5 ms·

A podcast about the xz backdoor with the guy who found it

134 points by throwaway4good 3y ago

Solvency 3y ago
Why can't they interview the guy who made it? Some say he's still posting on that board.
- buro9 3y ago
  who says that person exists? could well be a persona created for this purpose, with a team behind the persona
  - tester457 3y ago
    I want the team to talk more, maybe something will slip out.
    - humansareok1 3y ago
      Why would they, imo signs point to a nation state or at minimum a very sophisticated APT so it seems incredibly unlikely they're going to make a mistake like that.
      - cryptonector 3y ago
        If a nation-state then revealing themselves could cause a serious diplomatic incident. If not a nation-state then revealing themselves could expose them to criminal prosecution. The perpetrators almost certainly have been busy erasing their tracks and going underground. If they're not caught in spite of their best efforts, we'll never hear from them again.
        Solvency 3y ago
        where is there any law that says you can't put any code you want into open source that is completely visible, auditable , and reviewable by everyone who uses it? not challenging you. Genuinely curious.
        humansareok1 3y ago
        Does this not fall under the US CFAA Laws? I.e. intentionally adding malicious code?
        cryptonector 3y ago
        The CFAA is quite broad. I wouldn't be surprised if it's broad enough to allow for prosecution in this case. If you interpret the CFAA as narrowly as possible then you might only be able to prosecute when the backdoor is exercised, but at the very least that you could. And then there's the world outside the U.S., where the laws might be broader.
        ptx 3y ago
        Why would it matter that the thing being sabotaged is "completely visible, auditable , and reviewable"? Do you have any specific laws in mind that you think would not apply? If you were referring to the malicious code being contributed, not to the open source project as a whole, I don't think "completely visible" is an accurate description of the deliberately obfuscated chain of m4 gobbledygook and binary blobs that makes up the backdoor.
- tonypace 3y ago
  That board? What board?
- speedylight 3y ago
  We should lure him/her with a bait, like the winrar source code or something… give him hope for redemption.
bspammer 3y ago
It must be a strange feeling to know that you likely impacted future geopolitics by finding a single "bug".
kaliszad 3y ago
Andres Freund will also be on the Oxide and Friends podcast with @bcantrill and @ahl on April 9th at 5pm PT. https://oxide.computer/podcasts/oxide-and-friends https://oxide.computer/podcasts/oxide-and-friends
K0nserv 3y ago
Risky Business is a fantastic podcast in general, well worth listening to weekly if you are interested in infosec.
Icathian 3y ago
Risky Biz (and really anything Patrick Gray touches) is awesome. Would recommend. It just slays me that Andres Freund, absolute bastion of database goodness, is now just "the guy who found the xz bug". Funny old world.
- deleted 3y ago
  [deleted]
- monetus 3y ago
  He was called the "friend that saved the world" in two different vids I watched yesterday; kinda neat.
- rt4mn 3y ago
  > Risky Biz (and really anything Patrick Gray touches) is awesome. Would recommend. Patrick Gray is a good interviewer and news source but he is also a big booster of the American surveillance apparatus, and has spoken against such reasonable reforms as requiring the the FBI get a bloody warrant when it searches for Americans data in the 702 database (data that is collected specifically for foreign intel purposes and thus subject to less constitutional scrutiny). He recently defended the NSA's acquisition of netflow data because the NSA needs it to do its work. as if constitutional privacy rights should give way to a spy agencies priorities. He is just way to trusting of these agencies abilities to police themselves. I swear his quote when they talked about nsa getting netflow data was something along the lines of "if people only knew how many meetings they had to have before they would understand". Those are both examples I am pulling from memory so don't take them as gospel. And of course, no source of news / commentary is unbiased. I listen to and enjoy the risky buiz podcast. And institutional trust is a legitimate aspect of security, especially in infosec. I just wish he was more skeptical of western law enforcement and intelligence agencies (he is already more then skeptical of non-western law enforcement and intelligence agencies, which is fine, I just wish he did not give the five eyes countries a pass because we are "the good guys"). He recently interviewed people at NSA headquarters for petes sake.
