani.org host xz.tukaani.org is an alias for tukaani-project.github.io. And originally it was not: $ host tukaani.org tukaani.org has address 5.44.245.25 (seemingly in Finland) It was moved there in Jan of this year, as per the commit listed in my prior post. By this same person/account. This means that instead of Lasse Collin's more restrictive webpage, an account directly under the control of the untrusted account, is now able to edit the webpage without anyone else's involvement. For example, to make subtle changes in where to report security issues to, and so on. So far I don't see anything nefarious, but at the same time, isn't this the domain/page hosting bad tarballs too?
  - soraminazuki 3y ago
    Oh no, not libarchive! GitHub search shows 6 pull requests were merged back in 2021. https://github.com/search?q=repo%3Alibarchive%2Flibarchive+jiat75&type=commits https://github.com/search?q=repo%3Alibarchive%2Flibarchive+j... It does look innocent enough though. Let's hope there's no unicode trickery involved...
    - steelframe 3y ago
      Maybe not. They removed safe_fprintf() here and replaced it with the (unsafe) fprintf(). https://github.com/libarchive/libarchive/commit/e37efc16c8665f405182dd77eb1bbb32376f5484 https://github.com/libarchive/libarchive/commit/e37efc16c866...
      - buildbot 3y ago
        If libarchive is also backdoored, would that allow specifically crafted http gzip encoded responses to do bad things?
        nicolas_17 3y ago
        What software is using libarchive to decode HTTP responses?
        buildbot 3y ago
        I don't know, way outside my domain. Possibly none I guess?
        giantrobot 3y ago
        FreeBSD's archive tools are built on top of libarchive IIRC. Not sure about the other BSDs.
        mattbee 3y ago
        Well for one, the Powershell script I just wrote to build all the 3rd-party library dependencies for a video game. tar.exe was added to Windows this January, sourced from libarchive: https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows https://learn.microsoft.com/en-us/virtualization/community/t... Unlike the GNU tar I'm used to, it's actually a "full fat" command line archiving tool, compressing & decompressing zip, xz, bz2 on the command-line - really handy :-O
  - Zetobal 3y ago
    That looks like a repo that would sound alarms if you look at it from a security standpoint.
  - davexunit 3y ago
    JiaT75 also has commits in wasmtime according to https://hachyderm.io/@joeyh/112180082372196735 https://hachyderm.io/@joeyh/112180082372196735
    - pinko 3y ago
      per https://hachyderm.io/@bjorn3/112180226784517099 https://hachyderm.io/@bjorn3/112180226784517099, "The only contribution by them to Wasmtime is a doc change. No actual code or binary blobs have been changed by them."
    - mintplant 3y ago
      Just a documentation change, fortunately: https://github.com/bytecodealliance/wasmtime/commits?author=JiaT75 https://github.com/bytecodealliance/wasmtime/commits?author=... They've submitted little documentation tweaks to other projects, too; for example: https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp-docs?view=msvc-170#community-contributors https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp... I don't know whether this is a formerly-legitimate open source contributor who went rogue, or a deep-cover persona spreading innocuous-looking documentation changes around to other projects as a smokescreen.
      - bombcar 3y ago
        Minor documentation change PRs is a well known tactic used to make your GitHub profile look better (especially to potential employers). He could be doing the same thing for other reasons; nobody really digs into anything very deep so I could see someone handing over co-maintenance to a project based on a decent looking Github graph and some reasonability.
      - mysidia 3y ago
        Consider the possibility those type of submissions were part of the adversary's strategy in order to make their account appear more legitimate rather than appearing out of nowhere wanting to become the maintainer of some project.
  - ikmckenz 3y ago
    > The above author seems to be primary contact for xz? They made themselves the primary contact for xz for Google oss-fuzz about one year ago: https://github.com/google/oss-fuzz/commit/6403e93344476972e908ce17e8244f5c2b957dfd https://github.com/google/oss-fuzz/commit/6403e93344476972e9...
  - bed99 3y ago
    A SourceGraph search like this shows https://sourcegraph.com/search?q=context:global+JiaT75&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+JiaT75&patte... - Jia Tan <jiat75@gmail.com> - jiat75 <jiat0218@gmail.com> ``` amap = generate_author_map("xz") test_author = amap.get_author_by_name("Jia Cheong Tan") self.assertEqual( test_author.names, {"Jia Cheong Tan", "Jia Tan", "jiat75"} ) self.assertEqual( test_author.mail_addresses, {"jiat0218@gmail.com", "jiat75@gmail.com"} ) ```
    - pryce 3y ago
      additionally, even though the commit messages they've made are mostly plain, there may be features of their commit messages that could provide leads, such as his using what looks like a very obscure racist joke of referring to a gitignore file as a 'gitnigore'. There's barely a handful of people on the whole planet making this 'joke'.
      - berdario 3y ago
        Can you point to where you saw that racist joke? I don't see anything at https://sourcegraph.com/search?q=context:global+author:jiat0218%40gmail.com+gitnigore&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+author:jiat0...
        pryce 3y ago
        first commit made in one of JiaT75's other repos https://github.com/JiaT75/STest/commits/master/ https://github.com/JiaT75/STest/commits/master/
        berdario 3y ago
