7 ms·
Jia Tan "JiaT75": Added error text to warning when untaring with bsdtar (2021)
- hiisukun 2y agoI guess for those not sure of the context: The user Jia Tan added exploit code to the 'xz' tool as part of a larger deal. Wikipedia has a page on it here [1]. In this post, they are discussing some changes to print code specifically for the libarchive project, and some notable personalities in the security community chime in, including Colin Percival (Tarsnap among others) and Taviso (Google project zero among others). [1] https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor
- throw0101c 2y ago> The user Jia Tan added exploit code to the 'xz' tool as part of a larger deal. Various discussions on this backdoor (in rough chronological order): * Backdoor in upstream xz/liblzma leading to SSH server compromise:† https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810 * What we know about the xz Utils backdoor that almost infected the world: https://news.ycombinator.com/item?id=39891607 https://news.ycombinator.com/item?id=39891607 * How the XZ Backdoor Works: https://news.ycombinator.com/item?id=39911311 https://news.ycombinator.com/item?id=39911311 * The xz sshd backdoor rabbithole goes quite a bit deeper: https://news.ycombinator.com/item?id=39956455 https://news.ycombinator.com/item?id=39956455 * XZ backdoor story – Initial analysis: https://news.ycombinator.com/item?id=40017310 https://news.ycombinator.com/item?id=40017310 † Original report, AFAICT.
- r721 2y ago>XZ backdoor story – Initial analysis Here are parts 2 and 3 (weren't discussed on HN): >Part 2: Assessing the Y, and How, of the XZ Utils incident (social engineering) https://securelist.com/xz-backdoor-story-part-2-social-engineering/112476/ https://securelist.com/xz-backdoor-story-part-2-social-engin... >Part 3: XZ backdoor. Hook analysis https://securelist.com/xz-backdoor-part-3-hooking-ssh/113007/ https://securelist.com/xz-backdoor-part-3-hooking-ssh/113007...
- Bluestein 2y agoSomething tells me that somewhere deep in a millitary facility somewhere, somebody is getting court marshalled, if not downright worse (after having been found out, I mean ...) PS. Or some "unaffiliated" group somewhere is getting their SOF cut off ...
- Macha 2y agoThis was discussed at the time of the libxz revelations and they did re-review all commits in light of this: https://github.com/libarchive/libarchive/issues/2103 https://github.com/libarchive/libarchive/issues/2103
- wengo314 2y agoimho it's embarrassing that this got merged in the first place. it's not a major flaw, and no exploit. but it seems as if nobody paid due attention to actual changes.
- renewiltord 2y agoFunny how everyone's competent in hindsight and eager to share that.
- elric 2y agoI'm a little unclear as to why JiaT75's github account still exists? Surely this should be nuked from orbit so that no one accidentally ends up using their shady code?
- sammcgrail 2y agoHistory is useful
- TickleSteve 2y agoremoving their account doesnt remove their commits.
- falqun 2y agoThe deletion of the account would not delete commits associated with it. The commit would still contain everything potentially malicious, plus a reference to an account that would be deleted. Which is actually worse, you cant track what code a malicious actor has contributed (easily). So the correct thing to do is take away login / deactivate the account, and then start going through all contributions and check them via the account that references all of this.
- alphabetting 2y agoWould be cool if there was a big warning icon with "ACCOUNT LOCKED: STATE ACTOR" like for cheaters on chess websites
- poikroequ 2y agoIt's useful to keep it up so the public can scrutinize all their commits and fix anything suspicious.
- elric 2y agoSure, but there is zero indication of that on their user page. At the very least the account should be disabled, all repos should be archived, and a big fat warning banner should be prominently visible. The current state of affairs seems irresponsible.
- peanut_worm 2y agowhy wouldn’t they just immediately reject it if they know its the same guy from the xz thing?
- H8crilA 2y ago[2021]
- peanut_worm 2y agogood thing that was in the title
- joh6nn 2y agoAsking in seriousness: did you comment without reading the link? If so, why? I legit don't understand why people comment on things without having read them, and I would like to
- freen 2y agoFrist Psot culture is real: everyone else sees the “contribution”, and if it happens to be of marginal value, it earns karma. Stochastic karma farming benefits from a larger N, hence posting without reading.
