6 ms·

Story of XZ Backdoor [video]

140 points by Ulf950 7mo ago

forinti 7mo ago
Ireland recently created a Basic Income scheme for artists. Europe should have an equivalent scheme for programmers of important Open Source projects such as this one.
- anarazel 7mo ago
  Just German, not European, but still a start: https://en.wikipedia.org/wiki/Sovereign_Tech_Agency https://en.wikipedia.org/wiki/Sovereign_Tech_Agency
- mc32 7mo ago
  The problem was more than remuneration. It was burnout and mental health issues. They may have been moderated by income but we don’t know. Also today as I understand it much of OSS is done in-house by major companies (red hat, Ubuntu, ibm, Google, etc)
- ufmace 7mo ago
  I don't think it's a money thing really. IIRC the regular XZ creator/maintainer had a regular job and enough money already, and it was more of a burnout thing from dealing with the usual hassles of OSS. Which means what it really needs is to be taken over by an actual business organization, with a team of developers and professional project managers and customer support people etc so no one person gets too burnt out and if anyone does, they have plenty of backup.
coldpie 7mo ago
This is IMO one of the coolest tech stories to ever happen, seriously amazing spycraft & hacking skills, but I haven't been keeping up with new developments from this story since it broke. Last I heard, the best guess at what happened was some state-sponsored actor worked very hard to get this merged, and it was caught luckily at the last minute. But no one had any smoking gun as to who did it or why or who they were targeting. Any new developments since then? Are we still just totally in the dark about what was going on here?
- nerevarthelame 7mo ago
  Still no smoking gun, but possibly Russia. From the video https://youtu.be/aoag03mSuXQ?t=2883 https://youtu.be/aoag03mSuXQ?t=2883: > A lot of the aliases, like Jia Tan, they sound like Asian names, and the published changes are all timestamped in UTC+8, Beijing time. So the signs point to China. And that's why it's probably not China. I mean, why would they make it that obvious? Every other part of the operation has been so meticulous, so cautious. > And they also worked on Chinese New Year, but not on Christmas. And over the years, there were nine changes that fall outside of the Beijing time into UTC+2, which is a time zone that includes Israel and parts of Western Russia. That's why some experts have speculated that this could be the work of APT29, a Russian-state-backed hacker group also known as Cozy Bear. But again, do we know? No, of course we don't know who it is, and we likely will never know.
  - gosub100 7mo ago
    Russians don't celebrate Christmas on the 25th.
    - dijit 7mo ago
      That was also what I took away when watching the video. Russians don't celebrate Christmas on the 25th (they Celebrate on January 7th), but even more than that: Russians don't celebrate Christmas the same way we do in the west. Their "Christmas" family celebrations are on New Years Eve. So if you're drawing conclusions from them not working on the 25th (which is a literal normal day in eastern europe) then signs point elsewhere unfortunately.
      - siddbudd 7mo ago
        ah, Eastern Europe is a homogeneous slop, good to know. The 25th is only celebrated as a national holiday in like 90% of Eastern European countries. Russia and Serbia celebrate it on January 7th instead, and even that is only due to their use of the old Julian calendar. But sure, normal day in a very narrow and obscure definition of Eastern Europe.
mbauman 7mo ago
I'm still floored that Andres both found this and didn't ignore it. It's such a testament to an incredible engineer. (But also, my conspiratorially-inclined mind is quite entertained by the thought of some sort of parallel construction or tip from a TLA.)
- wasting_time 7mo ago
  With the enormous budgets we allocate in the name of "national security", this is exactly the kind of work I expect TLAs to do. Instead we have come to expect them to cowardly sit on exploits, or actively introduce them, rather than working to secure the general public from adversaries. What a mess.
  - alt227 7mo ago
    Wow when you put it like that it really hits hard.
- badocr 7mo ago
  > (But also, my conspiratorially-inclined mind is quite entertained by the thought of some sort of parallel construction or tip from a TLA.) For sure you were/are not alone in this thinking. How fast the whole thing was exposed in decent enough details was... surprising.
II2II 7mo ago
Even though the video is somewhat sensationalized at some points, it is well worth a watch for people who are interested in computers but don't have a background in it. There is a nice mixture of everything from history (e.g. the founding of the FSF) to a clear explanation of a compression algorithm (clear enough that one should be able to implement it). It also makes claims that should make some people stop and think about the industry as a whole (such as Linux being the most important contemporary operating system). I'm not sure if it is HN-crowd type material since it is easy enough information for most of us to dig up, assuming we didn't already know it. Yet it does not simplify things to the point of, "technology is magic."
- gopalv 7mo ago
  > a clear explanation of a compression algorithm The huffman tree, LZ77 and LZMA explanation is truly excellent for how concise the explanation is. The earlier Veritasium video on Markov Chains in itself is linked if you don't know what a markov chain is. I expected Veritasium to tank when it got sold to private equity & Derek went to Australia, but been surprised to see the quality of the long form stuff churned out by Casper, Petr, Henry & Greg.
  - p0w3n3d 7mo ago
    I liked the presentation about paint mixing, however I think this is not impossible to find the missing key paint having the public paint and the message paint, but still, this is really close to what RSA is
    - MzxgckZtNqX5i 7mo ago
      The paint mixing is actually way closer to the idea of the Diffie-Hellman key exchange, more than RSA.
    - misswaterfairy 7mo ago
      I couldn't help but notice it was quite similar to a Numberphile video 8 years earlier... https://youtu.be/NmM9HA2MQGI https://youtu.be/NmM9HA2MQGI
ting0 7mo ago
https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... This is the scariest part to me: > A pull request (https://github.com/jamespfennell/xz/pull/2 https://github.com/jamespfennell/xz/pull/2) to a go library by a 1Password employee is opened asking to upgrade the library to the vulnerable version
- 2OEH8eoCRo0 7mo ago
  People are always trying to bump versions because it's (usually) an easy contribution.
