5 ms·
Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library
- dannyw 3y agoI think there is a reasonable likelihood* that the compromise originates from Five Eyes. Would you really want to report IOCs to CISA? *Given the patience and sophistication of the attack, and my speculation that the NSA likely would’ve caught it and alerted it if it was China or Russia.
- acdha 3y agoIf you’re going to be playing that game, consider that his other contributions included optimizing CRC performance on the Chinese LoongArch CPUs with which he appeared to very familiar.
- wuiheerfoj 3y agoThe perpetrator is clearly a highly skilled dev, it doesn’t seem farfetched that they could become acquainted with a ‘foreign’ tech stack to sell a cover story
- yorwba 3y agoWhere are you getting this from? JiaT75 reviewed a pull request by xry111 including said optimization (which hadn't yet been merged), that's all.
- acdha 3y agoI saw https://news.ycombinator.com/item?id=39866716 https://news.ycombinator.com/item?id=39866716 yesterday but subsequent comments actually linked to it and a quick trip to the internet archive says you’re right.
- jtc331 3y agoThe assumption that the NSA catches (and discloses) most flaws in major open source software requires a high suspension of disbelief.
- acdha 3y agoIn particular it requires belief that the NSA ignores its mandated mission to protect U.S. infrastructure and is arrogant enough to think only they could find those problems. The federal government, state and local governments, key service providers, major utilities, etc. all rely on open source software and there’s no plausible way they wouldn’t be leaving those open to attack if they didn’t report a known vulnerability.
- lamontcg 3y agohttps://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- acdha 3y agoYes, that’s a good example of what I’m talking about. Even when they tried to subvert a cryptographic primitive, notice how they designed it in such a way that they could exploit it but other parties could not? Even making the attempt was unacceptable but I will say it’s categorically different than leaving an open source vulnerability unpatched. If they weren’t the ones who created it, they wouldn’t have noticed but not reported it – even our closest allies aren’t trusted with root on government servers.
- nixgeek 3y agoI think there is an equally reasonable likelihood that nation state security and intelligence apparatus have disinformation capabilities that include monitoring and when necessary posting to and attempting to influence online forums like HN.
- halJordan 3y agoThe nsa isnt a boogeyman you can just ascribe action. I mean you can, it's just wrong. Choosing to fill a void with a boogeyman because it's less uncomfortable than not knowing is exactly the conspiratorial thinking that gets us to chem trails and flat earth
- jwilk 3y agohttps://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810 (over 1300 comments)
- miduil 3y agoGotta love that they're now suggesting to downgrade to 5.4.6 with a link to the now defunct (and under control of the same authors) repository. They should have probably released hash and version of a not affected source tarball.
- hyperman1 3y agoThe Debian message is more interesting. They try to find out what happens when all potentially suspect commits disappear. They need to downgrade a lot further - 5.3.1- and break the API. The whole situation seems nasty.
- doubled112 3y agoSomebody pointed out fairly early that the current stable release was released by the same account too, and I wondered how deep this hole would go.
- deleted 3y ago[deleted]
- ghthor 3y agoThat really undersells the significance of this, GJ Cisa /s
- deleted 3y ago[deleted]
- xyst 3y agoIs there any information on the actual person that introduced the back door? Possible state actor? Or maybe a black hat that was trying to sell the “back door” for cash/crypto currency?
- syngrog66 3y agoThat was yesterday.