- joh6nn 2y agoThanks for weighing in! But this is just speculation, right? Are you speaking from experience? I'm specifically looking for someone who does it to explain it. I mean, I can make my own guesses about various forms of attention seeking and hopes to somehow cash in on high karma all day long but, to me it feels like HN is among the worst possible venues for that. I'm not aware of easy ways to convert HN karma into cash flow like you maybe could with followers on other platforms. So I don't immediately see a benefit in just farming karma for its own sake. Is there some benefit to karma farming I'm not aware of? Like, some points-to-dollars conversion stream that I'm not in the loop on?
- deleted 2y ago[deleted]
- throwaway2037 2y ago@dang: Please add [2021] to the title.
- exitb 2y agoOnly the original commit was from 2021. The discussion is recent.
- Zitrax 2y agoRecent is relative, the latest comment is from April 2024, not something that popped up today.
- lopkeny12ko 2y agoWhy? It is immediately obvious that the PR was published 3 years ago. Github shows the timestamp very clearly in multiple places.
- boesboes 2y agoYes, but this is not about the PR, it is about the discussion. The dates are shown very clearly in many places too. ffs
- boesboes 2y agoDiscussion is from this year, try reading for context
- deleted 2y ago[deleted]
- xyst 2y agoWild. All of these carefully inserted “seemingly innocuous” changes in the ecosystem to end up contributing to a wider exploit. This comment sums it up nicely with a gif: https://github.com/libarchive/libarchive/pull/1609#issuecomment-2028125584 https://github.com/libarchive/libarchive/pull/1609#issuecomm...
- wengo314 2y agothis explot is basically "death by a 1000 papercuts", now that i think about it.
- bufferoverflow 2y agoMore like assemble a sword from 1000 sheets of paper and stab everyone.
- joh6nn 2y agoI'm confused why this is being posted now? This thread appears to have taken place in the days immediately following the original XZ discovery, with no new activity since very early April. It was discussed heavily at the time that Jia Tan had made contributions to other projects and that those were being investigated as well. Is there something new here I missed, or some additional context that makes this specific commit relevant right now?
- oefrha 2y agoSince the posted thread has been locked since April, even if there’s new information it can’t be on the posted page. I suspect a lot of votes come from people thinking there’s significant new information (otherwise why would this suddenly be #1?) when there’s none.
- bibinou 2y agoKarma farming.
- joh6nn 2y agoOk, but to what end? Is there some karma-to-dollars pipeline that I don't know about? There a bunch of other platforms that superficially seem like much softer targets with more obvious payoffs. Like, if we put it in the classic context of 1. Farm Karma 2. ? 3. Profit! I'm not clear on step 2. What's step 2 And of course that pre-supposes malice (or at least greed), which is in violation of Hanlon's Razor.
- bibinou 2y agoCoincidentally, Reddit (YC05) IPO'ed in March so I'm sure you'll find plenty of analysis on that. Gallowboob reportedly got paid <https://knowyourmeme.com/memes/people/gallowboob https://knowyourmeme.com/memes/people/gallowboob>. It used to be called Curation, Marketing, or Expert Advice but it's been algorithmified to death.
- 2y ago
- cookiengineer 2y agoIt's kind of ridiculous how few lines of code can trigger such a huge and complex discussion about thread safety, where almost all developers involved actually aren't really certain whether or not this can be exploited. I just wish people would stop writing C code for libraries that consume arbitrary data.
- fooker 2y agoYes, please stop writing C and C++ code! (... and leave the high paying jobs to us of course)
- SpaghettiCthulu 2y agoIn this case it doesn't matter whether it's C or Rust. Both languages, if using their default string formatting facilities, are vulnerable.
- zokier 2y agoGitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, and leave the peanut gallery commenting to reddit/hn/twitter/whatev.
- Cthulhu_ 2y agoGH needs a system like most forum communities have where comments can be put in a moderation / approval queue before being public.
