5 ms·

When is Google, Amazon, Facebook, the DARPA, the EU - ANYONE going to step up to the plate and fund developer time for such obviously critical infrastructure? W

by toxik 3y ago

When is Google, Amazon, Facebook, the DARPA, the EU - ANYONE going to step up to the plate and fund developer time for such obviously critical infrastructure? Why could a single Chinese guy undermine the entire system with so little effort?

ddalex 3y ago
How do you know it is a guy, and it is Chinese?
- toxik 3y ago
  I take it you haven’t looked into the details of this, there is no proof but there is strong evidence in name choice, language use and the MO.
  - jeltz 3y ago
    Name choice I disagree with. The attacker used at least Chinese, Indian and Scandinavian names when working on this. It is possible we can find out something by doing a statistical analysis of the language but as far as I know no such analysis has been done. Edit: A Russian sounding alias was also used.
    - kijin 3y ago
      My current hypothesis is that the attacker(s) deliberately chose a Chinese-sounding name to make people jump to conclusions. A sophisticated state actor would be no stranger to making their actions look like somebody else's. Or maybe they actually are Chinese, and want me to believe the sentence above. :)
      - lodovic 3y ago
        Indeed - seeing the level of sophistication and long term thinking behind this attack, it seems everything about it was planned meticulously, including usernames, attack vectors, communication with the community, and when to commit the parts of the exploit. There's probably a full team of people behind it and attributing it to China because of the username may be too quick.
  - t-sauer 3y ago
    That is rather naive thinking. Making up a misleading identity is probably one of the first things someone with such a long term plan would do.
  - raverbashing 3y ago
    And time zone as well it seems
  - bdhcuidbebe 3y ago
    I strongly disagree. If you scratch the surface you find ”misoeater” and some russian sounding user names, and even a danish name. These are all fake profiles and gives us no information about the bad actor. Spreading doubt is taught in bad actor-academy.
- nindalf 3y ago
  At best there’s an account with a Chinese sounding name. I’m never going to carry water for the PLA or the CCP, but I’d need to see stronger evidence before agreeing it’s them.
  - mathfailure 3y ago
    What about water for ZND or CBSOM?
    - nindalf 3y ago
      If you’re implying that I used incomprehensible initialisms, I’d argue that they’re easily understandable in the context of an alleged state sponsored attack from China. I think your comment is facetious and adds nothing to the conversation.
      - mathfailure 3y ago
        I as well think your comment adds nothing to the conversation. Neither this one, nor the previous one.
- cpach 3y ago
  Good point. We just don’t know.
- rurban 3y ago
  He is Taiwanese. At least he posted on Taiwanese boards. Jie would be female, Jia male
  - yorwba 3y ago
    Occurrences of "jiat0218" on Taiwanese websites are clearly copypasta from some other website that's probably defunct now. While gendered names do exist, you can't easily tell from the romanization, it depends on the exact characters used. And most likely "Jia" is the surname, or rather the romanization of one of five different surnames.
    - programmeruser 3y ago
      Tan is a common Chinese surname that's the Hokkien/Teochew transliteration of Chen. It's more commonly seen in overseas Chinese but I wouldn't jump to any conclusions
- mrintegrity 3y ago
  In other discussions the Chinese person in question has been spoken about at length
- twno1 3y ago
  The commit history from bad actor set tomezone to +0800 Source: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...
  - lco 3y ago
    > It’s most likely our actor just mashed plausible-sounding Chinese names together. Also from that writeup. It also links to https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... which suggests the actual TZ of 'Jia Tan' to be UTC+02/03
Anon1096 3y ago
There was just 2 active maintainers on xz, and the compromised individual has been the primary for >1 year. If anyone were to fund development time on it, ironically it would go exactly to the person working to backdoor it.
- toxik 3y ago
  Facebook would fund a Facebook engineer and would therefore have vetted the person in question. Same for other actors, there are ways to support these projects with eg a non-profit organization bankrolled by EU taxes or similar. Imagine if instead of Some Guy being the sole maintainer of critical infrastructure piece X, there was shared responsibility and accountability and less personal attachment. We can argue about the specific implementation, but to suggest that it’s impossible seems incorrect to me.
  - buffet_overflow 3y ago
    > Facebook engineer and therefore have vetted Haven’t nation state actors openly infiltrated high level companies? This would provide a false sense of security imo. If anything, we need better testing and behavior heuristics for incoming code.
    - b112 3y ago
      One thing missing here. I develop cool thing X. Now, 100 minor things depend upon it. Suddenly, Facebook (or anyone of that size!) starts using it, and decides to vet the maintainer/author. Who says anyone has to cooperate? It's his software. He wrote it. Don't like it? Well tough! Now obviously Facebook could author a replacement. It could fork and maintain. But the very nerve that Facebook(or anyone!) would insist upon a security audit of the anonymous author would be very, very strange. Next up, I lend a neighbour my lawn mower, after he comes begging to borrow it. Oh but wait! My neighbour now wants me to sign a libabilty form, and also undergo a security check, all so he can borrow my lawnmower! The hell?!?! Hoping this illustrates my point. The project author owes nothing to anyone. And it gets more wacky, if there are 100 companies demanding audits. What? Demand?! This is where distros are the strong point. They aren't perfect, but they catch a lot of stuff on their own. And maintainers of different distros often backchannel, support each other in this. In terms of some government org "vetting" people? Way to take the last vestiges of free software, and hacking, and turn it into a gatekeeping, bureaucratic nightmare. I guess one will need credentials, government id, a 10 year security check, to be fingerprinted, and so on? Security clearances work like that, and that's how you vet someone.
nindalf 3y ago
Everything looks obvious in hindsight doesn’t it? Several of the organisations you’ve mentioned have funded projects to rewrite critical internet infrastructure in a memory safe language - HTTP client, HTTP reverse proxy, DNS resolver, NTP server, TLS library, AV1 decoder, a replacement for sudo, among other projects (https://memorysafety.org https://memorysafety.org). More can always be done, and it can always be done faster than it’s being done. Fwiw, it’s possible to use zstd instead of xz, which was created at and actively maintained at Facebook. So if you were expecting Big Tech to identify this class of problem and do something about it, it seems like they are. But if you expected them to eliminate every single possible instance of such an issue, that’s a bit much isn’t it?
- DrBazza 3y ago
  Would a 'memory safe' language really have stopped any of this? From what I've briefly read, this incident the whole attack process (PR, fake test data, social engineering) from start to finish by a state-actor (most likely), could have been in any language.
  - lifthrasiir 3y ago
    You are right, but C/C++ was vulnerable to this particular MO because of its complicated build process.
    - uecker 3y ago
      I would say today there is no real need for autoconf anymore in C / C++ and the build process could be fairly easy.
    - kukkamario 3y ago
      There are million ways to hide exploits even in "safe" languages. If you have a bad actor that can spend couple years prepping how to hide an exploit, then it doesn't really matter which programming language is used. Build system is complex because of legacy and need to support millions of different platforms and distros.