dijit 7mo ago
I actually watched this last night, and while I totally understand that criticism is easy, and making things is hard (and the production quality here is great); I got a weird vibe from the video when it comes to who it is for. The technical explanations are way too complex (even though they're "dumbed down" somewhat with the colour mixing scenario), that anyone who understands those will also know about how dependencies work and how Linux came to be. It feels almost like it's made for people like my mum, but it will lose them almost immediately at the first mention of complex polynomials. The actual weight of the situation kinda lands though, and that's important. It's really difficult to overstate how incredibly lucky we were to catch it, and how sophisticated the attack actually was. I'm really sad that we will genuinely never know who was behind it, and anxious that such things are already in our systems.
- alt227 7mo ago
  My partner who is an accountant, so intelligent but not technical, watched some Veritasium documentaries the other day. Her comment was that she was really impressed that it didnt dumb anything down like normal documentaries do. She was able to follow along more technical stuff than she anticipated, and that made her enjoy it even more. I think we need to give people more credit when it comes to complex or techincal explanations. If people are enjoying the context but dont understand the techincal, they can just gloss over that if they prefer. But I felt this was quite telling at how and why Veritasium is such a popular channel.
- alnwlsn 7mo ago
  Veritasium started out as a physics channel, and they've covered a wide variety of physics, math and science topics. They are never afraid of showing you the math, but one of the things I think they are really good at is not losing the human part of the story even if you can't follow the numbers exactly. At the end of the day it's humans who came up with this stuff in the first place, so it must be possible to understand it. They aren't really a technology channel though, at least as it relates to software/computers, so that's probably why the video starts out with a brief history of Linux.
deleted 7mo ago
[deleted]
amiga386 7mo ago
Lovely video, going into almost everything... ...and yet, zero mention of systemd's recommendation for programs to link in the libsystemd kitchen sink just to call sd_notify() (which should really be its own library) ...and no mention of why systemd felt the need to preemptively load compression libraries, which it only needs to read/write compressed log files, even if you don't read/write log files at all? Again, it's a whole independent subsystem that could be its own library. The video showed that xz was a dependency of OpenSSH. It showed on screen, but never said aloud, that this was only because of systemd. Debian/Redhat's sshd [0] was started with systemd and they added in a call to the sd_notify() helper function (which simply sends a message to the $NOTIFY_SOCKET socket), just to inform systemd of the exact moment sshd is ready. This loads the whole of libsystemd. That loads the whole of liblzma. Since the xz backdoor, OpenSSH no longer uses the sd_notify() function directly, it writes its own code to connect to $NOTIFY_SOCKET. And the sd_notify manpage begrudgingly gives a listing of code you can use to avoid calling it, so if you're an independent program with no connection to systemd, you just want to notify it you've started... you don't need to pull in the libsystemd kitchen sink. As it should've been in the first place. Is the real master hacker Lennart Poettering, for making sure his architectural choices didn't appear in this video? [0]: as an aside, the systemd notification code is only in Debian, Redhat et al because OpenSSH is OpenBSD's fork of Tatu Ylönen's SSH, which went on to become proprietary software. systemd is Linux-only and will never support OpenBSD, so likewise OpenBSD don't include any lines of code in OpenSSH to support systemd. Come to think of it, "BSD" is another thing they don't mention in the script, despite mentioning the AT&T lawsuit (https://en.wikipedia.org/wiki/USL_v._BSDi https://en.wikipedia.org/wiki/USL_v._BSDi)
- dralley 7mo ago
  It did get mentioned - in the context of the upstream change to dynamically load those libraries being a threat to the hack's viability which may have caused "Jia Tan" to rush and accidentally make mistakes in the process.
  - amiga386 7mo ago
    They say "an open-source developer requests to remove the dependency that links xz to OpenSSH" while showing https://github.com/systemd/systemd/pull/31550 https://github.com/systemd/systemd/pull/31550 on screen, zoomed and focused so the word "systemd" does not appear. They never once utter the word "systemd", anywhere in the script... isn't that strange for such a key dependency?
k2enemy 7mo ago
Oxide and Friends also had a great podcast with Andres about the discovery: https://oxide-and-friends.transistor.fm/episodes/discovering-the-xz-backdoor-with-andres-freund https://oxide-and-friends.transistor.fm/episodes/discovering...
TacticalCoder 7mo ago
Something that's puzzling in that XZ backdoor attempt is that the attacker had to hide the evil payload. And he hid it in test files and AIUI it was injected at build time through a modified build script and that went unnoticed (it's a compiled, deployed, version that got caught by someone and raised alarm bell). Why are build scripts not operating in a clean directory, stripping away all test related files? Isn't this something we should begin to consider doing, seen that it's all too easy to put arbitrary things in test files (you can just pretend stuff is "fuzzed" or "random" or "test vectors" and whatnots: there's always going to be room to hide mischief in test files)? Like literally building, but only after having erased all test directories/files/data. Or put it this way: how many backdoors are actually live but wouldn't be if every single build was only done after carefully deleting all the irrelevant files related to tests?
sricharanbattu 7mo ago
I had a question. People are claiming that the spike in time for ssh or the performance degradation is not much. But in the video itself, they show that the actual ssh time was about 100 ms and the new time it took was about 600 ms. It is almost 6 times the actual time. I am expecting the performance of the benchmark to significantly drop with these times. And it should be obvious to see that something was wrong. ( I am taking nothing from Andres here. I think he's a brilliant engineer to actually find the root cause of this himself. He is a hero. I am just pointing that 500 ms is not something obscure time interval).

