-
Notifications
You must be signed in to change notification settings - Fork 122
Commit
- Loading branch information
There are no files selected for viewing
93 comments
on commit cf44e4b
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is stuxnet-levels of subtle.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The current project members are Lasse Collin and Jia Tan. Jia became a co-maintainer for the XZ projects in 2022.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
It looks like the author did another "fixes" for these "test" files and was openly discussing these commits. See openwall analysis for details.
Subsequently the injected code (more about that below) caused valgrind errors
and crashes in some configurations, due the stack layout differing from what
the backdoor was expecting. These issues were attempted to be worked around
in 5.6.1:For which the exploit code was then adjusted:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
I would like to think that if someone compromised my keys and then went around pushing commits to projects I was very publicly identified as maintaining, and raising PRs in other projects, it might take me less than [checks calendar] 5 weeks to notice.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It might be possible that government actors forced the author to perform these things. I'm not sure where is he from though.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
I would like to think that if someone compromised my keys and then went around pushing commits to projects I was very publicly identified as maintaining, and raising PRs in other projects, it might take me less than [checks calendar] 5 weeks to notice.
This was quite a subtle attack though.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
I would like to think that if someone compromised my keys and then went around pushing commits to projects I was very publicly identified as maintaining, and raising PRs in other projects, it might take me less than [checks calendar] 5 weeks to notice.
yeah true
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
It looks like the author did another "fixes" for these "test" files and was openly discussing these commits. See openwall analysis for details.
Subsequently the injected code (more about that below) caused valgrind errors
and crashes in some configurations, due the stack layout differing from what
the backdoor was expecting. These issues were attempted to be worked around
in 5.6.1:
e5faaeb
72d2933
82ecc53
For which the exploit code was then adjusted:
6e63681
Man what a way to sneak this in 💀
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
It looks like the author did another "fixes" for these "test" files and was openly discussing these commits. See openwall analysis for details.
Subsequently the injected code (more about that below) caused valgrind errors
and crashes in some configurations, due the stack layout differing from what
the backdoor was expecting. These issues were attempted to be worked around
in 5.6.1:
e5faaeb
72d2933
82ecc53
For which the exploit code was then adjusted:
6e63681Man what a way to sneak this in 💀
Indeed. Next level sneaky. I suppose even if it is guarded against in a 5.6.2 patch, there is now a point of entry and compromise whereby others will now try these sneaky tricks to backdoor or elevate privilege. I would think it will require more than XZ to be patched against this attack vector.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm just commenting to keep updated regarding this incident..
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Very good test files :)
Indeed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm just commenting to keep updated regarding this incident..
Use the Subscribe
button at the bottom instead
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Someone should investigate JiaT75's other recent commits to other repositories ASAP.
Jia is the co-maintainer of xz project, since 2022 and second largest contributor in here.
It's very unlikely anyone can sort good and bad ones here, this is quite a trick they did...and seems they did this intentionally...and that's indeed sad to see.
Links:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Leaving the link here, for whoever wants to check the system with the bash script: https://www.openwall.com/lists/oss-security/2024/03/29/4
Probably relevant, was gradually implemented for over a year: https://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1453140-xz-struck-by-malicious-code-that-could-allow-unauthorized-remote-system-access/page7#post1453242
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🚀
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
actor is one_of(🇨🇳 🇰🇵 🇮🇷 🇷🇺)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
actor is one_of(🇨🇳 🇰🇵 🇮🇷 🇷🇺)
racist hate crime 🚨
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The contributor has also made contributions to other interesting projects https://github.com/JiaT75?tab=repositories
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is scary lmao https://www.openwall.com/lists/oss-security/2024/03/29/4 im glad shits open source
Nothing to be glad about. You know what day it is? 29 march. When did the commit happen? Feb 23. More than 1 month ago.
Now look when the comments started appearing here, since 1 hour ago.
you would be "glad" if you caught this Feb 23-24, not March 29.
If it was closed-source you wouldn't know for a lifetime.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The contributor has also made contributions to other interesting projects https://github.com/JiaT75?tab=repositories
libarchive is the one in which he made more contributions apart from xz itself, and it also includes test stuff. Though these are from 3 years ago.
https://github.com/libarchive/libarchive/commits/master/?author=JiaT75
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
All test cases passed, LGTM!
Seriously though, makes you wonder how many other projects have had this happen to them.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi mom!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
look at those cute innocent test files !
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
mmmm delicious binary blobs! my favorite! yum!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Interesting test files you’ve got there
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As @JiaT75 does not sign their commits, we can't really know if the actual owner of this account authored these commits.
Even if they were signed, Git commit signing often uses SSH keys, since many people don't like dealing with GPG. If their SSH key was stolen (which IMO is the likely explanation here), the attacker would have also been able to sign the commits with that key. Even if they're using GPG... If an attacker stole the SSH key, they'd probably be able to steal a GPG key too.
This is assuming the compromise was via a stolen key, rather than this developer themselves doing it.
Edit: Looking further into it, it seems like the committer may be directly involved, rather than this being a stolen key... https://boehs.org/node/everything-i-know-about-the-xz-backdoor
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
someone should run those test files, they look cool
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
they seem to be getting fuzz test reports for the project google/oss-fuzz@c6e3a34
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Larhzu/squashfs-tools@7fb8f31
plougher/squashfs-tools@33e03bd
plougher/squashfs-tools#276
"Larhzu committed 4 days ago"
Add RISC-V filter support
...