by toxik 3y ago

ddalex 3y ago

How do you know it is a guy, and it is Chinese?

toxik 3y ago
I take it you haven’t looked into the details of this, there is no proof but there is strong evidence in name choice, language use and the MO.
- jeltz 3y ago
  Name choice I disagree with. The attacker used at least Chinese, Indian and Scandinavian names when working on this. It is possible we can find out something by doing a statistical analysis of the language but as far as I know no such analysis has been done. Edit: A Russian sounding alias was also used.
  - kijin 3y ago
    My current hypothesis is that the attacker(s) deliberately chose a Chinese-sounding name to make people jump to conclusions. A sophisticated state actor would be no stranger to making their actions look like somebody else's. Or maybe they actually are Chinese, and want me to believe the sentence above. :)
    - lodovic 3y ago
      Indeed - seeing the level of sophistication and long term thinking behind this attack, it seems everything about it was planned meticulously, including usernames, attack vectors, communication with the community, and when to commit the parts of the exploit. There's probably a full team of people behind it and attributing it to China because of the username may be too quick.
- t-sauer 3y ago
  That is rather naive thinking. Making up a misleading identity is probably one of the first things someone with such a long term plan would do.
- raverbashing 3y ago
  And time zone as well it seems
- bdhcuidbebe 3y ago
  I strongly disagree. If you scratch the surface you find ”misoeater” and some russian sounding user names, and even a danish name. These are all fake profiles and gives us no information about the bad actor. Spreading doubt is taught in bad actor-academy.
nindalf 3y ago
At best there’s an account with a Chinese sounding name. I’m never going to carry water for the PLA or the CCP, but I’d need to see stronger evidence before agreeing it’s them.
- mathfailure 3y ago
  What about water for ZND or CBSOM?
  - nindalf 3y ago
    If you’re implying that I used incomprehensible initialisms, I’d argue that they’re easily understandable in the context of an alleged state sponsored attack from China. I think your comment is facetious and adds nothing to the conversation.
    - mathfailure 3y ago
      I as well think your comment adds nothing to the conversation. Neither this one, nor the previous one.
cpach 3y ago
Good point. We just don’t know.
rurban 3y ago
He is Taiwanese. At least he posted on Taiwanese boards. Jie would be female, Jia male
- yorwba 3y ago
  Occurrences of "jiat0218" on Taiwanese websites are clearly copypasta from some other website that's probably defunct now. While gendered names do exist, you can't easily tell from the romanization, it depends on the exact characters used. And most likely "Jia" is the surname, or rather the romanization of one of five different surnames.
  - programmeruser 3y ago
    Tan is a common Chinese surname that's the Hokkien/Teochew transliteration of Chen. It's more commonly seen in overseas Chinese but I wouldn't jump to any conclusions
mrintegrity 3y ago
In other discussions the Chinese person in question has been spoken about at length
twno1 3y ago
The commit history from bad actor set tomezone to +0800 Source: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...
- lco 3y ago
  > It’s most likely our actor just mashed plausible-sounding Chinese names together. Also from that writeup. It also links to https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... which suggests the actual TZ of 'Jia Tan' to be UTC+02/03