        Thank you. If you wouldn't have explained the background, I totally would've thought that this is just an innocent typo. (I still think it's like... 60% a typo? don't know) Anyhow, other people called the CCing of JiaT75 by Lasse suspicious: https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.collin@tukaani.org/ https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co... Someone pointed out the "mental health issues" and "some other things" https://news.ycombinator.com/item?id=39868881 https://news.ycombinator.com/item?id=39868881 https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... Lasse is of course a Nordic name, and the whole project has a finnish name and hosting https://news.ycombinator.com/item?id=39866902 https://news.ycombinator.com/item?id=39866902 If I wanted to go rogue and insert a backdoor in a project of mine, I'd probably create a new sockpuppet account and hand over management of the project to them. The above is worringly compatible with this hypothesis. OTOH, JiaT75 did not reuse the existing hosting provider, but rather switched the site to github.io and uploaded there old tarballs: https://github.com/tukaani-project/tukaani-project.github.io/commit/071a8acf097e11b659f6d7eb0f3b2e5e8934de0e https://github.com/tukaani-project/tukaani-project.github.io... If JiaT75 is an old-timer in the project, wouldn't they have kept using the same hosting infra? There are also some other grim possibilities: someone forced Lasse to hand over the project (violence or blackmailing? as farfetched as that sounds)... or maybe stole Lasse devices (and identity?) and now Lasse is incapacitated? Or maybe it's just some other fellow scandinavian who pretended to be chinese and got Lasse's trust. In which case I wish Lasse all the best, and hope they'll be able to clear their name. Is the same person sockpuppeting Hans Jansen? It's amusing (but unsurprising) that they are using both german-sounding and chinese-sounding identities. That said, I don't think it's unreasonable to think that Lasse genuinely trusted JiaT75, genuinely believed that the ifunc stuff was reasonable (it probably isn't: https://news.ycombinator.com/item?id=39869538 https://news.ycombinator.com/item?id=39869538 ) and handed over the project to them. And at the end of the day, the only thing linking JiaT75 to a nordic identity is a nordic racist joke which could well be a typo. People already checked the timezone of the commits, but I wonder if anyone has already checked the time-of-day of those commits... does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? (of course, that's also easy to manipulate, but maybe they could've slip up) Anyhow, I guess that security folks at Microsoft and Google (because of JiaT75 email account) are probably going to cooperate with authorities on trying to pin down the identity of JiaT75 (which might not be very useful, depending on where they live).
  - metzmanj 3y ago
    >Woha, is this legit or some sort of scam on Google in some way?: I work on OSS-Fuzz. As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way. OSS-Fuzz doesn't trust user code for this very reason.
    - packetlost 3y ago
      It looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
      - metzmanj 3y ago
        That's what people are saying though I haven't had the chance to look into this myself. Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
        bombcar 3y ago
        It's more likely that fuzzing would blow up on new code and they wanted an excuse to remove it. After all, if it hadn't had a performance regression (someone could submit a PR fixing whatever slowed it down, heh) it still wouldn't be known.
  - jnxx 3y ago
    There is also a variety of new, parallelized implementations of compression algorithms which would be good to have a close look at. Bugs causing undefined behaviour in parallel code are notoriously hard to see, and the parallel versions (which are actually much faster) could be take the place of well-established programs which have earned a lot of trust.
- formerly_proven 3y ago
  Well that account also did most of the releases since 5.4.0.
  - alwaysbeconsing 3y ago
    +1 Can see from project homepage http://web.archive.org/web/20240329165859/https://xz.tukaani.org/xz-utils/ http://web.archive.org/web/20240329165859/https://xz.tukaani... they have some release responsibility from 5.2.12. > Versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key . The older releases have been signed with Lasse Collin's OpenPGP key . It must be assume that before acquiring that privilege, they also contributed code to project. Probably most was to establish respectable record. Still could be malicious code going back someways.
    - 0x0 3y ago
      Looks like the Jia Tan OpenPGP key was replaced a few months ago as well: https://github.com/tukaani-project/tukaani-project.github.io/commit/76f58f1e14e44d69f712841090d331437c187b30 https://github.com/tukaani-project/tukaani-project.github.io...
rwmj 3y ago
I handed over all the emails I received to the security team, who I guess will send them "higher". I'll let them analyse it.
5kg 3y ago
There is zero web presence for this person and associated email address. Looks more likely a fake identity than compromised account.
- Retr0id 3y ago
  Did you check Chinese social media?
  - hw 3y ago
    Why would you think the person would have social media (or would even be on Chinese social media specifically), given the sophistication and planning?
    - Retr0id 3y ago
      I mention Chinese social media specifically because I know it's not indexed so well by western search engines. You can't conclude someone has no social footprint until you've actually checked. Regardless of how likely you think it is, finding a social media footprint would be useful information. Seek information first, reach conclusions second.
  - thrash158 3y ago
    I found this link on Zhihu: https://www.zhihu.com/question/650826484 https://www.zhihu.com/question/650826484
- mrb 3y ago
  Actually the "jiat0218" user part in his email address jiat0218@gmail.com has a bunch of matches on Taiwanese sites: https://char.tw/blog/post/24397301 https://char.tw/blog/post/24397301 https://forum.babyhome.com.tw/topic/167439 https://forum.babyhome.com.tw/topic/167439 https://bmwcct.com.tw/forums/thread1828.html https://bmwcct.com.tw/forums/thread1828.html
  - 5kg 3y ago
    I think it's just a coincidence. - All the posts are from 2004/2006. - "jiat" can be abbreviation for many common Chinese names.
wpietri 3y ago
I get why people are focusing on this bad actor. But the question that interests me more: how many other apparent individuals fit the profile that this person presented before caught?
- Phenylacetyl 3y ago
  Apparently, many. It looks like gettext may be containing a part of their attack infrastructure. https://github.com/microsoft/vcpkg/pull/37199#pullrequestreview-1924053615 https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev... https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16d9c519b2d76f862abe4fe02d40f84e8daa712f7e08b616df3f16376c82431 https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16... https://github.com/MonicaLiu0311 https://github.com/MonicaLiu0311
