8 ms·

Yikes indeed. This fix is being rolled out very fast, but what about the entire rest of the codebase? And scripts? I mean, years of access? I'd trust no asp

• b112 3y ago
  This seems to be the account, correct me if wrong (linked from the security email commit link): https://github.com/JiaT75 https://github.com/JiaT75 I hope authors of all these projects have been alerted. STest - Unit testing framework for C/C++. Easy to use by simply dropping stest.c and stest.h into your project! libarchive/libarchive - Multi-format archive and compression library Seatest - Simple C based Unit Testing Everything this account has done should be investigated. Woha, is this legit or some sort of scam on Google in some way?: https://github.com/google/oss-fuzz/pull/11587 https://github.com/google/oss-fuzz/pull/11587 edit: I have to be missing something, or I'm confused. The above author seems to be primary contact for xz? Have they just taken over?? Or did the bad commit come from another source, and a legit person applied it? A bit confused here.
  • tux3 3y ago
    The concern about other projects is fine, but let's be careful with attacks directed at the person. Maybe their account is compromised, maybe the username borrows the identity of an innocent person with the same name. Focus on the code, not people. No point forming a mob. (e: post above was edited and is no longer directed at the person. thanks for the edit.)
    • deleted 3y ago
      [deleted]
    • simiones 3y ago
      It's important to focus on people, not just code, when suspecting an adversary. Now, I have no idea if this is the right account, and if it has recently been compromised/sold/lost, or if it has always been under the ownership of the person who committed the backdoor. But IF this is indeed the right account, then it's important to block any further commit from it to any project, no matter how innocuous it seems, and to review thoroughly any past commit. For the most security-conscious projects, it would be a good idea to even consider reverting and re-implementing any work coming from this account if it's not fully understood. An account that has introduced a backdoor is not the same thing as an account who committed a bug.
      • tux3 3y ago
        I agree we should look at the account and its contributions, I make a distinction between the account and the person. Sometimes the distinction is not meaningful, but better safe than sorry.
        • tsimionescu 3y ago
          Oh, agreed then.
    • kevin_b_er 3y ago
      They appear to have moved carefully to set this up over the course of weeks by setting up the framework to perform this attack. I would now presume this person to be a hostile actor and their contributions anywhere and everywhere must be audited. I would not wait for them to cry 'but my bother did it', because an actual malicious actor would say the same thing. The 'mob' should be pouring over everything they've touched. Audit now and audit aggressively.
      • b112 3y ago
        My above post shows the primary domain for xz moving from tukaani.org to xz.tukaani.org. While it's hosted on github: $ host xz.tukaani.org host xz.tukaani.org is an alias for tukaani-project.github.io. And originally it was not: $ host tukaani.org tukaani.org has address 5.44.245.25 (seemingly in Finland) It was moved there in Jan of this year, as per the commit listed in my prior post. By this same person/account. This means that instead of Lasse Collin's more restrictive webpage, an account directly under the control of the untrusted account, is now able to edit the webpage without anyone else's involvement. For example, to make subtle changes in where to report security issues to, and so on. So far I don't see anything nefarious, but at the same time, isn't this the domain/page hosting bad tarballs too?
        • buildbot 3y ago
          > tukaani.org has address 5.44.245.25 (seemingly in Finland) Hetzner?
          • TimWolla 3y ago
            No: route: 5.44.240.0/21 descr: Zoner Oy origin: AS201692 mnt-by: MNT-ZONER created: 2014-09-03T08:09:00Z last-modified: 2014-09-03T08:09:00Z source: RIPE
            • buildbot 3y ago
              Interesting, seems to be a tiny finnish hosting company: https://www.zoner.fi/english/ https://www.zoner.fi/english/
    • mort96 3y ago
      If the owner of the account is innocent and their account was compromised, it's on them to come out and say that. All signs currently point to the person being a malicious actor, so I'll proceed on that assumption.
      • londons_explore 3y ago
        Does the person exist at all? Maybe they're a persona of a team working at some three letter agency...
        • bonzini 3y ago
          Or for some three letter party.
        • Citizen8396 3y ago
          Probably not. I did some pattern of life analysis on their email/other identifiers. It looks exactly like when I set up a burner online identity- just enough to get past platform registration, but they didn't care enough to make it look real. For example, their email is only registered to GitHub and Twitter. They haven't even logged into their Google account for almost a year. There's also no history of it being in any data breaches (because they never use it). Burn the witch.
          • ancientMariner 3y ago
            It would be interesting to hear the whole arc of social engineering behind getting access to the repo. Although, as a maintainer of a large-ish OSS project myself, I know that under a lot of burden any help will be welcomed with open arms, and I've never really talked about private stuff with any of them.