140 points by Ulf950 7mo ago

Ireland recently created a Basic Income scheme for artists. Europe should have an equivalent scheme for programmers of important Open Source projects such as this one.

anarazel 7mo ago
Just German, not European, but still a start: https://en.wikipedia.org/wiki/Sovereign_Tech_Agency https://en.wikipedia.org/wiki/Sovereign_Tech_Agency
mc32 7mo ago
The problem was more than remuneration. It was burnout and mental health issues. They may have been moderated by income but we don’t know. Also today as I understand it much of OSS is done in-house by major companies (red hat, Ubuntu, ibm, Google, etc)
ufmace 7mo ago
I don't think it's a money thing really. IIRC the regular XZ creator/maintainer had a regular job and enough money already, and it was more of a burnout thing from dealing with the usual hassles of OSS. Which means what it really needs is to be taken over by an actual business organization, with a team of developers and professional project managers and customer support people etc so no one person gets too burnt out and if anyone does, they have plenty of backup.

coldpie 7mo ago

This is IMO one of the coolest tech stories to ever happen, seriously amazing spycraft & hacking skills, but I haven't been keeping up with new developments from this story since it broke. Last I heard, the best guess at what happened was some state-sponsored actor worked very hard to get this merged, and it was caught luckily at the last minute. But no one had any smoking gun as to who did it or why or who they were targeting. Any new developments since then? Are we still just totally in the dark about what was going on here?