  - collinfunk 3y ago
    Are you referencing the '-unsafe' suffix in the second link? That is not something to worry about. This is from Gnulib, which is used by Gettext and other GNU projects. Using 'setlocale (0, NULL)' is not thread-safe on all platforms. Gnulib has modules to work around this, but not all projects want the extra locking. Hence the name '-unsafe'. :) See: https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg00127.html https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg001...
    - everybackdoor 3y ago
      They may be right: https://git.alpinelinux.org/aports/log/main/gettext https://git.alpinelinux.org/aports/log/main/gettext Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!
      - kaathewise 3y ago
        psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved. [0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10 https://git.alpinelinux.org/aports/stats/?period=y&ofs=10
mrb 3y ago
I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it could in theory be malware authors (ransomware, etc). However these guys tend to aim at the low hanging fruits. They want to make a buck quickly. I don't think they have the patience and persistence to infiltrate an open source project for 2 long years to finally gain enough trust and access to backdoor it. On the other hand, a state actor is in for the long term, so they would spend that much time (and more) to accomplish that. So that's my guess: Jia Tan is an employee of some intelligence agency. He chose to present an asian persona, but that's not necessarily who he truly represents. Could be anyone, really: Russia, China, Israel, or even the US, etc. Edit: given that Lasse Collin was the only maintainer of xz utils in 2022 before Jia Tan, I wouldn't be surprised if the state actor interfered with Lasse somehow. They could have done anything to distract him from the project: introduce a mistress in his life, give him a high-paying job, make his spouse sick so he has to care for her, etc. With Lasse not having as many hours to spend on the project, he would have been more likely to give access to a developer who shows up around the same time and who is highly motivated to contribute code. I would be interested to talk to Lasse to understand his circumstances around 2022.
- janc_ 3y ago
  Or they have just one or a small number of targets, but don’t want the target(s) to know that they were the only target(s), so they backdoor a large number of victims to “hide in the crowd”. I agree that this is likely a state actor, or at least a very large & wealthy private actor who can play the long game…
- dist-epoch 3y ago
  According to top comment he committed multiple binary files to xz for the last two years. Most likely this is not the first backdoor, just the first one to be discovered, so it wasn't two years of work until there were results. But I still agree that he's probably a state actor.
jpalomaki 3y ago
Seems to be a perfect project to hijack. Not too much happening, widely used, long history, single maintainer who no longer has time to manage the project and wants to pass it over.
dang 3y ago
We detached this subthread from https://news.ycombinator.com/item?id=39866275 https://news.ycombinator.com/item?id=39866275. (It's fine; I'm just trying to prune the top-heavy subthread.)
AviationAtom 3y ago
Not a developer but reading the changelogs and commit history from this person seem interesting, as they appear to be some effort consolidate control and push things in the direction of supporting wider dissemination of their backdoor code: Discussing commits that the other author has since reverted, IFUNC change with Project Zero tests, a focus on embedded, etc.: https://www.mail-archive.com/xz-devel@tukaani.org/msg00642.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00642.h... Trimming security reporting details: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=af071ef7702debef4f1d324616a0137a5001c14c https://git.tukaani.org/?p=xz.git;a=commitdiff;h=af071ef7702...
electronwill 3y ago
"crazytan" is the LinkedIn profile of a security software engineer named Jia Tan in Sunnyvale working at Snowflake, who attended Shanghai Jiao Tong University from 2011 to 2015 and Georgia Institute of Technology from 2015 to 2017. However, this Jia Tan on LinkedIn might not be the same Jia Tan who worked on XZ Utils. Also, the person who inserted the malicious code might be someone else who hijacked the account of the Jia Tan who worked on XZ Utils.
wtznc 3y ago
I found a user who seems suspicious to me. https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denia... He understood the software architecture quite early on while working on the following repository. He connected the dots from his other projects and went rogue. (probably to benefit from crypto?). Take a look at his other repositories and code style and recent likes on github. Is he our Jia Tan?
b7kich 3y ago
May or may not be related: https://www.linkedin.com https://www.linkedin.com › crazytan Jia Tan - Snowflake | LinkedIn
molaeiali 3y ago
Has Jia in any way posted a response to the incident?
- AdmiralAsshat 3y ago
  My assumption would be that he knows the jig is up, and is probably going to do everything he can to jettison the JiaTan account, lest any IPs he uses be turned over to authorities.
source_inform 3y ago
An Indian with the name, Jigar (meaning heart) would never address himself as Jigar, as seen in the citation. This would be culturally a bit weird. Unless he is being sarcastic or writing this on some comic note. Secondly, the use of English is not consistent in what should be from typical Indian. He should be from a foreign background or a very reputed English medium. The language though seemingly simple for a native English speaker but it seems in this case; a person whose first language: likely is not English. It is possible that Grammarly or auto correct could have been used to write these. But can't be certain of anything stated above. I do think that this is a sabotage account with 60% chances unless Mr. Kumar comes out clean, publicly. He is likely a state sponsored actor.

