5 ms·

Funny how Lasse Collin started to ccing himself and Jia Tan from 2024-03-20 (that was a day of tons of xz kernel patches), he never did that before. :) https:/

by gmnon 2y ago

Funny how Lasse Collin started to ccing himself and Jia Tan from 2024-03-20 (that was a day of tons of xz kernel patches), he never did that before. :) https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.collin@tukaani.org/ https://lore.kernel.org/lkml/20240320183846.19475-2-lasse.co...

ncr100 2y ago
Also interesting, to me, how the GMail account for the backdoor contributor ONLY appears in the context of "XZ" discussions. Google their email address. Suggests a kind of focus, to me, and a lack of reality / genuineness.
- fullstop 2y ago
  This also means that Google might know who they are, unless they were careful to hide behind VPN or other such means.
bombcar 2y ago
This is extremely suspicious. It looks like someone may have noticed a unmaintained or lightly maintained project related to various things, and moved to take control of it. Otherwhere in the discussion here someone mentions the domain details changed; if you have control of the domain you have control of all emails associated with it.
deleted 2y ago
[deleted]
ui2RjUen875bfFA 2y ago
those pipe usages are quite suspicious https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/scripts/Makefile.lib?h=next-20240328&id=d86bab34742d0a67aeb76a3070bc90f7433b78e3#n528 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/scripts/Makefile.lib?h=next-20240328&id=d86bab34742d0a67aeb76a3070bc90f7433b78e3#n531 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... pipeing into this shell script which now uses "eval" https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/scripts/xz_wrap.sh?h=next-20240328#n36 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... i guess this will be revisited and removed soon
- Hackbraten 2y ago
  > pipeing into this shell script which now uses "eval" I don’t actually see an issue with that `eval`. Why would one consider running `xz` followed by `eval`-ing its output more insecure than just running `xz`? If `xz` wants to do shenanigans with the privileges it already has, then it wouldn’t need `eval`’s help for that.
  - Bulat_Ziganshin 2y ago
    because in order to put backdoor into xz executable, you need to infect its sources. and in order to infect the sources, you need to use a similar technique to hide the modification
  - ui2RjUen875bfFA 2y ago
    just take a closer look at the analysis https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4 then try to understand the pattern. they backdoored by modifying the build process of packages. now consider the $XZ is also from a backdoored build and the call recognizes in the same way with parameters --robot --version and the shell environment with the hint "xz_wrap.sh" from the piped process. a lot stuff to recognize for the $XZ process that it run as part of a kernel build. Maybe they put advanced stuff in a backdoored $XZ binary to modify the kernel in a similar way they modified lzma based packages in the build process.
bonzini 2y ago
"started to cc himself" seems to be simply "contributing to a new project and not having git-send-email fully set up". By default git-send-email Cc the sender, though in practice it's one of the first options one changes.

by gmnon 2y ago

ncr100 2y ago

Also interesting, to me, how the GMail account for the backdoor contributor ONLY appears in the context of "XZ" discussions. Google their email address. Suggests a kind of focus, to me, and a lack of reality / genuineness.

fullstop 2y ago
This also means that Google might know who they are, unless they were careful to hide behind VPN or other such means.

bombcar 2y ago

This is extremely suspicious. It looks like someone may have noticed a unmaintained or lightly maintained project related to various things, and moved to take control of it. Otherwhere in the discussion here someone mentions the domain details changed; if you have control of the domain you have control of all emails associated with it.

deleted 2y ago

[deleted]

ui2RjUen875bfFA 2y ago

those pipe usages are quite suspicious https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/scripts/Makefile.lib?h=next-20240328&id=d86bab34742d0a67aeb76a3070bc90f7433b78e3#n528 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/scripts/Makefile.lib?h=next-20240328&id=d86bab34742d0a67aeb76a3070bc90f7433b78e3#n531 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... pipeing into this shell script which now uses "eval" https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/scripts/xz_wrap.sh?h=next-20240328#n36 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... i guess this will be revisited and removed soon

Hackbraten 2y ago
> pipeing into this shell script which now uses "eval" I don’t actually see an issue with that `eval`. Why would one consider running `xz` followed by `eval`-ing its output more insecure than just running `xz`? If `xz` wants to do shenanigans with the privileges it already has, then it wouldn’t need `eval`’s help for that.
- Bulat_Ziganshin 2y ago
  because in order to put backdoor into xz executable, you need to infect its sources. and in order to infect the sources, you need to use a similar technique to hide the modification
- ui2RjUen875bfFA 2y ago
  just take a closer look at the analysis https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4 then try to understand the pattern. they backdoored by modifying the build process of packages. now consider the $XZ is also from a backdoored build and the call recognizes in the same way with parameters --robot --version and the shell environment with the hint "xz_wrap.sh" from the piped process. a lot stuff to recognize for the $XZ process that it run as part of a kernel build. Maybe they put advanced stuff in a backdoored $XZ binary to modify the kernel in a similar way they modified lzma based packages in the build process.

bonzini 2y ago

"started to cc himself" seems to be simply "contributing to a new project and not having git-send-email fully set up". By default git-send-email Cc the sender, though in practice it's one of the first options one changes.