4 ms·

Linux Xz Backdoor Damage Could Be Greater Than Feared

11 points by RickJWagner 3y ago

jqpabc123 3y ago
"Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The fact that this possibility has been routinely dismissed for decades doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. And the full irony of this potentially catastrophic backdoor being discovered by a *Microsoft* employee still seems to be largely lost on the Open Source community. Security requires a lot more than just source code --- like maybe vetting those involved in the process. People are almost always the weakest link in any security system.
- xinayder 3y ago
  Where's the irony in it being discovered by a MS employee? As far as I know he was working on a personal project and decided to debug why SSH logins were taking longer than expected, and found the backdoor. > "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. I don't get this stance. Saying the true nature of open source is also its weakness is an ad hominem IMO, usually spat out from people that dislike the open source ideology. What's the solution? Developing stuff at walled gardens and praying to god that the maintainers will be beneficent enough to report a security breach? We've seen how that works out, companies take a year or so to report a breach after the damage was done. > The fact that this possibility has been routinely dismissed for years doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. It wasn't dismissed, it was just simply proven by experience that this is just FUD to undermine open source. And even if it is true, the good things coming out of OS ideology are much greater than the possible bad things. Let me give you an example of why this is FUD. ClamAV is an open source malware analysis tool and yet, it's being constantly updated with new malware signatures. The fact of it being open source did nothing to sever its ability of detecting malware.
  - robertlagrant 3y ago
    > Saying the true nature of open source is also its weakness is an ad hominem IMO Ad hominem is criticising the person making the argument, rather than the argument itself. This seems to be not that. > usually spat out from people that dislike the open source ideology. This is a good example of ad hominem.
  - jqpabc123 3y ago
    Where's the irony in it being discovered by a MS employee? If not for his day job producing non-Open Source software, he would likely have lacked the time and skill to devote to this Open Source project. Moral to the story --- developers can not live by Open Source alone.
- robertlagrant 3y ago
  > And the full irony of this potentially catastrophic backdoor being discovered by a Microsoft employee still seems to be largely lost on the Open Source community. I'm not sure things can be lost on a community. Aren't Microsoft part of that community?
  - graemep 3y ago
    > Aren't Microsoft part of that community? The MS employee who discovered the issue is definitely part of the open source community. A significant contributor to a major project AFAIK.
    - jqpabc123 3y ago
      If all software was Open Source, there would probably be significantly fewer develeoprs doing Open Source --- and fewer developers overall. His day job is proof that he does not subscribe to the mantra that Open Source is the best or the only way to do software.
- graemep 3y ago
  > "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The bug was found before it hit production, so to that extent things worked. If there was a similar attack on proprietary software (from a malicious or suborned employee, a contractor, a sub contractor, or from the vast amounts of open source code used in most of it, or by some other route) we might never have known. It certainly could not have been investigated by someone who did not have access to the source.
  - ranger_danger 3y ago
    > The bug was found before it hit production But it was found by pure accident in someone's spare time and not as part of any standard testing/procedures.
    - chasil 3y ago
      How can we be sure that it was found by accident?
      - ranger_danger 3y ago
        We can't, you're right I just took them for their word on it. Just like we can't know that this was actually intentional or done by a professional or state actor.
    - graemep 3y ago
      I thought he was working, not doing it in his spare time? He is paid to work on Postgres and that is what he was doing when he spotted it, right?
  - jqpabc123 3y ago
    The bug was found before it hit production, so to that extent things worked. Not according to the article: "Ubuntu 24.04 LTS (Noble Numbat) also contained the infected files, which have since been removed. Advisories were also issued by Arch and openSUSE." Bottom line: This is proof that there is very little vetting of either code or the people involved in these projects. In many cases, the people are unknown/anonymous. This is a gaping security hole that someone just spent a lot of time and effort to exploit.
- rho138 3y ago
  Something something solarwinds something something
account42 3y ago
This is a month old article. There doesn't seem to be anything here that wasn't in the other submissions about the xz-backdoor. Why post this?
deleted 3y ago
[deleted]
kelsey98765431 3y ago
It seems like the JaiTan incident was either the first time a playbook of this nature was caught, or a new proving out of the method by a less experienced set of operators. This can happen when an attack like this is successful enough times by a high skilled adversary that it becomes essentially a theoretically mapped attack path for lesser skilled operator teams to attempt to create a working playbook for. Look for many more of these attacks to come as the playbooks are refined and less skilled operators are able to pull off these sorts of attacks better. Think of how the ransomware industry evolved from viruses to botnets to the wannacry event. That vertical stack of both attack chain knowledge and post attack operational capability combined put most contenders out of the game until the post exploit portion of the attack was turned into an affiliate system. I envision a future where it's easier than ever for even just a burned out software developer to simply use a service that creates a one time use highly obfuscated performance and memory safety tested back door based on public key encryption exactly like the JaiTan proof of concept showed. The end result will need to be heavy focus on reproducible testing of signed source code, perhaps with even more cryptographic insurances than git currently provides. I imagine my entire workflow as being cryptographicly signed from commit to runner state changes to unit testing and fuzzing, with some form of multi factor signing system like multisig. The future is bleak but it's not like we can't do things about it and be proactive.