b112 3y ago

Yikes indeed. This fix is being rolled out very fast, but what about the entire rest of the codebase? And scripts? I mean, years of access? I'd trust no aspect of this code until a full audit is done, at least of every patch this author contributed. (note: not referring to fedora here, a current fix is required. But just generally. As in, everyone is rolling out this fix, but... I mean, this codebase is poison in my eyes without a solid audit)

b112 3y ago
This seems to be the account, correct me if wrong (linked from the security email commit link): https://github.com/JiaT75 https://github.com/JiaT75 I hope authors of all these projects have been alerted. STest - Unit testing framework for C/C++. Easy to use by simply dropping stest.c and stest.h into your project! libarchive/libarchive - Multi-format archive and compression library Seatest - Simple C based Unit Testing Everything this account has done should be investigated. Woha, is this legit or some sort of scam on Google in some way?: https://github.com/google/oss-fuzz/pull/11587 https://github.com/google/oss-fuzz/pull/11587 edit: I have to be missing something, or I'm confused. The above author seems to be primary contact for xz? Have they just taken over?? Or did the bad commit come from another source, and a legit person applied it? A bit confused here.
- tux3 3y ago
  The concern about other projects is fine, but let's be careful with attacks directed at the person. Maybe their account is compromised, maybe the username borrows the identity of an innocent person with the same name. Focus on the code, not people. No point forming a mob. (e: post above was edited and is no longer directed at the person. thanks for the edit.)
  - deleted 3y ago
    [deleted]
  - simiones 3y ago
    It's important to focus on people, not just code, when suspecting an adversary. Now, I have no idea if this is the right account, and if it has recently been compromised/sold/lost, or if it has always been under the ownership of the person who committed the backdoor. But IF this is indeed the right account, then it's important to block any further commit from it to any project, no matter how innocuous it seems, and to review thoroughly any past commit. For the most security-conscious projects, it would be a good idea to even consider reverting and re-implementing any work coming from this account if it's not fully understood. An account that has introduced a backdoor is not the same thing as an account who committed a bug.
    - tux3 3y ago
      I agree we should look at the account and its contributions, I make a distinction between the account and the person. Sometimes the distinction is not meaningful, but better safe than sorry.
      - tsimionescu 3y ago
        Oh, agreed then.
  - kevin_b_er 3y ago
    They appear to have moved carefully to set this up over the course of weeks by setting up the framework to perform this attack. I would now presume this person to be a hostile actor and their contributions anywhere and everywhere must be audited. I would not wait for them to cry 'but my bother did it', because an actual malicious actor would say the same thing. The 'mob' should be pouring over everything they've touched. Audit now and audit aggressively.
    - b112 3y ago
      My above post shows the primary domain for xz moving from tukaani.org to xz.tukaani.org. While it's hosted on github: $ host xz.tukaani.org host xz.tukaani.org is an alias for tukaani-project.github.io. And originally it was not: $ host tukaani.org tukaani.org has address 5.44.245.25 (seemingly in Finland) It was moved there in Jan of this year, as per the commit listed in my prior post. By this same person/account. This means that instead of Lasse Collin's more restrictive webpage, an account directly under the control of the untrusted account, is now able to edit the webpage without anyone else's involvement. For example, to make subtle changes in where to report security issues to, and so on. So far I don't see anything nefarious, but at the same time, isn't this the domain/page hosting bad tarballs too?
- soraminazuki 3y ago
  Oh no, not libarchive! GitHub search shows 6 pull requests were merged back in 2021. https://github.com/search?q=repo%3Alibarchive%2Flibarchive+jiat75&type=commits https://github.com/search?q=repo%3Alibarchive%2Flibarchive+j... It does look innocent enough though. Let's hope there's no unicode trickery involved...
  - steelframe 3y ago
    Maybe not. They removed safe_fprintf() here and replaced it with the (unsafe) fprintf(). https://github.com/libarchive/libarchive/commit/e37efc16c8665f405182dd77eb1bbb32376f5484 https://github.com/libarchive/libarchive/commit/e37efc16c866...
