Attempted backdoor on ssh

D

dada_dave

Elite Member
Joined
Oct 25, 2022
Posts
3,555

oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise

www.openwall.com

abadidea (@0xabad1dea@infosec.exchange)

so after blearily reading a bunch of blog posts immediately before bed I have come to the conclusion that only one month between the commits and Andres Freund sending what I hope is the most dramatic mailing list post of their career is actually a pretty good turnaround, this could have easily...
infosec.exchange infosec.exchange

Basically someone successfully inserted a backdoor into an upstream tarball for a library ssh relies on and thus compromising any server using Linux. It was discovered thanks to performance regressions and some valgrind errors on some systems.

1711751512924.png


Luckily xz 5.6.0 and 5.6.1 have not yet widely been integrated by linux
distributions, and where they have, mostly in pre-release versions.
Click to expand...
 


Mike Sheward (@SecureOwl@infosec.exchange)

people are saying the xz backdoor is likely the work of a nation state actor, and given that it appears to been slow rolled for a couple of years and immediately became obsolete before it was fully launched - you do have to admit it bears the hallmarks of a government IT project
infosec.exchange infosec.exchange

Gordon Messmer (@gordonmessmer@fosstodon.org)

The least surprising thing about the xz vulnerability is that it happened to a widely used project after a maintainer hand-off. We've seen exactly the same thing repeatedly in npm, pypi, browser extensions, and other code marketplaces. Humans don't last forever. Hand-off is inevitable. And I've...
fosstodon.org fosstodon.org

Small projects create big risks.
Sustainability is a security concern.
Click to expand...
 
Last edited:
If you use homebrew or MacPorts you likely have the 5.6.1 version. For homebrew:
Code: 
brew upgrade

It isn’t likely that your Mac is compromised but xz has been downgraded to 5.4.6 for both brew and MacPorts.

The back door specifically targeted x86-64, Debian, and systemd so it is unlikely that any macOS is targeted but downgrade anyway.
 
jbailey said:
If you use homebrew or MacPorts you likely have the 5.6.1 version. For homebrew:
Code: 
brew upgrade

It isn’t likely that your Mac is compromised but xz has been downgraded to 5.4.6 for both brew and MacPorts.

The back door specifically targeted x86-64, Debian, and systemd so it is unlikely that any macOS is targeted but downgrade anyway.
Click to expand...
Interestingly I had 5.4.5 🤔
 
jbailey said:
I definitely had 5.6.1 with Python3.8 and something else (I forget). You probably haven’t done a brew update in a while.
Click to expand...

I also had 5.4.5.

It looks like 5.6.0 was released on Feb 24th, so it's been about 35 days that the exploit has been in the wild for people on bleeding edge. I'm a bit surprised how quickly Brew picked up the package, to be honest.
 
dada_dave said:


Mike Sheward (@SecureOwl@infosec.exchange)

people are saying the xz backdoor is likely the work of a nation state actor, and given that it appears to been slow rolled for a couple of years and immediately became obsolete before it was fully launched - you do have to admit it bears the hallmarks of a government IT project
infosec.exchange infosec.exchange

Gordon Messmer (@gordonmessmer@fosstodon.org)

The least surprising thing about the xz vulnerability is that it happened to a widely used project after a maintainer hand-off. We've seen exactly the same thing repeatedly in npm, pypi, browser extensions, and other code marketplaces. Humans don't last forever. Hand-off is inevitable. And I've...
fosstodon.org fosstodon.org
Click to expand...

Small projects create big risks.
Sustainability is a security concern.
Click to expand...

More on this aspect of the attack:

robmensching.com

A Microcosm of the interactions in Open Source projects | RobMensching.com

Originally a thread on Twitter about the xz/liblzma vulnerability, when I finished typing it, I realized I had a real world slice of Open Source interaction that deserved more attention.
robmensching.com robmensching.com

It makes for some chilling reading where the attacker took advantage of a maintainer being behind and struggling with mental health issues and then “helpfully” offered the solution of taking over using the usual online gang up to effectively force the original person out.

As the article states, this is so prevalent in open source software that this behavior alone wouldn’t even register as an attack.
 
Last edited:
IIRC, the undocumented thing was the bolts which got left out when the door was reassembled. As in, if they were following good process, all the parts taken off the aircraft should have been labeled and stored such that at the end of the job, they could inventory stored parts and easily see "hey there's some bolts here which weren't ever reinstalled!" Or even just look at the paper trail.
 
mr_roboto said:
IIRC, the undocumented thing was the bolts which got left out when the door was reassembled. As in, if they were following good process, all the parts taken off the aircraft should have been labeled and stored such that at the end of the job, they could inventory stored parts and easily see "hey there's some bolts here which weren't ever reinstalled!" Or even just look at the paper trail.
Click to expand...
Or even a checklist for the repair (which apparently they did a lot), which required someone to take responsibility and initial that each step was completed.
 
Another similar case:

Open Source Security (OpenSSF) and OpenJS Foundations Issue Alert for Social Engineering Takeovers of Open Source Projects – Open Source Security Foundation

openssf.org openssf.org

The recent attempted XZ Utils backdoor (CVE-2024-3094) may not be an isolated incident as evidenced by a similar credible takeover attempt intercepted by the OpenJS Foundation, home to JavaScript projects used by billions of websites worldwide. The Open Source Security (OpenSSF) and OpenJS Foundations are calling all open source maintainers to be alert for social engineering takeover attempts, to recognize the early threat patterns emerging, and to take steps to protect their open source projects.
Click to expand...
 
Back
Top