this post was submitted on 29 Mar 2024
386 points (99.0% liked)

Linux

48269 readers
638 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 48 points 7 months ago* (last edited 7 months ago) (3 children)

I'm genuinely disturbed that a person who was a core developer could just go rogue.

[–] [email protected] 76 points 7 months ago* (last edited 7 months ago) (2 children)

From what I've been reading, it sounds like they were malicious from the very beginning. The work to integrate the malware goes back to 2021. https://boehs.org/node/everything-i-know-about-the-xz-backdoor

It's an extremely sophisticated attack that was hidden very well, and was only accidentally discovered by someone who noticed that rejected SSH connections (eg invalid key or password) were using more CPU power and taking 0.5s longer than they should have. https://mastodon.social/@AndresFreundTec/112180406142695845

[–] [email protected] 15 points 7 months ago (2 children)

From that post, commits set to UTC+0800 and activity between UTC 12-17 indicate that the programmer wasn't operating from California but from another country starting with C. The name is also another hint.

[–] [email protected] 35 points 7 months ago* (last edited 7 months ago) (9 children)

That could be part of their plan though... Make people think they're from China when in reality they're a state-sponsored actor from a different country. Hard to tell at this point. The scary thing is they got very close to sneaking this malware in undetected.

A lot of critical projects are only maintained by one person who may end up burning out, so I'm surprised we haven't seen more attacks like this. Gain the trust of the maintainer (maybe fix some bugs, reply to some mailing-list posts, etc), take over maintenance, and slowly add some malware one small piece at a time, interspersed with enough legit commits that you become one of the top contributors (and thus people start implicitly trusting you).

Edit: Based on this analysis, they may have been based in a European timezone and just changed their timezone to UTC+8 before committing to Git to make it look like they were in China: https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and. Their commits were usually between 9 am and 6 pm Eastern European Time, and there are a few commits where the timezone was set to UTC+2 instead of UTC+8.

load more comments (9 replies)
[–] [email protected] 6 points 7 months ago* (last edited 7 months ago)

According to this post, the person involved exposed a different name at one point.

https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Cheong is not a Pingyin name. It uses Romanization instead. Assuming that this isn't a false trail (unlikely, why would you expose a fake name once instead of using it all the time?) that cuts out China (Mainland) and Singapore which use the Pingyin system. Or somebody has a time machine and grabbed this guy before 1956.

Likely sources of the name would be a country/Chinese administrative zone that uses Chinese and Romanization. Which gives us Taiwan, Macau, or Hong Kong, all of which are in GMT+8. Note that two of these are technically under PRC control.

Realistically I feel this is just a rogue attacker instead of a nation state. The probability of China 1. Hiring someone from these specific regions 2. Exposing a non-pinying full name once on purpose is extremely low. Why bother with this when you have plenty of graduates from Tsinghua in Beijing? Especially after so many people desperate for jobs after COVID.

[–] [email protected] 4 points 7 months ago

Unrelated, I really like the idea that the author of that blog post to place the favicon near each link

[–] [email protected] 38 points 7 months ago (1 children)

Yeah, what if they go blue next?

(It's rogue not rouge)

load more comments (1 replies)
[–] [email protected] 12 points 7 months ago (3 children)

I'm kinda hoping it was just that a state sponsored attacker showed up on their door and said "include this snippet or else..." otherwise it's terrifying thinking of someone planning some long con like this

We are all relying on the honesty of a few overworked volunteers...

load more comments (3 replies)
[–] [email protected] 24 points 7 months ago (1 children)

could this be a nation-state attack? since jiat75 spent multiple years developing a fake persona and it seems like a lot of effort was put into this

load more comments (1 replies)
[–] [email protected] 23 points 7 months ago (2 children)

I'm on Void, and I had the malicious version installed. Updating the system downgraded xz to 5.4.6, so it seems they are on it. I'll be watching discussions to decide if my system might still be compromised.

[–] [email protected] 1 points 7 months ago (2 children)

Did you have SSH open to the internet?

