this post was submitted on 11 Apr 2024
478 points (96.0% liked)

Programmer Humor

32596 readers
621 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

founded 5 years ago
MODERATORS
 

transcriptScreenshot of github showing part of the commit message of this commit with this text:

Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094).

While the backdoor was inactive (and thus harmless) without inserting
a small trigger code into the build system when the source package was
created, it's good to remove this anyway:

  - The executable payloads were embedded as binary blobs in
    the test files. This was a blatant violation of the
    Debian Free Software Guidelines.

  - On machines that see lots bots poking at the SSH port, the backdoor
    noticeably increased CPU load, resulting in degraded user experience
    and thus overwhelmingly negative user feedback.

  - The maintainer who added the backdoor has disappeared.

  - Backdoors are bad for security.

This reverts the following without making any other changes:

The sentence "This was a blatant violation of the Debian Free Software Guidelines" is highlighted.

Below the github screenshot is a frame of the 1998 film The Big Lebowski with the meme caption "What, are you a fucking park ranger now?" from the scene where that line was spoken.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 67 points 7 months ago (4 children)

Seriously. If you are going to do it, write in assembly or something else no one understands.

[–] [email protected] 126 points 7 months ago (4 children)

Tbh jia tan really wasn't lucky some mf at Microsoft noticed a 500ms delay in ssh. The backdoor was so incredibely clever and Well hidden and ingenious i almost feel bad for him lmao

[–] [email protected] 77 points 7 months ago (2 children)

A really good point I heard is: this was likely a state actor attack, so how many others just like this are out there, undiscovered?

[–] [email protected] 30 points 7 months ago (5 children)

Unpopular opinion: what if it was not a state actor and just some bored person somewhere that thought it would be cool to own a bot net?

What if this is just one of many backdoors and it’s just the only one we found?

[–] [email protected] 64 points 7 months ago* (last edited 7 months ago) (2 children)

I heard that person actively contributed for something like 2 years, providing actually useful contributions, to gain the level of trust needed to plant that backdoor. Feels a bit too much to chalk it up to boredom.

As for the second part, that's an interesting question. Are there lots of backdoors and we just happened to notice this one, or are backdoors very rare exactly because we'd have found them out soon like in this case?

[–] [email protected] 18 points 7 months ago* (last edited 7 months ago) (1 children)

You'd be surprised what I manage with motivation and boredom.
You'd be surprised what a highly skilled ~~scalled~~ person can manage to achieve.

Boredom, Skills and Motivation are dangerous things to have if improperly handled.

[–] [email protected] 7 points 7 months ago

highly scalled person

You might be on to something, it might have been the lizzard people!

[–] [email protected] 1 points 7 months ago* (last edited 7 months ago)

Another speculation from the suse team was a private company with intent to sell the exploit to state ~~across~~ actors

I think there's lots of known backdoors that are not publicly disclosed and privately sold.

But given the history of cves in inclined to believe most come from well intentioned developers. When you read the blogs from the Google security team for example, it's interesting to see how you need to chain a couple exploits at least, to get a proper attack going. Not in this case, it would make it very straightforward to accomplish very intrusive actions.

[–] [email protected] 7 points 7 months ago

The design is Moriarty lvls of complex. State actor might be too specific, but everything but a group of people would be highly unlikely.

[–] [email protected] 7 points 7 months ago (1 children)

Nobody is both that bored and that motivated. Unless paid.

[–] [email protected] 8 points 7 months ago* (last edited 7 months ago)

You forget that a lot of brilliant open source projects are one man shows from geniuses somewhere around the world. They are usually not paid.

In the other hand, if you get your hands on a powerful botnet, you can rent out its services (like ddos for example) for quite a bit of money.

[–] [email protected] 6 points 7 months ago (1 children)

Realistically I think it's probably easier to acquire a botnet of less secure systems. This was a targeted attack.

[–] [email protected] 3 points 7 months ago

Easier, yes. But some people will do stuff because it is more challenging.

[–] [email protected] 3 points 7 months ago

Yeah, well that's just, like, your opinion, man. (You mentioned the word opinion in a post referencing The Big Lebowski. I had to. Thank you for coming to my shit post.)

[–] [email protected] 14 points 7 months ago

It’s scary to think about… a lot of people are now thinking about how we can best isolate our build test process so it works as a test suite but doesn’t have any way to interact with the output or environment.

It’s just blows my mind to think of the levels of obfuscation this process used and how easy it would be to miss it.

[–] [email protected] 12 points 7 months ago

the guy was even in microsoft he was at his house testing debian

[–] [email protected] 18 points 7 months ago

Aggressively writes a backdoor in COBOL

[–] [email protected] 3 points 7 months ago (1 children)

Whoa hol up.

Write the build script in assembly?

Thats not okay man.

[–] [email protected] 1 points 7 months ago

No, it this case the backdoor. Hide it in plain sight.

[–] [email protected] 1 points 7 months ago (1 children)

Assembly wouldn't run on multiple architectures

[–] [email protected] 4 points 7 months ago

Neither does the blob it downloaded. Would you think twice about AVX10 support if it was commented as AVX10 support in a compression library? Some might, but would they be the ones reviewing the code? A lot of programs that can take advantage of "handwritten" optimizations, like video decoders/encoders and compression, have assembly pathways so it will take advantage of the hardware when it is available but run when it isn't. If the reviewers are not familiar with assembly enough something could be snuck in.

systemD is using dlopens for libraries now and I am not convinced malware couldn't modify the core executable memory and stay resident even after the dl is unloaded. Difficult, yes, but not impossible.