    - buildbot 3y ago
      If libarchive is also backdoored, would that allow specifically crafted http gzip encoded responses to do bad things?
      - nicolas_17 3y ago
        What software is using libarchive to decode HTTP responses?
        buildbot 3y ago
        I don't know, way outside my domain. Possibly none I guess?
        giantrobot 3y ago
        FreeBSD's archive tools are built on top of libarchive IIRC. Not sure about the other BSDs.
        mattbee 3y ago
        Well for one, the Powershell script I just wrote to build all the 3rd-party library dependencies for a video game. tar.exe was added to Windows this January, sourced from libarchive: https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows https://learn.microsoft.com/en-us/virtualization/community/t... Unlike the GNU tar I'm used to, it's actually a "full fat" command line archiving tool, compressing & decompressing zip, xz, bz2 on the command-line - really handy :-O
- Zetobal 3y ago
  That looks like a repo that would sound alarms if you look at it from a security standpoint.
- davexunit 3y ago
  JiaT75 also has commits in wasmtime according to https://hachyderm.io/@joeyh/112180082372196735 https://hachyderm.io/@joeyh/112180082372196735
  - pinko 3y ago
    per https://hachyderm.io/@bjorn3/112180226784517099 https://hachyderm.io/@bjorn3/112180226784517099, "The only contribution by them to Wasmtime is a doc change. No actual code or binary blobs have been changed by them."
  - mintplant 3y ago
    Just a documentation change, fortunately: https://github.com/bytecodealliance/wasmtime/commits?author=JiaT75 https://github.com/bytecodealliance/wasmtime/commits?author=... They've submitted little documentation tweaks to other projects, too; for example: https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp-docs?view=msvc-170#community-contributors https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp... I don't know whether this is a formerly-legitimate open source contributor who went rogue, or a deep-cover persona spreading innocuous-looking documentation changes around to other projects as a smokescreen.
    - bombcar 3y ago
      Minor documentation change PRs is a well known tactic used to make your GitHub profile look better (especially to potential employers). He could be doing the same thing for other reasons; nobody really digs into anything very deep so I could see someone handing over co-maintenance to a project based on a decent looking Github graph and some reasonability.
    - mysidia 3y ago
      Consider the possibility those type of submissions were part of the adversary's strategy in order to make their account appear more legitimate rather than appearing out of nowhere wanting to become the maintainer of some project.
- ikmckenz 3y ago
  > The above author seems to be primary contact for xz? They made themselves the primary contact for xz for Google oss-fuzz about one year ago: https://github.com/google/oss-fuzz/commit/6403e93344476972e908ce17e8244f5c2b957dfd https://github.com/google/oss-fuzz/commit/6403e93344476972e9...
- bed99 3y ago
  A SourceGraph search like this shows https://sourcegraph.com/search?q=context:global+JiaT75&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+JiaT75&patte... - Jia Tan <jiat75@gmail.com> - jiat75 <jiat0218@gmail.com> ``` amap = generate_author_map("xz") test_author = amap.get_author_by_name("Jia Cheong Tan") self.assertEqual( test_author.names, {"Jia Cheong Tan", "Jia Tan", "jiat75"} ) self.assertEqual( test_author.mail_addresses, {"jiat0218@gmail.com", "jiat75@gmail.com"} ) ```
  - pryce 3y ago
    additionally, even though the commit messages they've made are mostly plain, there may be features of their commit messages that could provide leads, such as his using what looks like a very obscure racist joke of referring to a gitignore file as a 'gitnigore'. There's barely a handful of people on the whole planet making this 'joke'.
    - berdario 3y ago
      Can you point to where you saw that racist joke? I don't see anything at https://sourcegraph.com/search?q=context:global+author:jiat0218%40gmail.com+gitnigore&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+author:jiat0...
      - pryce 3y ago
        first commit made in one of JiaT75's other repos https://github.com/JiaT75/STest/commits/master/ https://github.com/JiaT75/STest/commits/master/
        berdario 3y ago
