6 ms·

If that's true, then I am 100% certain that this backdoor is from a nation state-level actor.

junon 3y ago
That's what this feels like. That, or someone who wanted to sell this to one. Can't imagine the ABC's are sleeping on this one at this point.
jeroenhd 3y ago
I already felt like this was way too sophisticated for a random cybercriminal. It's not like making up fake internet identities is very difficult, but someone has pretended to be a good-faith contributor for ages, in a surprisingly long-term operation. You need some funding and a good reason to pull off something like that. This could also be a ransomware group hoping to break into huge numbers of servers, though. Ransomware groups have been getting more sophisticated and they will already infiltrate their targets for months at a time (to make sure all old backups are useless when they strike), so I wouldn't put it past them to infiltrate the server authentication mechanism directly.
- TheBlight 3y ago
  Whoever this was is going after a government or a crypto exchange. Don't think anything else merits this effort.
  - delfinom 3y ago
    Otoh, maybe they just wanted to create a cryptomining farm. Lol. Don't underestimate the drive some people have to make a buck.
    - 1oooqooq 3y ago
      people downvoting you already forgot the cia fundraiser in the 80s...
  - dralley 3y ago
    I don't know that they had a singular target necessarily. Much like Solarwinds, they could take their pick of thousands of targets if this had gone undetected.
    - TheBlight 3y ago
      I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice. I think the attacker had a target in mind. They were clearly focused on specific Linux distros. I'd imagine they were after a specific set of sshd bastion machine(s). Maybe they have the ability to get on the VPN that has access to the bastion(s) but the subset of users with actual bastion access is perhaps much smaller and more alert/less vulnerable to phishing. So what's going to be the most valuable thing to hack that uses Linux sshd bastions? Something so valuable it's worth dedicating ~3 years of your life to it? My best guess is a crypto exchange.
      - baq 3y ago
        > But why would a government want to own tons of random Linux machines that have open sshd mappings? They don’t want tons. They want the few important ones. Turns out it was easiest to get to the important ones by pwning tons of random ones.
        TheBlight 3y ago
        That still implies there was a target in mind. But also they would've had to assume the access would be relatively short-lived. This means to me they had something specific they wanted to get access to, didn't plan to be there long, and weren't terribly concerned about leaving a trail of their methods.
        pessimizer 3y ago
- neffy 3y ago
  Those guys are estimated to have made $1 billion last year - have to think that buys some developer talent.
- BoardsOfCanada 3y ago
  I would expect a nation state to have better sock puppet accounts though.
  - nemothekid 3y ago
    >better sock puppet accounts though. Seems like to me they had perfectly good enough sock puppet accounts. It wasn't at all obvious they were sock puppets until someone detected the expliot.
fuzunoglu 3y ago
What is the possibility of identity theft that is commenced on state-level? There are reports that the time the backdoor was pushed do not match the usual timing of changes committed by the author. It also seems like a convenient ground for a false flag operation: hijacking an account that belong to a trustworthy developer from another country.
- Aloisius 3y ago
  And risk discovery by the trustworthy developer? Unlikely.
  - fuzunoglu 3y ago
    What if the developer passed away? It is also easy to blame the developer with mental issues otherwise.
ignoramous 3y ago
I imagine such actors are embed within major consumer tech teams, too: Twitter, TikTok, Chrome, Snap, WhatsApp, Instagram... covers ~70% of all humanity.
- therein 3y ago
  This could be something that agent that infiltrated into companies could use to execute stuff on internal hosts that they have SSH connectivity to but no access. You could get into bastion hosts and then to PROD and leave no log traces.
deleted 3y ago
[deleted]

That's what this feels like. That, or someone who wanted to sell this to one. Can't imagine the ABC's are sleeping on this one at this point.

jeroenhd 3y ago

I already felt like this was way too sophisticated for a random cybercriminal. It's not like making up fake internet identities is very difficult, but someone has pretended to be a good-faith contributor for ages, in a surprisingly long-term operation. You need some funding and a good reason to pull off something like that. This could also be a ransomware group hoping to break into huge numbers of servers, though. Ransomware groups have been getting more sophisticated and they will already infiltrate their targets for months at a time (to make sure all old backups are useless when they strike), so I wouldn't put it past them to infiltrate the server authentication mechanism directly.

TheBlight 3y ago
Whoever this was is going after a government or a crypto exchange. Don't think anything else merits this effort.
- delfinom 3y ago
  Otoh, maybe they just wanted to create a cryptomining farm. Lol. Don't underestimate the drive some people have to make a buck.
  - 1oooqooq 3y ago
    people downvoting you already forgot the cia fundraiser in the 80s...
- dralley 3y ago
  I don't know that they had a singular target necessarily. Much like Solarwinds, they could take their pick of thousands of targets if this had gone undetected.
  - TheBlight 3y ago
    I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice. I think the attacker had a target in mind. They were clearly focused on specific Linux distros. I'd imagine they were after a specific set of sshd bastion machine(s). Maybe they have the ability to get on the VPN that has access to the bastion(s) but the subset of users with actual bastion access is perhaps much smaller and more alert/less vulnerable to phishing. So what's going to be the most valuable thing to hack that uses Linux sshd bastions? Something so valuable it's worth dedicating ~3 years of your life to it? My best guess is a crypto exchange.
    - baq 3y ago
      > But why would a government want to own tons of random Linux machines that have open sshd mappings? They don’t want tons. They want the few important ones. Turns out it was easiest to get to the important ones by pwning tons of random ones.
      - TheBlight 3y ago
        That still implies there was a target in mind. But also they would've had to assume the access would be relatively short-lived. This means to me they had something specific they wanted to get access to, didn't plan to be there long, and weren't terribly concerned about leaving a trail of their methods.
        pessimizer 3y ago
neffy 3y ago
Those guys are estimated to have made $1 billion last year - have to think that buys some developer talent.
BoardsOfCanada 3y ago
I would expect a nation state to have better sock puppet accounts though.
- nemothekid 3y ago
  >better sock puppet accounts though. Seems like to me they had perfectly good enough sock puppet accounts. It wasn't at all obvious they were sock puppets until someone detected the expliot.

fuzunoglu 3y ago

What is the possibility of identity theft that is commenced on state-level? There are reports that the time the backdoor was pushed do not match the usual timing of changes committed by the author. It also seems like a convenient ground for a false flag operation: hijacking an account that belong to a trustworthy developer from another country.

Aloisius 3y ago
And risk discovery by the trustworthy developer? Unlikely.
- fuzunoglu 3y ago
  What if the developer passed away? It is also easy to blame the developer with mental issues otherwise.

ignoramous 3y ago

I imagine such actors are embed within major consumer tech teams, too: Twitter, TikTok, Chrome, Snap, WhatsApp, Instagram... covers ~70% of all humanity.

therein 3y ago
This could be something that agent that infiltrated into companies could use to execute stuff on internal hosts that they have SSH connectivity to but no access. You could get into bastion hosts and then to PROD and leave no log traces.

deleted 3y ago

[deleted]