5 ms·

I thought performance was actually fine? It only dragged when using valgrind, hence the rhetoric that it took some really unlikely circumstances for it to be de

by heyoni 3y ago

I thought performance was actually fine? It only dragged when using valgrind, hence the rhetoric that it took some really unlikely circumstances for it to be detected that quickly.

jwilk 3y ago
No, it wasn't fine. From the advisory (https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810): > With the backdoored liblzma installed, logins via ssh become a lot slower.
- heyoni 3y ago
  Yea you're right. 500ms vs 10ms on an older server. Was thrown off by this statement and thought only the perf/valgrind/gdb attachments were what really brought it to surface. > Initially starting sshd outside of systemd did not show the slowdown, despite the backdoor briefly getting invoked. This appears to be part of some countermeasures to make analysis harder. Performance was much worse but not enough to actually nudge the author into digging into it until the random ssh logins started piling up: https://twitter.com/AndresFreundTec/status/1774190743776866374 https://twitter.com/AndresFreundTec/status/17741907437768663... https://nitter.poast.org/AndresFreundTec/status/1774190743776866374 https://nitter.poast.org/AndresFreundTec/status/177419074377...
- olejorgenb 3y ago
  2-3x slower 0m0.299s -> 0m0.807s [1] [1] https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4
- rstuart4133 3y ago
  It was noticed because of it's CPU usage. It seems most people think "that was lucky". It wasn't lucky, it was inevitable. It happened to be noticed by someone doing benchmarking, but there is another category of machines out there it would hit hard: low end VM's running an ssh server. I've had my low end VM's hit by exactly the same thing the postgres benchmarker saw, but on these box's it isn't just annoying. There are so many ssh logins happening the OOM killer comes out to play but these ssh logins are tiny so it tends to kill the real stuff you've got the box doing, like web serving. A 2 or 3 fold increase in CPU would suddenly bring a lot of VM to their knees. At least thousands of them. It would be noticed.

by heyoni 3y ago

I thought performance was actually fine? It only dragged when using valgrind, hence the rhetoric that it took some really unlikely circumstances for it to be detected that quickly.

jwilk 3y ago

No, it wasn't fine. From the advisory (https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810): > With the backdoored liblzma installed, logins via ssh become a lot slower.

heyoni 3y ago
Yea you're right. 500ms vs 10ms on an older server. Was thrown off by this statement and thought only the perf/valgrind/gdb attachments were what really brought it to surface. > Initially starting sshd outside of systemd did not show the slowdown, despite the backdoor briefly getting invoked. This appears to be part of some countermeasures to make analysis harder. Performance was much worse but not enough to actually nudge the author into digging into it until the random ssh logins started piling up: https://twitter.com/AndresFreundTec/status/1774190743776866374 https://twitter.com/AndresFreundTec/status/17741907437768663... https://nitter.poast.org/AndresFreundTec/status/1774190743776866374 https://nitter.poast.org/AndresFreundTec/status/177419074377...
olejorgenb 3y ago
2-3x slower 0m0.299s -> 0m0.807s [1] [1] https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4
rstuart4133 3y ago
It was noticed because of it's CPU usage. It seems most people think "that was lucky". It wasn't lucky, it was inevitable. It happened to be noticed by someone doing benchmarking, but there is another category of machines out there it would hit hard: low end VM's running an ssh server. I've had my low end VM's hit by exactly the same thing the postgres benchmarker saw, but on these box's it isn't just annoying. There are so many ssh logins happening the OOM killer comes out to play but these ssh logins are tiny so it tends to kill the real stuff you've got the box doing, like web serving. A 2 or 3 fold increase in CPU would suddenly bring a lot of VM to their knees. At least thousands of them. It would be noticed.