  - throwaway4good 3y ago
weinzierl 3y ago
Andreas Freund's part is from 5:08 to 16:20 minutes.
m3kw9 3y ago
Imagine the scene at the hackers office once this was exposed
- jethro_tell 3y ago
  Some group of coders pissed off because the were rushed into shipping and a middle manager or two that were trying to make an arbitrary deadline blaming it on incompetent devs.
  - planede 3y ago
    From https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline : 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. Kevin Beaumont speculates that knowing this was on the way may have accelerated the attacker’s schedule. @teknoraver commented on HN that the liblzma PR was one in a series of dependency slimming changes for libsystemd; there were two mentions of it in late January. I think that this is a plausible explanation for a rushed schedule and an actually justified deadline.
    - eichin 3y ago
      (From the "history may not repeat itself but it sure does rhyme" files: Berkeley releasing a new ftpd with fixes for a bunch of buffer overruns (in Fall of 1988, when this was a New Thing) was widely suspected to be a reason the Morris Worm launched when it did, because some of the holes it used might have gotten closed too. I'm not sure if this ever got confirmed but it was part of the earliest responsible disclosure narratives...)
  - Twirrim 3y ago
    We're within weeks of cut-off for Ubuntu's next LTS, Red Hat 10, etc. Fail to deliver their code upstream in the next few weeks and they'd be out of luck for getting it in to an enterprise distribution for the next 3-4ish years. There's nothing arbitrary about the deadlines, the clock was absolutely ticking.
fredland 3y ago
imagine the other bugs out there just like this that haven’t been found
- lukan 3y ago
  That was not a bug, but a intentional hidden backdoor. But yeah, likely there are many undiscovered critical bugs waiting to be found and maybe also more intentional backdoors.
jordigh 3y ago
He has written about it before, but listening to the podcast, the most interesting part for me that led to the Freund's discovery is that the hotspot had no debugging symbols attached to it. In free software, trying to hide something actually makes it stick out more. I wonder if a subsequent, more sophisticated attack could add some bogus debugging symbols to better hide its track.
77pt77 3y ago
It's an episode of a podcast.
deleted 3y ago
[deleted]
BasilPH 3y ago
I made a transcript: https://www.withfanfare.com/p/hacker-news-collection/risky-business-743-a-chat-about-the-xz-backdoor-with-the-guy-who-found-it https://www.withfanfare.com/p/hacker-news-collection/risky-b... Andres Freund starts speaking at 5:09. I'm not affiliated with the podcast. I only did a very cursory review of the S2T results, so expect mistakes.
- bdzr 3y ago
  I used Kagi to summarize the transcript: - A serious SSH backdoor was discovered in the xz Linux compression library, allowing attackers to compromise SSH servers. - The backdoor was discovered by Andres Freund, a Postgres developer, who noticed suspicious CPU usage and login attempts on his systems. - The xz backdoor allowed attackers to bypass authentication and gain root access on compromised systems. - Microsoft faced significant criticism from the CSRB (Cybersecurity Review Board) for a cascade of errors related to a China-based hack. - Ukraine was able to leverage an old WinRAR vulnerability to hack into Russian systems as part of the ongoing conflict. - There have been recent "MFA bombing" attacks targeting Apple users, combining push notifications and social engineering. - A ransomware gang leaked stolen Scottish healthcare patient data as part of an extortion attempt. - Renowned security expert and author Ross Anderson passed away. - The episode features a discussion with Andres Freund about his discovery of the xz backdoor. - The podcast sponsor, Island, discusses how enterprises are moving away from VDI (Virtual Desktop Infrastructure) towards security-focused enterprise browsers.
  - williamstein 3y ago
    Also, "And so, look, long story short, the country that we think is most likely behind this is Russia."

