3 ms·

I too have been trying to find out about the hack. There has been a lot of interesting analysis of the code, which has a feeling of the awe and sophistication

I too have been trying to find out about the hack. There has been a lot of interesting analysis of the code, which has a feeling of the awe and sophistication of stuxnet yet on the scale of “this could be the work of a single motivated coder … like one of us”. But what I haven’t found yet, and would like leads on, is what ther thinking is about the attack in a wider context… What is the current thinking on: 1. Was the malicious code inserted by the new contributor, or was this likely a compromised account? 2. If the new contributor did it, did they become an xz maintainer with the aim of acting maliciously? 3. If the new contributor was malicious, why take so long to attack and why do it in xz? Or are they also attacking lots of other systems, perhaps under other names? 4. And what can we do about these attacks? How can we build a system that isn’t ultimately brought crashing down by one or two bad actors? 5. Small technical detail I haven’t spotted in writeups: was the attack commands signed in some way so only the attacker can use it and the world can go hunting for a smoking gun cert that matches the attacker?

randmeerkat 3y ago
> If the new contributor did it, did they become an xz maintainer with the aim of acting maliciously? Is no one asking if there was a state actor behind the contributor? My question is what was the ultimate end goal, and who motivated this exploit?
- wood_spirit 3y ago
  I think it is just as plausible that a state actor casts about for an account of a committer they can trivially compromise who is on one of the thousands of tired projects that can slip this kind of attack in…
bgmeister 3y ago
> why take so long to attack First they need to gain some credibility. And they also need to obfuscate what they were trying to do. The payoff if they were to succeed is potentially enormous, so it makes sense to do things slowly. > and why do it in xz? xz is almost a perfect target- undermaintained, complicated code that isn't well understood by many people, deployed and used widely. > Or are they also attacking lots of other systems, perhaps under other names? The answer probably depends who the attacker(s) are, and what sort of funding or other motifivations they have. We can only guess. > 4. And what can we do about these attacks? This is a big unanswered question. I haven't seen any great suggestions yet. We were very lucky with this particular attack. > How can we build a system that isn’t ultimately brought crashing down by one or two bad actors? The complexity involved in this attack suggests that it was probably a group, IMO. > 5. Small technical detail I haven’t spotted in writeups: was the attack commands signed in some way so only the attacker can use it and the world can go hunting for a smoking gun cert that matches the attacker? Yes, sort of. Filippo's thread has a good description: https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b https://bsky.app/profile/filippo.abyssdomain.expert/post/3ko...

randmeerkat 3y ago

> If the new contributor did it, did they become an xz maintainer with the aim of acting maliciously? Is no one asking if there was a state actor behind the contributor? My question is what was the ultimate end goal, and who motivated this exploit?

wood_spirit 3y ago
I think it is just as plausible that a state actor casts about for an account of a committer they can trivially compromise who is on one of the thousands of tired projects that can slip this kind of attack in…

bgmeister 3y ago

> why take so long to attack First they need to gain some credibility. And they also need to obfuscate what they were trying to do. The payoff if they were to succeed is potentially enormous, so it makes sense to do things slowly. > and why do it in xz? xz is almost a perfect target- undermaintained, complicated code that isn't well understood by many people, deployed and used widely. > Or are they also attacking lots of other systems, perhaps under other names? The answer probably depends who the attacker(s) are, and what sort of funding or other motifivations they have. We can only guess. > 4. And what can we do about these attacks? This is a big unanswered question. I haven't seen any great suggestions yet. We were very lucky with this particular attack. > How can we build a system that isn’t ultimately brought crashing down by one or two bad actors? The complexity involved in this attack suggests that it was probably a group, IMO. > 5. Small technical detail I haven’t spotted in writeups: was the attack commands signed in some way so only the attacker can use it and the world can go hunting for a smoking gun cert that matches the attacker? Yes, sort of. Filippo's thread has a good description: https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b https://bsky.app/profile/filippo.abyssdomain.expert/post/3ko...