nerevarthelame 7mo ago
Still no smoking gun, but possibly Russia. From the video https://youtu.be/aoag03mSuXQ?t=2883 https://youtu.be/aoag03mSuXQ?t=2883: > A lot of the aliases, like Jia Tan, they sound like Asian names, and the published changes are all timestamped in UTC+8, Beijing time. So the signs point to China. And that's why it's probably not China. I mean, why would they make it that obvious? Every other part of the operation has been so meticulous, so cautious. > And they also worked on Chinese New Year, but not on Christmas. And over the years, there were nine changes that fall outside of the Beijing time into UTC+2, which is a time zone that includes Israel and parts of Western Russia. That's why some experts have speculated that this could be the work of APT29, a Russian-state-backed hacker group also known as Cozy Bear. But again, do we know? No, of course we don't know who it is, and we likely will never know.
- gosub100 7mo ago
  Russians don't celebrate Christmas on the 25th.
  - dijit 7mo ago
    That was also what I took away when watching the video. Russians don't celebrate Christmas on the 25th (they Celebrate on January 7th), but even more than that: Russians don't celebrate Christmas the same way we do in the west. Their "Christmas" family celebrations are on New Years Eve. So if you're drawing conclusions from them not working on the 25th (which is a literal normal day in eastern europe) then signs point elsewhere unfortunately.
    - siddbudd 7mo ago
      ah, Eastern Europe is a homogeneous slop, good to know. The 25th is only celebrated as a national holiday in like 90% of Eastern European countries. Russia and Serbia celebrate it on January 7th instead, and even that is only due to their use of the old Julian calendar. But sure, normal day in a very narrow and obscure definition of Eastern Europe.

mbauman 7mo ago

I'm still floored that Andres both found this and didn't ignore it. It's such a testament to an incredible engineer. (But also, my conspiratorially-inclined mind is quite entertained by the thought of some sort of parallel construction or tip from a TLA.)

wasting_time 7mo ago
With the enormous budgets we allocate in the name of "national security", this is exactly the kind of work I expect TLAs to do. Instead we have come to expect them to cowardly sit on exploits, or actively introduce them, rather than working to secure the general public from adversaries. What a mess.
- alt227 7mo ago
  Wow when you put it like that it really hits hard.
badocr 7mo ago
> (But also, my conspiratorially-inclined mind is quite entertained by the thought of some sort of parallel construction or tip from a TLA.) For sure you were/are not alone in this thinking. How fast the whole thing was exposed in decent enough details was... surprising.

II2II 7mo ago

Even though the video is somewhat sensationalized at some points, it is well worth a watch for people who are interested in computers but don't have a background in it. There is a nice mixture of everything from history (e.g. the founding of the FSF) to a clear explanation of a compression algorithm (clear enough that one should be able to implement it). It also makes claims that should make some people stop and think about the industry as a whole (such as Linux being the most important contemporary operating system). I'm not sure if it is HN-crowd type material since it is easy enough information for most of us to dig up, assuming we didn't already know it. Yet it does not simplify things to the point of, "technology is magic."

gopalv 7mo ago
> a clear explanation of a compression algorithm The huffman tree, LZ77 and LZMA explanation is truly excellent for how concise the explanation is. The earlier Veritasium video on Markov Chains in itself is linked if you don't know what a markov chain is. I expected Veritasium to tank when it got sold to private equity & Derek went to Australia, but been surprised to see the quality of the long form stuff churned out by Casper, Petr, Henry & Greg.
- p0w3n3d 7mo ago
  I liked the presentation about paint mixing, however I think this is not impossible to find the missing key paint having the public paint and the message paint, but still, this is really close to what RSA is
  - MzxgckZtNqX5i 7mo ago
    The paint mixing is actually way closer to the idea of the Diffie-Hellman key exchange, more than RSA.
  - misswaterfairy 7mo ago
    I couldn't help but notice it was quite similar to a Numberphile video 8 years earlier... https://youtu.be/NmM9HA2MQGI https://youtu.be/NmM9HA2MQGI

ting0 7mo ago

https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... This is the scariest part to me: > A pull request (https://github.com/jamespfennell/xz/pull/2 https://github.com/jamespfennell/xz/pull/2) to a go library by a 1Password employee is opened asking to upgrade the library to the vulnerable version

2OEH8eoCRo0 7mo ago
People are always trying to bump versions because it's (usually) an easy contribution.

dijit 7mo ago

I actually watched this last night, and while I totally understand that criticism is easy, and making things is hard (and the production quality here is great); I got a weird vibe from the video when it comes to who it is for. The technical explanations are way too complex (even though they're "dumbed down" somewhat with the colour mixing scenario), that anyone who understands those will also know about how dependencies work and how Linux came to be. It feels almost like it's made for people like my mum, but it will lose them almost immediately at the first mention of complex polynomials. The actual weight of the situation kinda lands though, and that's important. It's really difficult to overstate how incredibly lucky we were to catch it, and how sophisticated the attack actually was. I'm really sad that we will genuinely never know who was behind it, and anxious that such things are already in our systems.