        Thank you. If you wouldn't have explained the background, I totally would've thought that this is just an innocent typo. (I still think it's like... 60% a typo? don't know) Anyhow, other people called the CCing of JiaT75 by Lasse suspicious: https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.collin@tukaani.org/ https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co... Someone pointed out the "mental health issues" and "some other things" https://news.ycombinator.com/item?id=39868881 https://news.ycombinator.com/item?id=39868881 https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... Lasse is of course a Nordic name, and the whole project has a finnish name and hosting https://news.ycombinator.com/item?id=39866902 https://news.ycombinator.com/item?id=39866902 If I wanted to go rogue and insert a backdoor in a project of mine, I'd probably create a new sockpuppet account and hand over management of the project to them. The above is worringly compatible with this hypothesis. OTOH, JiaT75 did not reuse the existing hosting provider, but rather switched the site to github.io and uploaded there old tarballs: https://github.com/tukaani-project/tukaani-project.github.io/commit/071a8acf097e11b659f6d7eb0f3b2e5e8934de0e https://github.com/tukaani-project/tukaani-project.github.io... If JiaT75 is an old-timer in the project, wouldn't they have kept using the same hosting infra? There are also some other grim possibilities: someone forced Lasse to hand over the project (violence or blackmailing? as farfetched as that sounds)... or maybe stole Lasse devices (and identity?) and now Lasse is incapacitated? Or maybe it's just some other fellow scandinavian who pretended to be chinese and got Lasse's trust. In which case I wish Lasse all the best, and hope they'll be able to clear their name. Is the same person sockpuppeting Hans Jansen? It's amusing (but unsurprising) that they are using both german-sounding and chinese-sounding identities. That said, I don't think it's unreasonable to think that Lasse genuinely trusted JiaT75, genuinely believed that the ifunc stuff was reasonable (it probably isn't: https://news.ycombinator.com/item?id=39869538 https://news.ycombinator.com/item?id=39869538 ) and handed over the project to them. And at the end of the day, the only thing linking JiaT75 to a nordic identity is a nordic racist joke which could well be a typo. People already checked the timezone of the commits, but I wonder if anyone has already checked the time-of-day of those commits... does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? (of course, that's also easy to manipulate, but maybe they could've slip up) Anyhow, I guess that security folks at Microsoft and Google (because of JiaT75 email account) are probably going to cooperate with authorities on trying to pin down the identity of JiaT75 (which might not be very useful, depending on where they live).
- metzmanj 3y ago
  >Woha, is this legit or some sort of scam on Google in some way?: I work on OSS-Fuzz. As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way. OSS-Fuzz doesn't trust user code for this very reason.
  - packetlost 3y ago
    It looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
    - metzmanj 3y ago
      That's what people are saying though I haven't had the chance to look into this myself. Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
      - bombcar 3y ago
        It's more likely that fuzzing would blow up on new code and they wanted an excuse to remove it. After all, if it hadn't had a performance regression (someone could submit a PR fixing whatever slowed it down, heh) it still wouldn't be known.
- jnxx 3y ago
  There is also a variety of new, parallelized implementations of compression algorithms which would be good to have a close look at. Bugs causing undefined behaviour in parallel code are notoriously hard to see, and the parallel versions (which are actually much faster) could be take the place of well-established programs which have earned a lot of trust.
formerly_proven 3y ago
Well that account also did most of the releases since 5.4.0.
- alwaysbeconsing 3y ago
  +1 Can see from project homepage http://web.archive.org/web/20240329165859/https://xz.tukaani.org/xz-utils/ http://web.archive.org/web/20240329165859/https://xz.tukaani... they have some release responsibility from 5.2.12. > Versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key . The older releases have been signed with Lasse Collin's OpenPGP key . It must be assume that before acquiring that privilege, they also contributed code to project. Probably most was to establish respectable record. Still could be malicious code going back someways.
  - 0x0 3y ago
    Looks like the Jia Tan OpenPGP key was replaced a few months ago as well: https://github.com/tukaani-project/tukaani-project.github.io/commit/76f58f1e14e44d69f712841090d331437c187b30 https://github.com/tukaani-project/tukaani-project.github.io...