          • Ill_Yam_689 3y ago
            did you find the Twitter account associated to Jia's email?
            • deleted 3y ago
  • soraminazuki 3y ago
    Oh no, not libarchive! GitHub search shows 6 pull requests were merged back in 2021. https://github.com/search?q=repo%3Alibarchive%2Flibarchive+jiat75&type=commits https://github.com/search?q=repo%3Alibarchive%2Flibarchive+j... It does look innocent enough though. Let's hope there's no unicode trickery involved...
    • steelframe 3y ago
      Maybe not. They removed safe_fprintf() here and replaced it with the (unsafe) fprintf(). https://github.com/libarchive/libarchive/commit/e37efc16c8665f405182dd77eb1bbb32376f5484 https://github.com/libarchive/libarchive/commit/e37efc16c866...
      • buildbot 3y ago
        If libarchive is also backdoored, would that allow specifically crafted http gzip encoded responses to do bad things?
        • nicolas_17 3y ago
          What software is using libarchive to decode HTTP responses?
          • buildbot 3y ago
            I don't know, way outside my domain. Possibly none I guess?
          • giantrobot 3y ago
            FreeBSD's archive tools are built on top of libarchive IIRC. Not sure about the other BSDs.
          • mattbee 3y ago
            Well for one, the Powershell script I just wrote to build all the 3rd-party library dependencies for a video game. tar.exe was added to Windows this January, sourced from libarchive: https://learn.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows https://learn.microsoft.com/en-us/virtualization/community/t... Unlike the GNU tar I'm used to, it's actually a "full fat" command line archiving tool, compressing & decompressing zip, xz, bz2 on the command-line - really handy :-O
  • Zetobal 3y ago
    That looks like a repo that would sound alarms if you look at it from a security standpoint.
  • davexunit 3y ago
    JiaT75 also has commits in wasmtime according to https://hachyderm.io/@joeyh/112180082372196735 https://hachyderm.io/@joeyh/112180082372196735
    • pinko 3y ago
      per https://hachyderm.io/@bjorn3/112180226784517099 https://hachyderm.io/@bjorn3/112180226784517099, "The only contribution by them to Wasmtime is a doc change. No actual code or binary blobs have been changed by them."
    • mintplant 3y ago
      Just a documentation change, fortunately: https://github.com/bytecodealliance/wasmtime/commits?author=JiaT75 https://github.com/bytecodealliance/wasmtime/commits?author=... They've submitted little documentation tweaks to other projects, too; for example: https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp-docs?view=msvc-170#community-contributors https://learn.microsoft.com/en-us/cpp/overview/whats-new-cpp... I don't know whether this is a formerly-legitimate open source contributor who went rogue, or a deep-cover persona spreading innocuous-looking documentation changes around to other projects as a smokescreen.
      • bombcar 3y ago
        Minor documentation change PRs is a well known tactic used to make your GitHub profile look better (especially to potential employers). He could be doing the same thing for other reasons; nobody really digs into anything very deep so I could see someone handing over co-maintenance to a project based on a decent looking Github graph and some reasonability.
      • mysidia 3y ago
        Consider the possibility those type of submissions were part of the adversary's strategy in order to make their account appear more legitimate rather than appearing out of nowhere wanting to become the maintainer of some project.
  • ikmckenz 3y ago
    > The above author seems to be primary contact for xz? They made themselves the primary contact for xz for Google oss-fuzz about one year ago: https://github.com/google/oss-fuzz/commit/6403e93344476972e908ce17e8244f5c2b957dfd https://github.com/google/oss-fuzz/commit/6403e93344476972e9...
  • bed99 3y ago
    A SourceGraph search like this shows https://sourcegraph.com/search?q=context:global+JiaT75&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+JiaT75&patte... - Jia Tan <jiat75@gmail.com> - jiat75 <jiat0218@gmail.com> ``` amap = generate_author_map("xz") test_author = amap.get_author_by_name("Jia Cheong Tan") self.assertEqual( test_author.names, {"Jia Cheong Tan", "Jia Tan", "jiat75"} ) self.assertEqual( test_author.mail_addresses, {"jiat0218@gmail.com", "jiat75@gmail.com"} ) ```
    • pryce 3y ago
      additionally, even though the commit messages they've made are mostly plain, there may be features of their commit messages that could provide leads, such as his using what looks like a very obscure racist joke of referring to a gitignore file as a 'gitnigore'. There's barely a handful of people on the whole planet making this 'joke'.
      • berdario 3y ago
        Can you point to where you saw that racist joke? I don't see anything at https://sourcegraph.com/search?q=context:global+author:jiat0218%40gmail.com+gitnigore&patternType=keyword&sm=0 https://sourcegraph.com/search?q=context:global+author:jiat0...
