5 ms·

ELI5 why the “xz drama” couldn’t happen on openBSD? do they not use open source packages? are they assuming they would have caught it before adding the infected

ELI5 why the “xz drama” couldn’t happen on openBSD? do they not use open source packages? are they assuming they would have caught it before adding the infected version to their repos?

ddavis 3y ago
The back door relied on a couple of Linux package management systems (if I’m recalling correctly, it had .deb and .rpm checks, see https://marc.info/?l=openbsd-misc&m=171227941117852&w=2 https://marc.info/?l=openbsd-misc&m=171227941117852&w=2)
- rrix2 3y ago
  was it mostly about the targets the xz actor was interested in than some security property inherent to openbsd that would prevent that sort of dynamic linking vulnerability?
  - calgarymicro 3y ago
    Debian and RedHat link liblzma into SSH for systemd which OpenBSD doesn't use. So in the sense of there being a larger attack surface with those distros I guess you can consider it more secure, but it's not just OpenBSD though; there are plenty of Linux distros that don't do this either.
shrubble 3y ago
If you run the 'ldd' tool against OpenBSD's ssh, you get 4 libraries. If you do the same on different Linux distros you get many more; this means the surface area is much larger.
t-3 3y ago
OpenSSH and the OpenBSD init system are part of the base system, maintained by OpenBSD developers. There's no opportunity for an outsider to use dependencies to insert backdoors in critical components.
- johnny22 3y ago
  It didn't matter where the init system came from, but where xz came from.
  - lsaljdljsljljsa 3y ago
    it does. If the init system links xz... and systemd does.
  - toast0 3y ago
    My understanding is that nothing in base has a dependency on anything outside. There may be some third party software in contrib (if OpenBSD has contrib, like FreeBSD), but I don't think the 3rd party software's build system would be used. Some BSDs use an external compiler on some platforms, and in that case, you have a build dependency on that, and trusting trust may apply.
    - sillywalk 3y ago
      > that nothing in base has a dependency on anything outside. From [0] "The system includes the following major components from outside suppliers: Xenocara (based on X.Org 7.7 with xserver 21.1.11 + patches, freetype 2.13.0, fontconfig 2.14.2, Mesa 23.1.9, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.3 and more) LLVM/Clang 16.0.6 (+ patches) GCC 4.2.1 (+ patches) and 3.3.6 (+ patches) Perl 5.36.3 (+ patches) NSD 4.8.0 Unbound 1.18.0 Ncurses 6.4 Binutils 2.17 (+ patches) Gdb 6.3 (+ patches) Awk January 22, 2024 Expat 2.6.0 zlib 1.3.1 (+ patches) [0] https://www.openbsd.org/75.html https://www.openbsd.org/75.html
    - johnny22 3y ago
      What openbsd includes in the base system is the real star vs the way linux distros get made.
  - akira2501 3y ago
    The critical piece was systemd, was it not? ssh is no dependent on xz, it only gets there through the "systemd notification" hook provided by vendor specific patches.
jcranmer 3y ago
It depends on what is meant by "xz drama". If you consider it to refer to the supply chain attack, well, OpenBSD is too minor a platform for anyone to consider it worthwhile trying to invest in the long supply chain attack for the OS. If you view it as the break-xz-to-attack-sshd, OpenBSD is designed as a single system with a single codebase, and has a general aversion to features such that it is difficult for an undersecured random library to become a vehicle to breaking a major, important component. If you view it as the techniques used to publish an exploit in open source code, well, OpenBSD is filled with the kind of developers whose self-confidence is such that they believe that they are uniquely capable of writing code without those kinds of issues and will denigrate the use of newer technologies that mitigate that risk with the attitude that it coddles programmers and coddled programmers aren't good programmers. Or, in shorter terms, OpenBSD is actually one of the projects I'd expect to have a relatively high chance of a clever contributor being able to smuggle in an exploit in plain sight.
- QuantumG 3y ago
  Which newer techniques? Honest question.
  - nequo 3y ago
    Not parent but jails and capabilities that are user controlled and not hardcoded into the binary would be nice to see.
    - QuantumG 3y ago
      Do you think they understand the benefits? I think you'd have a lot better chance at enacting change than my emotional rambling has, and if not, lesson learned.
    - nanolith 3y ago
      They tried this. The predecessor for pledge / unveil was systrace, which included a user-controlled policy file. One significant reason that pledge was implemented was because it is possible to disable or mis-configure user-controlled policies. Theo mentions this in his presentation that unveiled pledge, and he's basically referring to things like seccomp and systrace: https://www.openbsd.org/papers/hackfest2015-pledge/mgp00005.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00005.... More explicitly mentioning seLinux / seccomp: https://www.openbsd.org/papers/hackfest2015-pledge/mgp00008.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00008.... https://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.... More explicitly mentioning systrace: https://www.openbsd.org/papers/hackfest2015-pledge/mgp00009.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00009.... Certainly, it's possible to debate the relative merits of this approach, but this is why OpenBSD has moved away from user controlled policies.
dfedbeef 3y ago
People used to say backdoors and security bugs were less likely on Linux because 'open source'. Sociological theories of computer security are magical thinking.
- dfedbeef 3y ago
  (By 'people', I mean me and also the person who introduced me to Linux.)
- kibwen 3y ago
  The "all bugs are shallow" schtick is not about bugs being less likely, only that bugs are more likely to be brought to light. Which is still true: the xz backdoor never would have been found in a closed-source codebase.
1vuio0pswjnm7 3y ago
"ELI5 why the "xz drama" couldn't happen on [O]penBSD." It could happen but it did not happen. Linux distributions that use glibc and systemd are popular. Linux has millions of dollars behind it, and many corporations contributing their time and money, some building businesses around Linux. AFAIK, OpenBSD does not have similar resources. It's volunteer-supported. Berkeley Software Distributions use their own libc, such as OpenBSD, and their own init system (not systemd) and are relatively unpopular. The liblzma exploit that was discovered targeted Linux distributions that use glibc and systemd. Specifically, it relied on a feature of glibc called ifunc. If an exploit targeted OpenBSD, then there would probably be less "drama". Unpopularity probably plays a role in avoiding "drama". Also consider the use of features such as ifunc and systemd. In some cases Linux may use features that BSD projects do not have. The liblzma exploit author chose to target Linux-specific features. Also, glibc and systemd are different projects, the later is associated with a commercial entity. The libc and init system used on a BSD project are normally both parts of the BSD project, and the project is not associated with any commercial entity. Whether that has any effect on anything is left as question for the reader.

