7 ms·

Why do they say "almost" infected the world? At least 3 quite popular Linux distributions (arch, gentoo, and opensuse tumbleweed) ended up shipping the backdoor

Why do they say "almost" infected the world? At least 3 quite popular Linux distributions (arch, gentoo, and opensuse tumbleweed) ended up shipping the backdoor _for weeks_ , and it was most definitely working in at least tumbleweed. For weeks! A backdoored ssh! Hardly "almost".

nequo 3y ago
My guess is that most Linux boxes that run sshd use an LTS distro, not one with rolling release. But I don’t know how to get any data on this.
christophilus 3y ago
The exploit didn’t actually run on those distros, though. Only on deb/rpm targets. So, effectively, it was stopped before it hit production.
- deleted 3y ago
  [deleted]
- cozzyd 3y ago
  Tumbleweed is rpm-based, though maybe not so used in production
Denvercoder9 3y ago
Arch, Gentoo and openSUSE Tumbleweed are hardly the world.
- samtheprogram 3y ago
  Arch and Gentoo were also not supported, although the code shipped, because the exploit explicitly checked for RPM- and deb-packaged distros. Suse is RPM based, but don’t remember whether the check was for the utilities or another method — Suse uses zypper for package management, as opposed to yum/dnf on the far more popular RedHat-based distros, so it depends how the exploit checked.
  - jwilk 3y ago
    The initial advisory (https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810) said it was: test "x$RPM_ARCH" = "xx86_64"
stefanka 3y ago
I heard that sshd in arc doesn’t link to xz
- withinboredom 3y ago
  the link to xz was in systemd that then loaded sshd with the exploit in the shared libraries.
  - growse 3y ago
    Only for distros that took a specific openssh patch (not merged in upstream openssh). Arch didn't afaik.
markus_zhang 3y ago
I hope Open Source maintainers and the big companies get the message -- they need to change the financial outlook of open source maintaining.
- thiht 3y ago
  How would it have changed anything in this specific case?
  - markus_zhang 3y ago
    This might solve the original author's issues, AND might also attract other people to do the job. The more people, the more eyes. It's definitely not a silver bullet, but I would be surprised that OSS maintainers are fine with the current financial arrangement, or lack of it.
    - slowmovintarget 3y ago
      Money itself doesn't necessarily cure mental health issues. I'm mean it usually doesn't hurt, but it's not like you can blend cash up into a smoothy and cure depression. (Yes, that's a South Park reference.)
      - account42 3y ago
        Lack of money on the other hand can both cause mental issues and make dealing with them harder if not impossible.
- bongodongobob 3y ago
  I think the message would more likely be "don't use open source and pay for closed source" than "give money to open source and cross your fingers that it does something".
  - markus_zhang 3y ago
    Either way, it gives more jobs and $$$ to software developers in general. I'm fine with both :) Just imagine how many more jobs will be created if every large company decides to roll their own stuffs. A lot are actually doing this, but not enough.
zouhair 3y ago
Also, what about those that are not yet discovered?
- onoyoudont 3y ago
  shh
acdha 3y ago
Arch and Gentoo are fairly popular as hobbyist distributions but they’re far less common in professional use, especially for the servers running SSH which this attack targeted. That doesn’t mean what happened is in any way okay but if this hadn’t been noticed long enough to make it into RHEL or Debian/Ubuntu stable you would be hearing about it in notifications from your bank, healthcare providers, etc. A pre-auth RCE would mean anyone who doesn’t have a tightly-restricted network and robust flow logging would struggle to say that they hadn’t been affected.
- red-iron-pine 3y ago
  aye, this. RHEL is the industry standard and if you're not using that because you want Enterprise Support than you're using a derivative like Fedora, CentOS, or Rocky. Or else you hang out in the .deb side and use Debian or Ubuntu. Arch is popular with a niche group of end users, but that ain't what most enterprise architectures are working on.
  - hda111 3y ago
    SLES is the only real alternative to RHEL for enterprises, also using RPM.
deleted 3y ago
[deleted]
joveian 3y ago
It doesn't seem to have been actually included in the Arch (binary) package but only because the backdoor build system itself didn't include the backdoor for Arch. If you cmp -l liblzma.so.5.6.1 between xz-5.6.1-1 and xz-5.6.1-2 there are only tiny differences. I'm guessing they didn't notice this before writing the advisory. https://github.com/QubesOS/qubes-issues/issues/9067#issuecomment-2028464631 https://github.com/QubesOS/qubes-issues/issues/9067#issuecom...
- auguzanellato 3y ago
  That’s because one of the first stages of the backdoor, that’s actually running at build time, checks if the distro is DEB or RPM based and aborts otherwise

nequo 3y ago

My guess is that most Linux boxes that run sshd use an LTS distro, not one with rolling release. But I don’t know how to get any data on this.