alt227 7mo ago
My partner who is an accountant, so intelligent but not technical, watched some Veritasium documentaries the other day. Her comment was that she was really impressed that it didnt dumb anything down like normal documentaries do. She was able to follow along more technical stuff than she anticipated, and that made her enjoy it even more. I think we need to give people more credit when it comes to complex or techincal explanations. If people are enjoying the context but dont understand the techincal, they can just gloss over that if they prefer. But I felt this was quite telling at how and why Veritasium is such a popular channel.
alnwlsn 7mo ago
Veritasium started out as a physics channel, and they've covered a wide variety of physics, math and science topics. They are never afraid of showing you the math, but one of the things I think they are really good at is not losing the human part of the story even if you can't follow the numbers exactly. At the end of the day it's humans who came up with this stuff in the first place, so it must be possible to understand it. They aren't really a technology channel though, at least as it relates to software/computers, so that's probably why the video starts out with a brief history of Linux.

deleted 7mo ago

[deleted]

amiga386 7mo ago

Lovely video, going into almost everything... ...and yet, zero mention of systemd's recommendation for programs to link in the libsystemd kitchen sink just to call sd_notify() (which should really be its own library) ...and no mention of why systemd felt the need to preemptively load compression libraries, which it only needs to read/write compressed log files, even if you don't read/write log files at all? Again, it's a whole independent subsystem that could be its own library. The video showed that xz was a dependency of OpenSSH. It showed on screen, but never said aloud, that this was only because of systemd. Debian/Redhat's sshd [0] was started with systemd and they added in a call to the sd_notify() helper function (which simply sends a message to the $NOTIFY_SOCKET socket), just to inform systemd of the exact moment sshd is ready. This loads the whole of libsystemd. That loads the whole of liblzma. Since the xz backdoor, OpenSSH no longer uses the sd_notify() function directly, it writes its own code to connect to $NOTIFY_SOCKET. And the sd_notify manpage begrudgingly gives a listing of code you can use to avoid calling it, so if you're an independent program with no connection to systemd, you just want to notify it you've started... you don't need to pull in the libsystemd kitchen sink. As it should've been in the first place. Is the real master hacker Lennart Poettering, for making sure his architectural choices didn't appear in this video? [0]: as an aside, the systemd notification code is only in Debian, Redhat et al because OpenSSH is OpenBSD's fork of Tatu Ylönen's SSH, which went on to become proprietary software. systemd is Linux-only and will never support OpenBSD, so likewise OpenBSD don't include any lines of code in OpenSSH to support systemd. Come to think of it, "BSD" is another thing they don't mention in the script, despite mentioning the AT&T lawsuit (https://en.wikipedia.org/wiki/USL_v._BSDi https://en.wikipedia.org/wiki/USL_v._BSDi)

dralley 7mo ago
It did get mentioned - in the context of the upstream change to dynamically load those libraries being a threat to the hack's viability which may have caused "Jia Tan" to rush and accidentally make mistakes in the process.
- amiga386 7mo ago
  They say "an open-source developer requests to remove the dependency that links xz to OpenSSH" while showing https://github.com/systemd/systemd/pull/31550 https://github.com/systemd/systemd/pull/31550 on screen, zoomed and focused so the word "systemd" does not appear. They never once utter the word "systemd", anywhere in the script... isn't that strange for such a key dependency?

k2enemy 7mo ago

Oxide and Friends also had a great podcast with Andres about the discovery: https://oxide-and-friends.transistor.fm/episodes/discovering-the-xz-backdoor-with-andres-freund https://oxide-and-friends.transistor.fm/episodes/discovering...

TacticalCoder 7mo ago

Something that's puzzling in that XZ backdoor attempt is that the attacker had to hide the evil payload. And he hid it in test files and AIUI it was injected at build time through a modified build script and that went unnoticed (it's a compiled, deployed, version that got caught by someone and raised alarm bell). Why are build scripts not operating in a clean directory, stripping away all test related files? Isn't this something we should begin to consider doing, seen that it's all too easy to put arbitrary things in test files (you can just pretend stuff is "fuzzed" or "random" or "test vectors" and whatnots: there's always going to be room to hide mischief in test files)? Like literally building, but only after having erased all test directories/files/data. Or put it this way: how many backdoors are actually live but wouldn't be if every single build was only done after carefully deleting all the irrelevant files related to tests?

sricharanbattu 7mo ago

I had a question. People are claiming that the spike in time for ssh or the performance degradation is not much. But in the video itself, they show that the actual ssh time was about 100 ms and the new time it took was about 600 ms. It is almost 6 times the actual time. I am expecting the performance of the benchmark to significantly drop with these times. And it should be obvious to see that something was wrong. ( I am taking nothing from Andres here. I think he's a brilliant engineer to actually find the root cause of this himself. He is a hero. I am just pointing that 500 ms is not something obscure time interval).