rwmj 3y ago

I handed over all the emails I received to the security team, who I guess will send them "higher". I'll let them analyse it.

5kg 3y ago

There is zero web presence for this person and associated email address. Looks more likely a fake identity than compromised account.

Retr0id 3y ago
Did you check Chinese social media?
- hw 3y ago
  Why would you think the person would have social media (or would even be on Chinese social media specifically), given the sophistication and planning?
  - Retr0id 3y ago
    I mention Chinese social media specifically because I know it's not indexed so well by western search engines. You can't conclude someone has no social footprint until you've actually checked. Regardless of how likely you think it is, finding a social media footprint would be useful information. Seek information first, reach conclusions second.
- thrash158 3y ago
  I found this link on Zhihu: https://www.zhihu.com/question/650826484 https://www.zhihu.com/question/650826484
mrb 3y ago
Actually the "jiat0218" user part in his email address jiat0218@gmail.com has a bunch of matches on Taiwanese sites: https://char.tw/blog/post/24397301 https://char.tw/blog/post/24397301 https://forum.babyhome.com.tw/topic/167439 https://forum.babyhome.com.tw/topic/167439 https://bmwcct.com.tw/forums/thread1828.html https://bmwcct.com.tw/forums/thread1828.html
- 5kg 3y ago
  I think it's just a coincidence. - All the posts are from 2004/2006. - "jiat" can be abbreviation for many common Chinese names.

wpietri 3y ago

I get why people are focusing on this bad actor. But the question that interests me more: how many other apparent individuals fit the profile that this person presented before caught?

Phenylacetyl 3y ago
Apparently, many. It looks like gettext may be containing a part of their attack infrastructure. https://github.com/microsoft/vcpkg/pull/37199#pullrequestreview-1924053615 https://github.com/microsoft/vcpkg/pull/37199#pullrequestrev... https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16d9c519b2d76f862abe4fe02d40f84e8daa712f7e08b616df3f16376c82431 https://github.com/microsoft/vcpkg/pull/37356/files#diff-e16... https://github.com/MonicaLiu0311 https://github.com/MonicaLiu0311
- collinfunk 3y ago
  Are you referencing the '-unsafe' suffix in the second link? That is not something to worry about. This is from Gnulib, which is used by Gettext and other GNU projects. Using 'setlocale (0, NULL)' is not thread-safe on all platforms. Gnulib has modules to work around this, but not all projects want the extra locking. Hence the name '-unsafe'. :) See: https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg00127.html https://lists.gnu.org/archive/html/bug-gnulib/2024-02/msg001...
  - everybackdoor 3y ago
    They may be right: https://git.alpinelinux.org/aports/log/main/gettext https://git.alpinelinux.org/aports/log/main/gettext Timeline matches and there is a sudden switch of maintainer. And they add dependency to xz!
    - kaathewise 3y ago
      psykose was a prolific contributor to Alpine's aports, with thousands of commits over the past few years[0]. So, I doubt They're involved. [0]: https://git.alpinelinux.org/aports/stats/?period=y&ofs=10 https://git.alpinelinux.org/aports/stats/?period=y&ofs=10