ELI5 why the “xz drama” couldn’t happen on openBSD? do they not use open source packages? are they assuming they would have caught it before adding the infected version to their repos?

ddavis 3y ago

The back door relied on a couple of Linux package management systems (if I’m recalling correctly, it had .deb and .rpm checks, see https://marc.info/?l=openbsd-misc&m=171227941117852&w=2 https://marc.info/?l=openbsd-misc&m=171227941117852&w=2)

rrix2 3y ago
was it mostly about the targets the xz actor was interested in than some security property inherent to openbsd that would prevent that sort of dynamic linking vulnerability?
- calgarymicro 3y ago
  Debian and RedHat link liblzma into SSH for systemd which OpenBSD doesn't use. So in the sense of there being a larger attack surface with those distros I guess you can consider it more secure, but it's not just OpenBSD though; there are plenty of Linux distros that don't do this either.

shrubble 3y ago

If you run the 'ldd' tool against OpenBSD's ssh, you get 4 libraries. If you do the same on different Linux distros you get many more; this means the surface area is much larger.

t-3 3y ago

OpenSSH and the OpenBSD init system are part of the base system, maintained by OpenBSD developers. There's no opportunity for an outsider to use dependencies to insert backdoors in critical components.

johnny22 3y ago
It didn't matter where the init system came from, but where xz came from.
- lsaljdljsljljsa 3y ago
  it does. If the init system links xz... and systemd does.
- toast0 3y ago
  My understanding is that nothing in base has a dependency on anything outside. There may be some third party software in contrib (if OpenBSD has contrib, like FreeBSD), but I don't think the 3rd party software's build system would be used. Some BSDs use an external compiler on some platforms, and in that case, you have a build dependency on that, and trusting trust may apply.
  - sillywalk 3y ago
    > that nothing in base has a dependency on anything outside. From [0] "The system includes the following major components from outside suppliers: Xenocara (based on X.Org 7.7 with xserver 21.1.11 + patches, freetype 2.13.0, fontconfig 2.14.2, Mesa 23.1.9, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.3 and more) LLVM/Clang 16.0.6 (+ patches) GCC 4.2.1 (+ patches) and 3.3.6 (+ patches) Perl 5.36.3 (+ patches) NSD 4.8.0 Unbound 1.18.0 Ncurses 6.4 Binutils 2.17 (+ patches) Gdb 6.3 (+ patches) Awk January 22, 2024 Expat 2.6.0 zlib 1.3.1 (+ patches) [0] https://www.openbsd.org/75.html https://www.openbsd.org/75.html
  - johnny22 3y ago
    What openbsd includes in the base system is the real star vs the way linux distros get made.
- akira2501 3y ago
  The critical piece was systemd, was it not? ssh is no dependent on xz, it only gets there through the "systemd notification" hook provided by vendor specific patches.