christophilus 3y ago

The exploit didn’t actually run on those distros, though. Only on deb/rpm targets. So, effectively, it was stopped before it hit production.

deleted 3y ago
[deleted]
cozzyd 3y ago
Tumbleweed is rpm-based, though maybe not so used in production

Denvercoder9 3y ago

Arch, Gentoo and openSUSE Tumbleweed are hardly the world.

samtheprogram 3y ago
Arch and Gentoo were also not supported, although the code shipped, because the exploit explicitly checked for RPM- and deb-packaged distros. Suse is RPM based, but don’t remember whether the check was for the utilities or another method — Suse uses zypper for package management, as opposed to yum/dnf on the far more popular RedHat-based distros, so it depends how the exploit checked.
- jwilk 3y ago
  The initial advisory (https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810) said it was: test "x$RPM_ARCH" = "xx86_64"

stefanka 3y ago

I heard that sshd in arc doesn’t link to xz

withinboredom 3y ago
the link to xz was in systemd that then loaded sshd with the exploit in the shared libraries.
- growse 3y ago
  Only for distros that took a specific openssh patch (not merged in upstream openssh). Arch didn't afaik.

markus_zhang 3y ago

I hope Open Source maintainers and the big companies get the message -- they need to change the financial outlook of open source maintaining.

thiht 3y ago
How would it have changed anything in this specific case?
- markus_zhang 3y ago
  This might solve the original author's issues, AND might also attract other people to do the job. The more people, the more eyes. It's definitely not a silver bullet, but I would be surprised that OSS maintainers are fine with the current financial arrangement, or lack of it.
  - slowmovintarget 3y ago
    Money itself doesn't necessarily cure mental health issues. I'm mean it usually doesn't hurt, but it's not like you can blend cash up into a smoothy and cure depression. (Yes, that's a South Park reference.)
    - account42 3y ago
      Lack of money on the other hand can both cause mental issues and make dealing with them harder if not impossible.
bongodongobob 3y ago
I think the message would more likely be "don't use open source and pay for closed source" than "give money to open source and cross your fingers that it does something".
- markus_zhang 3y ago
  Either way, it gives more jobs and $$$ to software developers in general. I'm fine with both :) Just imagine how many more jobs will be created if every large company decides to roll their own stuffs. A lot are actually doing this, but not enough.

zouhair 3y ago

Also, what about those that are not yet discovered?

onoyoudont 3y ago
shh

acdha 3y ago

Arch and Gentoo are fairly popular as hobbyist distributions but they’re far less common in professional use, especially for the servers running SSH which this attack targeted. That doesn’t mean what happened is in any way okay but if this hadn’t been noticed long enough to make it into RHEL or Debian/Ubuntu stable you would be hearing about it in notifications from your bank, healthcare providers, etc. A pre-auth RCE would mean anyone who doesn’t have a tightly-restricted network and robust flow logging would struggle to say that they hadn’t been affected.

red-iron-pine 3y ago
aye, this. RHEL is the industry standard and if you're not using that because you want Enterprise Support than you're using a derivative like Fedora, CentOS, or Rocky. Or else you hang out in the .deb side and use Debian or Ubuntu. Arch is popular with a niche group of end users, but that ain't what most enterprise architectures are working on.
- hda111 3y ago
  SLES is the only real alternative to RHEL for enterprises, also using RPM.

deleted 3y ago

[deleted]

joveian 3y ago

It doesn't seem to have been actually included in the Arch (binary) package but only because the backdoor build system itself didn't include the backdoor for Arch. If you cmp -l liblzma.so.5.6.1 between xz-5.6.1-1 and xz-5.6.1-2 there are only tiny differences. I'm guessing they didn't notice this before writing the advisory. https://github.com/QubesOS/qubes-issues/issues/9067#issuecomment-2028464631 https://github.com/QubesOS/qubes-issues/issues/9067#issuecom...

auguzanellato 3y ago
That’s because one of the first stages of the backdoor, that’s actually running at build time, checks if the distro is DEB or RPM based and aborts otherwise