        • pryce 3y ago
          first commit made in one of JiaT75's other repos https://github.com/JiaT75/STest/commits/master/ https://github.com/JiaT75/STest/commits/master/
          • berdario 3y ago
            Thank you. If you wouldn't have explained the background, I totally would've thought that this is just an innocent typo. (I still think it's like... 60% a typo? don't know) Anyhow, other people called the CCing of JiaT75 by Lasse suspicious: https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.collin@tukaani.org/ https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co... Someone pointed out the "mental health issues" and "some other things" https://news.ycombinator.com/item?id=39868881 https://news.ycombinator.com/item?id=39868881 https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h... Lasse is of course a Nordic name, and the whole project has a finnish name and hosting https://news.ycombinator.com/item?id=39866902 https://news.ycombinator.com/item?id=39866902 If I wanted to go rogue and insert a backdoor in a project of mine, I'd probably create a new sockpuppet account and hand over management of the project to them. The above is worringly compatible with this hypothesis. OTOH, JiaT75 did not reuse the existing hosting provider, but rather switched the site to github.io and uploaded there old tarballs: https://github.com/tukaani-project/tukaani-project.github.io/commit/071a8acf097e11b659f6d7eb0f3b2e5e8934de0e https://github.com/tukaani-project/tukaani-project.github.io... If JiaT75 is an old-timer in the project, wouldn't they have kept using the same hosting infra? There are also some other grim possibilities: someone forced Lasse to hand over the project (violence or blackmailing? as farfetched as that sounds)... or maybe stole Lasse devices (and identity?) and now Lasse is incapacitated? Or maybe it's just some other fellow scandinavian who pretended to be chinese and got Lasse's trust. In which case I wish Lasse all the best, and hope they'll be able to clear their name. Is the same person sockpuppeting Hans Jansen? It's amusing (but unsurprising) that they are using both german-sounding and chinese-sounding identities. That said, I don't think it's unreasonable to think that Lasse genuinely trusted JiaT75, genuinely believed that the ifunc stuff was reasonable (it probably isn't: https://news.ycombinator.com/item?id=39869538 https://news.ycombinator.com/item?id=39869538 ) and handed over the project to them. And at the end of the day, the only thing linking JiaT75 to a nordic identity is a nordic racist joke which could well be a typo. People already checked the timezone of the commits, but I wonder if anyone has already checked the time-of-day of those commits... does it actually match the working hours that a person genuinely living (and sleeping) in China would follow? (of course, that's also easy to manipulate, but maybe they could've slip up) Anyhow, I guess that security folks at Microsoft and Google (because of JiaT75 email account) are probably going to cooperate with authorities on trying to pin down the identity of JiaT75 (which might not be very useful, depending on where they live).
  • metzmanj 3y ago
    >Woha, is this legit or some sort of scam on Google in some way?: I work on OSS-Fuzz. As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way. OSS-Fuzz doesn't trust user code for this very reason.
    • packetlost 3y ago
      It looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
      • metzmanj 3y ago
        That's what people are saying though I haven't had the chance to look into this myself. Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
        • bombcar 3y ago
          It's more likely that fuzzing would blow up on new code and they wanted an excuse to remove it. After all, if it hadn't had a performance regression (someone could submit a PR fixing whatever slowed it down, heh) it still wouldn't be known.
  • jnxx 3y ago
    There is also a variety of new, parallelized implementations of compression algorithms which would be good to have a close look at. Bugs causing undefined behaviour in parallel code are notoriously hard to see, and the parallel versions (which are actually much faster) could be take the place of well-established programs which have earned a lot of trust.
• formerly_proven 3y ago
  Well that account also did most of the releases since 5.4.0.
  • alwaysbeconsing 3y ago
    +1 Can see from project homepage http://web.archive.org/web/20240329165859/https://xz.tukaani.org/xz-utils/ http://web.archive.org/web/20240329165859/https://xz.tukaani... they have some release responsibility from 5.2.12. > Versions 5.2.12, 5.4.3 and later have been signed with Jia Tan's OpenPGP key . The older releases have been signed with Lasse Collin's OpenPGP key . It must be assume that before acquiring that privilege, they also contributed code to project. Probably most was to establish respectable record. Still could be malicious code going back someways.
    • 0x0 3y ago
      Looks like the Jia Tan OpenPGP key was replaced a few months ago as well: https://github.com/tukaani-project/tukaani-project.github.io/commit/76f58f1e14e44d69f712841090d331437c187b30 https://github.com/tukaani-project/tukaani-project.github.io...