jcranmer 3y ago

It depends on what is meant by "xz drama". If you consider it to refer to the supply chain attack, well, OpenBSD is too minor a platform for anyone to consider it worthwhile trying to invest in the long supply chain attack for the OS. If you view it as the break-xz-to-attack-sshd, OpenBSD is designed as a single system with a single codebase, and has a general aversion to features such that it is difficult for an undersecured random library to become a vehicle to breaking a major, important component. If you view it as the techniques used to publish an exploit in open source code, well, OpenBSD is filled with the kind of developers whose self-confidence is such that they believe that they are uniquely capable of writing code without those kinds of issues and will denigrate the use of newer technologies that mitigate that risk with the attitude that it coddles programmers and coddled programmers aren't good programmers. Or, in shorter terms, OpenBSD is actually one of the projects I'd expect to have a relatively high chance of a clever contributor being able to smuggle in an exploit in plain sight.

QuantumG 3y ago
Which newer techniques? Honest question.
- nequo 3y ago
  Not parent but jails and capabilities that are user controlled and not hardcoded into the binary would be nice to see.
  - QuantumG 3y ago
    Do you think they understand the benefits? I think you'd have a lot better chance at enacting change than my emotional rambling has, and if not, lesson learned.
  - nanolith 3y ago
    They tried this. The predecessor for pledge / unveil was systrace, which included a user-controlled policy file. One significant reason that pledge was implemented was because it is possible to disable or mis-configure user-controlled policies. Theo mentions this in his presentation that unveiled pledge, and he's basically referring to things like seccomp and systrace: https://www.openbsd.org/papers/hackfest2015-pledge/mgp00005.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00005.... More explicitly mentioning seLinux / seccomp: https://www.openbsd.org/papers/hackfest2015-pledge/mgp00008.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00008.... https://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00011.... More explicitly mentioning systrace: https://www.openbsd.org/papers/hackfest2015-pledge/mgp00009.html https://www.openbsd.org/papers/hackfest2015-pledge/mgp00009.... Certainly, it's possible to debate the relative merits of this approach, but this is why OpenBSD has moved away from user controlled policies.

dfedbeef 3y ago

People used to say backdoors and security bugs were less likely on Linux because 'open source'. Sociological theories of computer security are magical thinking.

dfedbeef 3y ago
(By 'people', I mean me and also the person who introduced me to Linux.)
kibwen 3y ago
The "all bugs are shallow" schtick is not about bugs being less likely, only that bugs are more likely to be brought to light. Which is still true: the xz backdoor never would have been found in a closed-source codebase.

1vuio0pswjnm7 3y ago

"ELI5 why the "xz drama" couldn't happen on [O]penBSD." It could happen but it did not happen. Linux distributions that use glibc and systemd are popular. Linux has millions of dollars behind it, and many corporations contributing their time and money, some building businesses around Linux. AFAIK, OpenBSD does not have similar resources. It's volunteer-supported. Berkeley Software Distributions use their own libc, such as OpenBSD, and their own init system (not systemd) and are relatively unpopular. The liblzma exploit that was discovered targeted Linux distributions that use glibc and systemd. Specifically, it relied on a feature of glibc called ifunc. If an exploit targeted OpenBSD, then there would probably be less "drama". Unpopularity probably plays a role in avoiding "drama". Also consider the use of features such as ifunc and systemd. In some cases Linux may use features that BSD projects do not have. The liblzma exploit author chose to target Linux-specific features. Also, glibc and systemd are different projects, the later is associated with a commercial entity. The libc and init system used on a BSD project are normally both parts of the BSD project, and the project is not associated with any commercial entity. Whether that has any effect on anything is left as question for the reader.