The RISC-V filter requires liblzma >= 5.6.0.
...
👀
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is scary lmao https://www.openwall.com/lists/oss-security/2024/03/29/4 im glad shits open source
Nothing to be glad about. You know what day it is? 29 march. When did the commit happen? Feb 23. More than 1 month ago.
Now look when the comments started appearing here, since 1 hour ago.
you would be "glad" if you caught this Feb 23-24, not March 29.
nerd
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm just commenting to keep updated regarding this incident..
Same. This whole project needs an audit from a reasonably-trusted 3rd-party.
@github This repo in distributing malware, it should probably be frozen until a full investigation is performed.
I tried to look into Jia Tan some, but I couldn't find any information about them as a person. Their first commit to xz was early 2022 with 6468f7e. What's weird is that it was a direct commit, not a PR or such, though it does say that it was authored by @JiaT75 but committed by @Larhzu. In fact, all commits are like this up until 8ace358, which is authored and committed by @JiaT75 via #2.
My first thought based on the name was the CCP sticking their hands in things they shouldn't, but given that I couldn't find any info on them as a person, now I'm just left with more questions. Is Jia Tan even a real person? Was this a long-play by some state actor? If so, who? Or was this just one person going rouge with no connections to groups or states, but if that's the case, then why did they do this? Was this always the goal, or did something change?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This almost certainly isn't a stolen key. Committer added a key entry point to .gitignore
so it could be included in the (signed) tarballs without being seen in the repo.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This almost certainly isn't a stolen key. Committer added a key entry point to
.gitignore
so it could be included in the (signed) tarballs without being seen in the repo.
It looks like they also added to .gitignore on libarchive
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi Mr Robertson
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This almost certainly isn't a stolen key. Committer added a key entry point to
.gitignore
so it could be included in the (signed) tarballs without being seen in the repo.
4323bc3It looks like they also added to .gitignore on libarchive
They only added bin/
to .gitignore
, it's a pretty normal addition (binaries shouldn't be committed to Git).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
let's audit all tarballs against their git repositories
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
include me in the screenshots, thanks
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Jezz I hope the author only had it's ssh keys compromised or something and haven't done this intentionally
there's also the possibility of having done intentionally under duress
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like JiaT75 is now suspended, at least from looking at the followers of tukaani-project organization
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The contributor has also made contributions to other interesting projects https://github.com/JiaT75?tab=repositories
Note this view is probably more helpful: https://github.com/search?q=author%3AJiaT75&type=pullrequests
Around 3k commits and 52 PRs to audit?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rugk if you read the first link from https://boehs.org/node/everything-i-know-about-the-xz-backdoor, it might make sense to check more commits.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This commit sucks, do you guys like my cat
I am afraid your cat looks over weight, please refer to this web-page for instructions on how to adequately feed your pet cat.
Otherwise yes the cat is objectively adorable.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Well, this a whole lot of SAD. Opensource community learns something new today
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So it’s all a coincidence?
Nothing special, just another fresh/clean account.
"mvatsyk-lsg
is a new contributor to projects/xz. The PR must be approved by known contributors before it can be merged. The past contributors are: JiaT75
, inferno-chromium, devtty1er, Dor1s, bshastry (unverified)”
“If that's possible, I'd like to put this pull request on hold until the updated fuzzing configuration is merged into the main xz repo”
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cf44e4b#commitcomment-140383192
Its sadly not a question of open source.
Somebody could have done the same thing in a proprietary company and would have probably not been noticed too. And probably for a longer time.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rugk we probably need to have a version that start from 0 again.
It's just not safe to use the previous code. Or we can roll back from 2 years ago. Checking every commit and every PR takes a huge amount of work (tho rewriting too) but with no guarantee. This exploit is serious, and this man is not kidding.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
actor is one_of(🇨🇳 🇰🇵 🇮🇷 🇷🇺)
sultaniman is one_of(🤡 💩 👹)
What a shame to come across garbage like you on GitHub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For anyone wondering, it seems like he was planning this for MONTHS.
google/oss-fuzz#10667
Was in Jully 2023. 9 MONTHS AGO.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this attack is actually genius, considering that it has been unnoticed for over a month. packing your backdoor into test files and applying it during the tests is huge brain. thats why im the bestest developer and never do tests for my projects 😎
I can now finally rest easy knowing I am both a great developer and can respond to people asking about the lack of tests in my projects with "security concerns"!!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sus
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ThioJoe you're a little late to the party.... just like the knowledge in your videos...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lol
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is just crazy .. also the social engineering aspect of it is just nuts
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How to get a backdoor in a proprietary program: Ask the company for a backdoor
How to get a backdoor in a FOSS program: get a false identity, spend years gaining trust of the community, insert your meticulously crafted backdoor, immediately get caught by a dude investigating a 0.5s delay
Source: https://www.reddit.com/r/linux/comments/1btm4dd/comment/kxou767
This comment was marked as spam.
Sorry, something went wrong.
unfunnylaughApr 12, 2024