Anon1096 3y ago

There was just 2 active maintainers on xz, and the compromised individual has been the primary for >1 year. If anyone were to fund development time on it, ironically it would go exactly to the person working to backdoor it.

toxik 3y ago
Facebook would fund a Facebook engineer and would therefore have vetted the person in question. Same for other actors, there are ways to support these projects with eg a non-profit organization bankrolled by EU taxes or similar. Imagine if instead of Some Guy being the sole maintainer of critical infrastructure piece X, there was shared responsibility and accountability and less personal attachment. We can argue about the specific implementation, but to suggest that it’s impossible seems incorrect to me.
- buffet_overflow 3y ago
  > Facebook engineer and therefore have vetted Haven’t nation state actors openly infiltrated high level companies? This would provide a false sense of security imo. If anything, we need better testing and behavior heuristics for incoming code.
  - b112 3y ago
    One thing missing here. I develop cool thing X. Now, 100 minor things depend upon it. Suddenly, Facebook (or anyone of that size!) starts using it, and decides to vet the maintainer/author. Who says anyone has to cooperate? It's his software. He wrote it. Don't like it? Well tough! Now obviously Facebook could author a replacement. It could fork and maintain. But the very nerve that Facebook(or anyone!) would insist upon a security audit of the anonymous author would be very, very strange. Next up, I lend a neighbour my lawn mower, after he comes begging to borrow it. Oh but wait! My neighbour now wants me to sign a libabilty form, and also undergo a security check, all so he can borrow my lawnmower! The hell?!?! Hoping this illustrates my point. The project author owes nothing to anyone. And it gets more wacky, if there are 100 companies demanding audits. What? Demand?! This is where distros are the strong point. They aren't perfect, but they catch a lot of stuff on their own. And maintainers of different distros often backchannel, support each other in this. In terms of some government org "vetting" people? Way to take the last vestiges of free software, and hacking, and turn it into a gatekeeping, bureaucratic nightmare. I guess one will need credentials, government id, a 10 year security check, to be fingerprinted, and so on? Security clearances work like that, and that's how you vet someone.

nindalf 3y ago

Everything looks obvious in hindsight doesn’t it? Several of the organisations you’ve mentioned have funded projects to rewrite critical internet infrastructure in a memory safe language - HTTP client, HTTP reverse proxy, DNS resolver, NTP server, TLS library, AV1 decoder, a replacement for sudo, among other projects (https://memorysafety.org https://memorysafety.org). More can always be done, and it can always be done faster than it’s being done. Fwiw, it’s possible to use zstd instead of xz, which was created at and actively maintained at Facebook. So if you were expecting Big Tech to identify this class of problem and do something about it, it seems like they are. But if you expected them to eliminate every single possible instance of such an issue, that’s a bit much isn’t it?

DrBazza 3y ago
Would a 'memory safe' language really have stopped any of this? From what I've briefly read, this incident the whole attack process (PR, fake test data, social engineering) from start to finish by a state-actor (most likely), could have been in any language.
- lifthrasiir 3y ago
  You are right, but C/C++ was vulnerable to this particular MO because of its complicated build process.
  - uecker 3y ago
    I would say today there is no real need for autoconf anymore in C / C++ and the build process could be fairly easy.
  - kukkamario 3y ago
    There are million ways to hide exploits even in "safe" languages. If you have a bad actor that can spend couple years prepping how to hide an exploit, then it doesn't really matter which programming language is used. Build system is complex because of legacy and need to support millions of different platforms and distros.