- keepamovin 2y agoNot a bad idea. I guess the UX is not hard, but likely it would clash with GH's bias towards openness/transparency/public record. Possibly risk making moderation 1st class citizen, they may fear this would detract from the main purpose of collaborative code production. Yet...it could help that. But I understand it's a tricky nuance. So, they have comment minimization by assigned moderators. Or you can just delete / edit comments and issues. Obviously not as powerful as a pre-screening queue. Less work tho!
- Bluestein 2y agoThey'd end up like SO ...
- ivanjermakov 2y agoThis is why a lot of projects use other tools for bug tracking and merging, e.g. bugzilla, youtrack, atlassian etc.
- AshamedCaptain 2y agoThe opposite. Whenever some project migrates to an inferior alternative like Github or Discord they always claim a number of arguments which boil down to "it's where people go these days" (e.g. less friction for newcomers, most people have an account there already, larger community, whatever excuse you can come up). So I say they are getting exactly what they wanted to get.
- deleted 2y ago[deleted]
- lkdfjlkdfjlg 2y agoPeople in the Western world are comfortable and people in China are very motivated. I've been reading "the man who solved the market" about Jim Simons and his hedge fund Renaissance. This reminds me that there was a period just after the fall of the Soviet Union where Renaissance was flooded with very technically strong, very motivated, very hard working, and very fraudulent ex-USSR people. They're leaking guys, wake up.
- AHTERIX5000 2y agoI'd be surprised if China has anything to do with this operation.
- bediger4000 2y agoWho do you favor? One of the Russian Intel agencies? NSA? The Grugq?
- Bluestein 2y agoAt some point FOSS will need it's own agency, at this rate :) PS. The GNU GRU?
- Bluestein 2y agoThat is actually a thought.-
- deleted 2y ago[deleted]
- londons_explore 2y agoAm I the only one a little concerned that no obvious attack has been found from this? It seems doubtful that a state actor is trying to use terminal escape sequences to hide an error message... The state actor wants code execution, not the ability to backspace some warning on a developers terminal. Besides, using such a vulnerability seems far too dangerous - those escape sequences would be plainly obvious in any log file or any inspection of files on-disk. And at the same time, if you are an undercover state actor, there is no point in potentially revealing yourself by inserting some security problem that isn't exploitable.
- bthrn 2y agoThe goal here is to submit what appears to be a sequence of innocuous changes, none of which on their own are “obvious” vulnerabilities. The truth is, we don’t know what the strategic depths of this actor are. It may be years before we know whether an attack is successful. For example — and this is just hypothetical - the author may have found that some consumer of this codebase uses it in a script, and consumes console output in some form. By modifying its output to behave differently, they may be able to influence the consumer’s execution in some clever way so as to create other conditions necessary for additional exploitation. Or - the PR could have just been a test to gauge the scrutiny of the approvers.
- Bluestein 2y agoThe "funny" thing here is that this is (somewhat, perhaps?) how an AI intelligent beyond human capacity might execute an attack - or what an attack by one such might feel like: Lots of apparently unrelated actions, many or all of which make no sense ... ... (until and if you see the larger picture, which might be insurmountably difficult ... ... this, coupled with AI-level scalability of social engineering, at AI-level scale -and- with an AI-level understanding of "known-outcomes" that might be desirable towards given goals: "Leader change", etc.-)
- omoikane 2y agoThere had been code execution exploits tied to escape sequences, for example: https://news.ycombinator.com/item?id=40428032 https://news.ycombinator.com/item?id=40428032 - Abusing url handling in iTerm2 and Hyper for code execution (2024-05-21)
- keybored 2y ago> The diff doesn't make this obvious due to the removal of a newline in a parameter list. I like to separate every little intentional change into their own commits. So a formatting change would be separated into its own commit. If you are looking for “red flags” notice if the diff is clean or not according to what you expect to see changed; if you only expect to see some error text change then multiple lines being changed is weird. Also use a decent diff viewer which is somewhat content/language-aware.
- laura074 2y ago[dead]