Solvency 3y ago

Why can't they interview the guy who made it? Some say he's still posting on that board.

buro9 3y ago
who says that person exists? could well be a persona created for this purpose, with a team behind the persona
- tester457 3y ago
  I want the team to talk more, maybe something will slip out.
  - humansareok1 3y ago
    Why would they, imo signs point to a nation state or at minimum a very sophisticated APT so it seems incredibly unlikely they're going to make a mistake like that.
    - cryptonector 3y ago
      If a nation-state then revealing themselves could cause a serious diplomatic incident. If not a nation-state then revealing themselves could expose them to criminal prosecution. The perpetrators almost certainly have been busy erasing their tracks and going underground. If they're not caught in spite of their best efforts, we'll never hear from them again.
      - Solvency 3y ago
        where is there any law that says you can't put any code you want into open source that is completely visible, auditable , and reviewable by everyone who uses it? not challenging you. Genuinely curious.
        humansareok1 3y ago
        Does this not fall under the US CFAA Laws? I.e. intentionally adding malicious code?
        cryptonector 3y ago
        The CFAA is quite broad. I wouldn't be surprised if it's broad enough to allow for prosecution in this case. If you interpret the CFAA as narrowly as possible then you might only be able to prosecute when the backdoor is exercised, but at the very least that you could. And then there's the world outside the U.S., where the laws might be broader.
        ptx 3y ago
        Why would it matter that the thing being sabotaged is "completely visible, auditable , and reviewable"? Do you have any specific laws in mind that you think would not apply? If you were referring to the malicious code being contributed, not to the open source project as a whole, I don't think "completely visible" is an accurate description of the deliberately obfuscated chain of m4 gobbledygook and binary blobs that makes up the backdoor.
tonypace 3y ago
That board? What board?
speedylight 3y ago
We should lure him/her with a bait, like the winrar source code or something… give him hope for redemption.

bspammer 3y ago

It must be a strange feeling to know that you likely impacted future geopolitics by finding a single "bug".

kaliszad 3y ago

Andres Freund will also be on the Oxide and Friends podcast with @bcantrill and @ahl on April 9th at 5pm PT. https://oxide.computer/podcasts/oxide-and-friends https://oxide.computer/podcasts/oxide-and-friends

K0nserv 3y ago

Risky Business is a fantastic podcast in general, well worth listening to weekly if you are interested in infosec.

Icathian 3y ago

Risky Biz (and really anything Patrick Gray touches) is awesome. Would recommend. It just slays me that Andres Freund, absolute bastion of database goodness, is now just "the guy who found the xz bug". Funny old world.

deleted 3y ago
[deleted]
monetus 3y ago
He was called the "friend that saved the world" in two different vids I watched yesterday; kinda neat.
rt4mn 3y ago
> Risky Biz (and really anything Patrick Gray touches) is awesome. Would recommend. Patrick Gray is a good interviewer and news source but he is also a big booster of the American surveillance apparatus, and has spoken against such reasonable reforms as requiring the the FBI get a bloody warrant when it searches for Americans data in the 702 database (data that is collected specifically for foreign intel purposes and thus subject to less constitutional scrutiny). He recently defended the NSA's acquisition of netflow data because the NSA needs it to do its work. as if constitutional privacy rights should give way to a spy agencies priorities. He is just way to trusting of these agencies abilities to police themselves. I swear his quote when they talked about nsa getting netflow data was something along the lines of "if people only knew how many meetings they had to have before they would understand". Those are both examples I am pulling from memory so don't take them as gospel. And of course, no source of news / commentary is unbiased. I listen to and enjoy the risky buiz podcast. And institutional trust is a legitimate aspect of security, especially in infosec. I just wish he was more skeptical of western law enforcement and intelligence agencies (he is already more then skeptical of non-western law enforcement and intelligence agencies, which is fine, I just wish he did not give the five eyes countries a pass because we are "the good guys"). He recently interviewed people at NSA headquarters for petes sake.
- throwaway4good 3y ago

weinzierl 3y ago

Andreas Freund's part is from 5:08 to 16:20 minutes.