11 points by RickJWagner 3y ago

"Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The fact that this possibility has been routinely dismissed for decades doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. And the full irony of this potentially catastrophic backdoor being discovered by a *Microsoft* employee still seems to be largely lost on the Open Source community. Security requires a lot more than just source code --- like maybe vetting those involved in the process. People are almost always the weakest link in any security system.

xinayder 3y ago
Where's the irony in it being discovered by a MS employee? As far as I know he was working on a personal project and decided to debug why SSH logins were taking longer than expected, and found the backdoor. > "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. I don't get this stance. Saying the true nature of open source is also its weakness is an ad hominem IMO, usually spat out from people that dislike the open source ideology. What's the solution? Developing stuff at walled gardens and praying to god that the maintainers will be beneficent enough to report a security breach? We've seen how that works out, companies take a year or so to report a breach after the damage was done. > The fact that this possibility has been routinely dismissed for years doesn't make it any less of a real security threat. This is kinda like assuming that blockchain can prevent crypto fraud. It wasn't dismissed, it was just simply proven by experience that this is just FUD to undermine open source. And even if it is true, the good things coming out of OS ideology are much greater than the possible bad things. Let me give you an example of why this is FUD. ClamAV is an open source malware analysis tool and yet, it's being constantly updated with new malware signatures. The fact of it being open source did nothing to sever its ability of detecting malware.
- robertlagrant 3y ago
  > Saying the true nature of open source is also its weakness is an ad hominem IMO Ad hominem is criticising the person making the argument, rather than the argument itself. This seems to be not that. > usually spat out from people that dislike the open source ideology. This is a good example of ad hominem.
- jqpabc123 3y ago
  Where's the irony in it being discovered by a MS employee? If not for his day job producing non-Open Source software, he would likely have lacked the time and skill to devote to this Open Source project. Moral to the story --- developers can not live by Open Source alone.
robertlagrant 3y ago
> And the full irony of this potentially catastrophic backdoor being discovered by a Microsoft employee still seems to be largely lost on the Open Source community. I'm not sure things can be lost on a community. Aren't Microsoft part of that community?
- graemep 3y ago
  > Aren't Microsoft part of that community? The MS employee who discovered the issue is definitely part of the open source community. A significant contributor to a major project AFAIK.
  - jqpabc123 3y ago
    If all software was Open Source, there would probably be significantly fewer develeoprs doing Open Source --- and fewer developers overall. His day job is proof that he does not subscribe to the mantra that Open Source is the best or the only way to do software.
graemep 3y ago
> "Open Source" may help find bugs but it can just as easily help exploit them --- or as in this case, intentionally create and plant them. The bug was found before it hit production, so to that extent things worked. If there was a similar attack on proprietary software (from a malicious or suborned employee, a contractor, a sub contractor, or from the vast amounts of open source code used in most of it, or by some other route) we might never have known. It certainly could not have been investigated by someone who did not have access to the source.
- ranger_danger 3y ago
  > The bug was found before it hit production But it was found by pure accident in someone's spare time and not as part of any standard testing/procedures.
  - chasil 3y ago
    How can we be sure that it was found by accident?
    - ranger_danger 3y ago
      We can't, you're right I just took them for their word on it. Just like we can't know that this was actually intentional or done by a professional or state actor.
  - graemep 3y ago
    I thought he was working, not doing it in his spare time? He is paid to work on Postgres and that is what he was doing when he spotted it, right?
- jqpabc123 3y ago
  The bug was found before it hit production, so to that extent things worked. Not according to the article: "Ubuntu 24.04 LTS (Noble Numbat) also contained the infected files, which have since been removed. Advisories were also issued by Arch and openSUSE." Bottom line: This is proof that there is very little vetting of either code or the people involved in these projects. In many cases, the people are unknown/anonymous. This is a gaping security hole that someone just spent a lot of time and effort to exploit.
rho138 3y ago
Something something solarwinds something something

account42 3y ago

This is a month old article. There doesn't seem to be anything here that wasn't in the other submissions about the xz-backdoor. Why post this?

deleted 3y ago

[deleted]

kelsey98765431 3y ago

It seems like the JaiTan incident was either the first time a playbook of this nature was caught, or a new proving out of the method by a less experienced set of operators. This can happen when an attack like this is successful enough times by a high skilled adversary that it becomes essentially a theoretically mapped attack path for lesser skilled operator teams to attempt to create a working playbook for. Look for many more of these attacks to come as the playbooks are refined and less skilled operators are able to pull off these sorts of attacks better. Think of how the ransomware industry evolved from viruses to botnets to the wannacry event. That vertical stack of both attack chain knowledge and post attack operational capability combined put most contenders out of the game until the post exploit portion of the attack was turned into an affiliate system. I envision a future where it's easier than ever for even just a burned out software developer to simply use a service that creates a one time use highly obfuscated performance and memory safety tested back door based on public key encryption exactly like the JaiTan proof of concept showed. The end result will need to be heavy focus on reproducible testing of signed source code, perhaps with even more cryptographic insurances than git currently provides. I imagine my entire workflow as being cryptographicly signed from commit to runner state changes to unit testing and fuzzing, with some form of multi factor signing system like multisig. The future is bleak but it's not like we can't do things about it and be proactive.