[–] [email protected] 2 points 7 months ago

No, this is just my personal laptop. I don't even have access to an IP address I could enable port-forwarding on.

load more comments (1 replies)
load more comments (1 replies)
[–] [email protected] 14 points 7 months ago (4 children)

What is the name of the software that is affected??

[–] [email protected] 14 points 7 months ago (1 children)

xz is the compromised package, but it in turn compromises ssh authentication

[–] [email protected] 19 points 7 months ago* (last edited 7 months ago) (2 children)

In turn it ~~compromises ssh authentication~~ allows remote code execution via system(); if the connecting SSH certificate contains the backdoor key. No user account required. Nothing logged anywhere you'd expect. Full root code execution.

https://news.ycombinator.com/item?id=39877312

There is also a killswitch hard-coded into it, so it doesn't affect machines of whatever state actor developed it.

https://news.ycombinator.com/item?id=39881018

It's pretty clear this is a state actor, targeting a dependency of one of the most widely used system control software on Linux systems. There are likely tens or hundreds of other actors doing the exact same thing. This one was detected purely by chance, as it wasn't even in the code for ssh.

If people ever wonder how cyber warfare could potentially cause a massive blackout and communications system interruption - this is how.

load more comments (2 replies)
load more comments (2 replies)
[–] [email protected] 12 points 7 months ago (2 children)

some people in my mastodon feed are suggesting that the backdoor might have connected out to malicious infrastructure or substituted its own SSH host keys, but I can't find any clear confirmation. More info as the investigation progresses.

I guess at this point if you're on Fedora 40 or rawhide clear / regen your host keys, even after xz version rollback

[–] [email protected] 9 points 7 months ago (1 children)

or substituted its own SSH host keys,

why would the backdoor do that? It would immediately expose itself because every ssh client on the planet warns about changed host keys when connecting.

[–] [email protected] 3 points 7 months ago* (last edited 7 months ago)

Perhaps it was a poorly worded way of suggesting that invalidating host keys would invalidate all client keys it could potentially generate? Either way it's a lot of speculation.

Resetting the keys and SSH config on any potentially compromised host is probably not a terrible idea

[–] [email protected] 2 points 7 months ago (1 children)

If you are on a affected system I would nuke from orbit.

[–] [email protected] 4 points 7 months ago (1 children)

Nuke from orbit might be an overreaction, if you need that machine perhaps disable ssh or turn the machine off until later next week when the postmortems happen. If you need that trusted machine now, then yes fresh install

[–] [email protected] 2 points 7 months ago (1 children)

Honestly doing a fresh install is a good test of your recovery abilities. You should always have a way to restore critical content in an emergency

load more comments (1 replies)
[–] [email protected] 8 points 7 months ago

I am looking at these gaggle of posts and all of lemmy is flooded with this and then think that there is an entire Spyware OS on the other side... Which who knows what code it runs and people are chill about it. I am so thankful for this community.

[–] [email protected] 6 points 7 months ago (1 children)

Makes you wonder how many of these are out there that have not been found?

load more comments (1 replies)
[–] [email protected] 5 points 7 months ago

Using the F40 preview with KDE and a regular update from Discover rolled xz back to the known good version 5.4.6

[–] [email protected] 5 points 7 months ago (1 children)

Damn, I had a malicious version installed on my Arch machine. I've since done a system update which removes the backdoor, but looking more into it, it does seem that only fedora and debian(?) are affected/targeted but better safe than sorry.

[–] [email protected] 1 points 7 months ago

I guess this is one of those instances where Manjaro holding back packages makes it more secure than Arch, not less.

[–] [email protected] 4 points 7 months ago* (last edited 7 months ago)

So far I was affected on termux. There is already package update.

[–] [email protected] 4 points 7 months ago

Well, there's also malicious code in the proprietary binary blobs of the drivers and those run with kernel privilege. At least that one we see what it does.

[–] [email protected] 3 points 7 months ago (1 children)

And the one main issue with FOSS rears its ugly head – freedom of contribution also means freedom of bad contributions.

[–] [email protected] 4 points 7 months ago

This happens in close source software too. You just don't find out about it until it gets bad enough.

load more comments
view more: next ›