5 ms·

I haven't seen Thomas Roccia's infographic mentioned here yet: https://twitter.com/fr0gger_/status/1774342248437813525 https://twitter.com/fr0gger_/status/17743

by mzs 3y ago

I haven't seen Thomas Roccia's infographic mentioned here yet: https://twitter.com/fr0gger_/status/1774342248437813525 https://twitter.com/fr0gger_/status/1774342248437813525

xomodo 3y ago
Thx. Timeline shows attack begun by adding ignore entry in .gitignore file. That is hard to detect nowadays.
moopitydoop 3y ago
This just gives a partial high-level look at how the exploit gets planted in liblzma, it doesn't cover how the exploit works or its contents at all.
hakdbha 3y ago
[dead]
ihsoy 3y ago
That seems to be largely grasped at straws and connecting dots without reason. For example oss-fuzz was building xz by cloning the github repo directly. There was never a chance for oss-fuzz to discover the backdoor, because only the tarball had it, not the repo itself. So that oss-fuzz PR might genuinely just be a genuine thing unrelated to the backdoor.
- sp332 3y ago
  The ifunc part looked more legitimate, it was used to switch between optimized implementations of CRC. So that part was in the git repo. https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667
_trampeltier 3y ago
Jia Tan asked distros to update quickly just before it became public. How possible is it, there is another account / person who learned earlyer from people around Andreas Freund, the backdoor would become public. How possible is it, there is still another insider around?
- OneLeggedCat 3y ago
  Right. Way too much coincidence. Jia Tan found out that it was about to become public and threw a Hail Mary. How did he find out?
  - freedomben 3y ago
    If the stakes weren't so high, this would be a damn fun game of murder mystery.
  - rsc 3y ago
    I think the RedHat Valgrind report on 2024-03-04 made the Jia Tan team panic, since the one public rwmj stack trace pointed the finger directly at the backdoor. All it would take is someone looking closely at that failure to expose the whole operation. They fixed it on 2024-03-09, but then two weeks later distros still had not updated to the new version, and every day is another day that someone might hit the Valgrind failure and dig. I think that's why the sockpuppets came back on 2024-03-25 begging Debian to update. And then on the Debian thread there was pushback because they weren't the maintainer (except probably they were), so once Debian was updated, Jia Tan had to be the account that asked Ubuntu to update.
    - peteradio 3y ago
      That seems like a breach that they went forward with the update based on some random persons request. Oh you're getting pushy? I guess we better listen to this guy.
      - rsc 3y ago
        The update was pulling from trusted upstream archives. I'm sure Debian verified that.
- ptx 3y ago
  There were also changes to systemd happening around that time which would have prevented the backdoor from working. See the timeline article by the same author linked in this one.

by mzs 3y ago

I haven't seen Thomas Roccia's infographic mentioned here yet: https://twitter.com/fr0gger_/status/1774342248437813525 https://twitter.com/fr0gger_/status/1774342248437813525

xomodo 3y ago

Thx. Timeline shows attack begun by adding ignore entry in .gitignore file. That is hard to detect nowadays.

moopitydoop 3y ago

This just gives a partial high-level look at how the exploit gets planted in liblzma, it doesn't cover how the exploit works or its contents at all.

hakdbha 3y ago

[dead]

ihsoy 3y ago

That seems to be largely grasped at straws and connecting dots without reason. For example oss-fuzz was building xz by cloning the github repo directly. There was never a chance for oss-fuzz to discover the backdoor, because only the tarball had it, not the repo itself. So that oss-fuzz PR might genuinely just be a genuine thing unrelated to the backdoor.

sp332 3y ago
The ifunc part looked more legitimate, it was used to switch between optimized implementations of CRC. So that part was in the git repo. https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667

_trampeltier 3y ago

Jia Tan asked distros to update quickly just before it became public. How possible is it, there is another account / person who learned earlyer from people around Andreas Freund, the backdoor would become public. How possible is it, there is still another insider around?

OneLeggedCat 3y ago
Right. Way too much coincidence. Jia Tan found out that it was about to become public and threw a Hail Mary. How did he find out?
- freedomben 3y ago
  If the stakes weren't so high, this would be a damn fun game of murder mystery.
- rsc 3y ago
  I think the RedHat Valgrind report on 2024-03-04 made the Jia Tan team panic, since the one public rwmj stack trace pointed the finger directly at the backdoor. All it would take is someone looking closely at that failure to expose the whole operation. They fixed it on 2024-03-09, but then two weeks later distros still had not updated to the new version, and every day is another day that someone might hit the Valgrind failure and dig. I think that's why the sockpuppets came back on 2024-03-25 begging Debian to update. And then on the Debian thread there was pushback because they weren't the maintainer (except probably they were), so once Debian was updated, Jia Tan had to be the account that asked Ubuntu to update.
  - peteradio 3y ago
    That seems like a breach that they went forward with the update based on some random persons request. Oh you're getting pushy? I guess we better listen to this guy.
    - rsc 3y ago
      The update was pulling from trusted upstream archives. I'm sure Debian verified that.
ptx 3y ago
There were also changes to systemd happening around that time which would have prevented the backdoor from working. See the timeline article by the same author linked in this one.