Everything I Know About the XZ Backdoor

https://boehs.org/node/everything-i-know-about-the-xz-backdoor

by internetter • 2 years ago

195 30 2 years ago

tomrod2• 2 years ago

Wow. Timeline-wise this appears to be a clearly coordinated attempt, unless I'm missing something.

goalieca2• 2 years ago

The timeline suggests this is a patient hacker. The most patient of which are nation-states because they're not worried about cashflow and think in terms of years.

imiric• 2 years ago

Makes one wonder how many instances of this goes unnoticed. Maybe this attacker got sloppy, but how many of them don't? We were lucky that one person noticed suspicious behavior and had the technical skills and patience to investigate, but how many of us don't?

adeon2• 2 years ago

This mailing thread is quoted in the 2022 part on the page on the xz maintainer being pressured to add new maintainers for xz: https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...

Seems like the usual story of some lone maintainer maintaining a popular project and losing their time and energy.

The post doesn't spell it out but I wonder if they implied there's a suspicion that the person doing the pressuring there is also another sock puppet of JiaT75 as some scheme of getting access to xz. That would seem particularly cruel; take advantage of a tired maintainer with mental health issues to use their project to smuggle security exploits to the world.

Regardless, be nice to people who are doing "unpaid hobby projects" your work depends on. Reading the thread made me sad.

Hakkin• 2 years ago

The post doesn't spell it out but I wonder if they implied there's a suspicion that the person doing the pressuring there is also another sock puppet of JiaT75 as some scheme of getting access to xz

You can get the user's e-mail by clicking the "Reply via e-mail to" on the page. It matches the <firstname><lastname><number>@protonmail.com of the other sockpuppets, and the PGP key for the account was made 1 day prior to their first communication on that mailing list.

radicaldreamer• 2 years ago

This is an intelligence agency trying to add backdoors to archiving software... likely targeting other utilities as well with same MO

adeon2• 2 years ago

Ah I see, I wondered where the heck is a reply e-mail, I didn't see any reply email spelled out anywhere and didn't notice the button, I thought maybe the archive site deliberately wanted to hide the email adderesses.

Kinda looks like everyone in the thread might be sock puppet? ...except for the xz maintainer. Oof.

Now I'm just even more sad. Dammit Internet.

LegionMammal978• 2 years ago

Regarding the libarchive change:

This commit does not do what it says it does. All it does, in fact, is replace safe_fprint with an unsafe variant, potentially introducing another vulnerability. The code was merged without any discussion, and lives on to this day. libarchive should also be considered compromised until proven otherwise.

This is very far from the truth, from what I can tell. If you look at the PR, it does, in fact, add strerror(errno) to the end of the error line, as it claims in its description.

And the switch from safe_fprintf() to regular fprintf() for the archive_error_string matches the rest of the codebase, which is scattered with calls to lafe_errc() and lafe_warnc() with archive_error_string (forwarding to vfprintf()). If the contents of that string were considered sensitive to print out, then it would hardly be a new vulnerability. Especially compare the code in tar/write.c, which calls fprintf(stderr) to output the archive_error_string in precisely the same way as the PR in question does.

Note that safe_fprintf() has nothing at all to do with memory safety: its only purpose is to escape unprintable characters before printing them. Indeed, a stack overflow bug within the safe_fprintf() implementation was the subject of a CVE in 2022 [0].

[0] https://github.com/advisories/GHSA-c42q-jv3x-rq38

internetter• 2 years ago

Thanks, in my haste I misread. I removed the part claiming it didn't do what it says, though I maintain the changes made simultaneously is very suspect as there is no apparent motivation

Bulat_Ziganshin• 2 years ago

the motivation is probably "get foot in the door". the attacker also made a few documentation-only PRs in various repos, but having code PR will make him more creditable, and also would help to add more backdoors to libarchive in the future

and librachive is now part of Windows 10, being used as a universal archive decompression library in the Explorer

dang• 2 years ago

Main ongoing thread:

Backdoor in upstream xz/liblzma leading to SSH server compromise - https://news.ycombinator.com/item?id=39865810 - March 2024 (744 comments)

hnthrowaway03282• 2 years ago

This might be the tip of the iceberg, especially if this is part of the work of a nation-state agency. Very persistent and clever though.

hnthrowaway03282• 2 years ago

Some other thoughts: how many popular open source projects only have 1-2 maintainers? I guess there is a way to do a search. I assume 5+ is safer, if they are of different humans.

Everything I Know About the XZ Backdoor

Related Stories