mrb 3y ago

I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it could in theory be malware authors (ransomware, etc). However these guys tend to aim at the low hanging fruits. They want to make a buck quickly. I don't think they have the patience and persistence to infiltrate an open source project for 2 long years to finally gain enough trust and access to backdoor it. On the other hand, a state actor is in for the long term, so they would spend that much time (and more) to accomplish that. So that's my guess: Jia Tan is an employee of some intelligence agency. He chose to present an asian persona, but that's not necessarily who he truly represents. Could be anyone, really: Russia, China, Israel, or even the US, etc. Edit: given that Lasse Collin was the only maintainer of xz utils in 2022 before Jia Tan, I wouldn't be surprised if the state actor interfered with Lasse somehow. They could have done anything to distract him from the project: introduce a mistress in his life, give him a high-paying job, make his spouse sick so he has to care for her, etc. With Lasse not having as many hours to spend on the project, he would have been more likely to give access to a developer who shows up around the same time and who is highly motivated to contribute code. I would be interested to talk to Lasse to understand his circumstances around 2022.

janc_ 3y ago
Or they have just one or a small number of targets, but don’t want the target(s) to know that they were the only target(s), so they backdoor a large number of victims to “hide in the crowd”. I agree that this is likely a state actor, or at least a very large & wealthy private actor who can play the long game…
dist-epoch 3y ago
According to top comment he committed multiple binary files to xz for the last two years. Most likely this is not the first backdoor, just the first one to be discovered, so it wasn't two years of work until there were results. But I still agree that he's probably a state actor.

jpalomaki 3y ago

Seems to be a perfect project to hijack. Not too much happening, widely used, long history, single maintainer who no longer has time to manage the project and wants to pass it over.

dang 3y ago

We detached this subthread from https://news.ycombinator.com/item?id=39866275 https://news.ycombinator.com/item?id=39866275. (It's fine; I'm just trying to prune the top-heavy subthread.)

AviationAtom 3y ago

Not a developer but reading the changelogs and commit history from this person seem interesting, as they appear to be some effort consolidate control and push things in the direction of supporting wider dissemination of their backdoor code: Discussing commits that the other author has since reverted, IFUNC change with Project Zero tests, a focus on embedded, etc.: https://www.mail-archive.com/xz-devel@tukaani.org/msg00642.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00642.h... Trimming security reporting details: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=af071ef7702debef4f1d324616a0137a5001c14c https://git.tukaani.org/?p=xz.git;a=commitdiff;h=af071ef7702...

electronwill 3y ago

"crazytan" is the LinkedIn profile of a security software engineer named Jia Tan in Sunnyvale working at Snowflake, who attended Shanghai Jiao Tong University from 2011 to 2015 and Georgia Institute of Technology from 2015 to 2017. However, this Jia Tan on LinkedIn might not be the same Jia Tan who worked on XZ Utils. Also, the person who inserted the malicious code might be someone else who hijacked the account of the Jia Tan who worked on XZ Utils.

wtznc 3y ago

I found a user who seems suspicious to me. https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denial-of-service-vulnerability https://github.com/snappyJack/CVE-request-XZ-5.2.5-has-denia... He understood the software architecture quite early on while working on the following repository. He connected the dots from his other projects and went rogue. (probably to benefit from crypto?). Take a look at his other repositories and code style and recent likes on github. Is he our Jia Tan?

b7kich 3y ago

May or may not be related: https://www.linkedin.com https://www.linkedin.com › crazytan Jia Tan - Snowflake | LinkedIn

molaeiali 3y ago

Has Jia in any way posted a response to the incident?

AdmiralAsshat 3y ago
My assumption would be that he knows the jig is up, and is probably going to do everything he can to jettison the JiaTan account, lest any IPs he uses be turned over to authorities.

source_inform 3y ago

An Indian with the name, Jigar (meaning heart) would never address himself as Jigar, as seen in the citation. This would be culturally a bit weird. Unless he is being sarcastic or writing this on some comic note. Secondly, the use of English is not consistent in what should be from typical Indian. He should be from a foreign background or a very reputed English medium. The language though seemingly simple for a native English speaker but it seems in this case; a person whose first language: likely is not English. It is possible that Grammarly or auto correct could have been used to write these. But can't be certain of anything stated above. I do think that this is a sabotage account with 60% chances unless Mr. Kumar comes out clean, publicly. He is likely a state sponsored actor.