m3kw9 3y ago

Imagine the scene at the hackers office once this was exposed

jethro_tell 3y ago
Some group of coders pissed off because the were rushed into shipping and a middle manager or two that were trying to make an arbitrary deadline blaming it on incompetent devs.
- planede 3y ago
  From https://research.swtch.com/xz-timeline https://research.swtch.com/xz-timeline : 2024-02-29: On GitHub, @teknoraver sends pull request to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. Kevin Beaumont speculates that knowing this was on the way may have accelerated the attacker’s schedule. @teknoraver commented on HN that the liblzma PR was one in a series of dependency slimming changes for libsystemd; there were two mentions of it in late January. I think that this is a plausible explanation for a rushed schedule and an actually justified deadline.
  - eichin 3y ago
    (From the "history may not repeat itself but it sure does rhyme" files: Berkeley releasing a new ftpd with fixes for a bunch of buffer overruns (in Fall of 1988, when this was a New Thing) was widely suspected to be a reason the Morris Worm launched when it did, because some of the holes it used might have gotten closed too. I'm not sure if this ever got confirmed but it was part of the earliest responsible disclosure narratives...)
- Twirrim 3y ago
  We're within weeks of cut-off for Ubuntu's next LTS, Red Hat 10, etc. Fail to deliver their code upstream in the next few weeks and they'd be out of luck for getting it in to an enterprise distribution for the next 3-4ish years. There's nothing arbitrary about the deadlines, the clock was absolutely ticking.

fredland 3y ago

imagine the other bugs out there just like this that haven’t been found

lukan 3y ago
That was not a bug, but a intentional hidden backdoor. But yeah, likely there are many undiscovered critical bugs waiting to be found and maybe also more intentional backdoors.

jordigh 3y ago

He has written about it before, but listening to the podcast, the most interesting part for me that led to the Freund's discovery is that the hotspot had no debugging symbols attached to it. In free software, trying to hide something actually makes it stick out more. I wonder if a subsequent, more sophisticated attack could add some bogus debugging symbols to better hide its track.

77pt77 3y ago

It's an episode of a podcast.

deleted 3y ago

[deleted]

BasilPH 3y ago

I made a transcript: https://www.withfanfare.com/p/hacker-news-collection/risky-business-743-a-chat-about-the-xz-backdoor-with-the-guy-who-found-it https://www.withfanfare.com/p/hacker-news-collection/risky-b... Andres Freund starts speaking at 5:09. I'm not affiliated with the podcast. I only did a very cursory review of the S2T results, so expect mistakes.

bdzr 3y ago
I used Kagi to summarize the transcript: - A serious SSH backdoor was discovered in the xz Linux compression library, allowing attackers to compromise SSH servers. - The backdoor was discovered by Andres Freund, a Postgres developer, who noticed suspicious CPU usage and login attempts on his systems. - The xz backdoor allowed attackers to bypass authentication and gain root access on compromised systems. - Microsoft faced significant criticism from the CSRB (Cybersecurity Review Board) for a cascade of errors related to a China-based hack. - Ukraine was able to leverage an old WinRAR vulnerability to hack into Russian systems as part of the ongoing conflict. - There have been recent "MFA bombing" attacks targeting Apple users, combining push notifications and social engineering. - A ransomware gang leaked stolen Scottish healthcare patient data as part of an extortion attempt. - Renowned security expert and author Ross Anderson passed away. - The episode features a discussion with Andres Freund about his discovery of the xz backdoor. - The podcast sponsor, Island, discusses how enterprises are moving away from VDI (Virtual Desktop Infrastructure) towards security-focused enterprise browsers.
- williamstein 3y ago
  Also, "And so, look, long story short, the country that we think is most likely behind this is Russia."