5 ms·
XZ backdoor killswitch
There appears to be a string encoded in the binary payload:
https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01#file-hashes-txt-L115 https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01...
Which functions as a killswitch:
https://piaille.fr/@zeno/112185928685603910 https://piaille.fr/@zeno/112185928685603910
Thus, one workaround for affected systems might be to add this to `/etc/environment`:
```
echo "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" | sudo tee -a /etc/environment
```
+ restart ssh and systemd
- evmar 3y agoNice try, Jia Tan.
- deleted 3y ago[deleted]
- mmsc 3y agoSo DPRK, Russia, or China, right? The USA and any country affiliated with it can just seize servers.
- dralley 3y agoWell the more likely reason for that is that the exploit doesn't work if you have the LANG env var set. The US is the primary place where it wouldn't be set and hence where the malware would be active.
- mmsc 3y agoDoes sshd normally run with any LANG env set when it’s run as a daemon?
- politelemon 3y agoDoes that mean setting a Lang environment variable is a mitigation?
- workfromspace 3y agoMy understanding was the opposite. Two examples I found where backdoor is working are: env -i LANG=en_US.UTF-8 /usr/sbin/sshd -D env -i LANG=C /usr/sbin/sshd -h
- CSMastermind 3y agoCommits had a UTC +8 timestamp, so most likely China or possibly Russia unless Australia or Taiwan decided to do something really weird. Probably not DPRK.
- kardos 3y agoThe commit timestamps are not a reliable indicator of this actor's work day. It's trivial to work on a different schedule than local 9-5, or simply falsify the time stamps [1]. [1] https://github.com/jbranchaud/blog/blob/master/_posts/2013-06-06-Fun-with-GitHubs-Contribution-Graphs.md https://github.com/jbranchaud/blog/blob/master/_posts/2013-0...
- dakiol 3y agoPeople thinking like you still astonishes me. We are talking about someone who is able to build a backdoor like this, and be so careless of: - using a name that reveals their nationality? - commiting at a timezone that reveals where are they located? Please. We have no idea who's behind this. The only legitimate question is (as usual): who benefits from this? Answer: any government on earth (most likely: USA, China, Russia, etc.)
- star-glider 3y agoThis analysis strongly suggests an Eastern European locale masquerading (with occasional oversights) as Chinese: https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
- ibic 3y agoIf an attacker is so smart and patient to pull of a sneaky supply chain attack like this, I'd say he/she/they must have been quite carefully choosing the moniker and hide/obfuscate other potentially identity revealing information (afaik, there is no reliable identity information found at the moment). So by choosing a very typical Chinese name (Jia Tan), I believe this is intentially misleading/smearing. I can't believe a smart ass (potenially a state actor) would be so stupid to use his/her/their actual nationality or other information.
- anarazel 3y agoYou can also just set TERM or any of about a dozen other env vars.
- JellyYelly 3y agoI believe that is just to disable the inclusion of the payload, the given env variable will disable the payload when it is live.
- anarazel 3y agoIt prevents registration of the dl-audit hook, very early on. So no redirection of RSA_public_decrypt occurs.
- sgammon 3y agogood point; i don't want to be sensational, so i updated the headline
- dralley 3y agoIt should go without saying: don't rely on this. You probably don't have 100% certainty that the RCE hasn't already dropped a secondary payload.
- ChrisArchitect 3y agoTell HN: Also, more discussion in here: https://news.ycombinator.com/item?id=39877267 https://news.ycombinator.com/item?id=39877267
- cjbprime 3y agoBut do you need to also possess the trusted privkey? I wonder why the attacker would build an unauthenticated kill switch.
- benmmurphy 3y agoit's for convenience. if you are aware of the necessity of the kill switch then you can just replace the offending package.
- sgammon 3y agoIt does not appear you need the secret key to use the kill switch.