#cve20243094 — Public Fediverse posts

Veritasium covers the #xz compromise. This is well done. It starts off explaining open source. It explains encryption and compression. It explains software dependencies. It explains how the back door would have worked. Good watch.

#Backdoor #Veritasium #CVE #CVE20243094
https://youtu.be/aoag03mSuXQ

Auch wenn im aktuellen Fall nicht von Vorsatz auszugehen ist, lässt das erneute Auftreten einer
Schwachstelle mit CVSS >8 (die dritte in 3 Jahren) Zweifel an der Qualitätskontrolle innerhalb des XZ-Projektes aufkommen. Dabei ist zu berücksichtigen, dass diese ubiquitäre Softwarekomponente im Wesentlichen von einem einzelnen Maintainer in seiner Freizeit gepflegt wird. Die verfügbaren
personellen Ressourcen stehen damit in keinem Verhältnis zur hohen Verbreitung der Bibliothek. Dies trifft auf eine große Anzahl von Open-Source-Software-Komponenten zu, die oft auch in proprietärer Software integriert sind, ohne hier offensichtlich zu werden. Zudem handelt es sich dabei um einen sehr frühen Punkt in der Lieferkette einer Softwarekomponente, die extrem weit verbreitet ist.

Hersteller von umsatzstarken Produkten bzw. Dienstangeboten teilen oftmals auch nicht die Erlöse
mit den bzw. mit allen im Unterbau genutzten Software-Projekten. Durch derartige Projekte sind im Laufe der letzten 30 Jahre eine Vielzahl an höchst wertvollen Software-Gütern entstanden, von denen das Funktionieren der heutigen IT-Welt abhängig ist, die jedoch trotz ihrer wirtschaftlichen Verwertung nicht ansatzweise mit Ressourcen ausgestattet wurden, die der damit erzielten Wertschöpfung entspricht. Perspektivisch sollte diesem strukturellen Problem mehr Aufmerksamkeit geschenkt werden.

Allen, die noch Windows 10 nutzen, empfiehlt das Bundesamt für Sicherheit in der Informationstechnik (BSI), ein Upgrade durchzuführen bzw. auf ein anderes Betriebssystem umzusteigen. Das können etwa Windows 11, ein Unix-basiertes Betriebssystem wie macOS oder ein Linux-basiertes Betriebssystem sein.

Neues Video von #Simplicissimus: „Eine Gruppe Hacker hätte sich beinahe Zugang zu Millionen von Servern auf der ganzen Welt verschafft. Doch ein deutscher Software-Entwickler hat ihnen einen Strich durch die Rechnung gemacht.“
https://www.youtube.com/watch?v=8p8PHeGg--U
Hintergrund: https://de.wikipedia.org/wiki/CVE-2024-3094
#xz #linux #opensource #quelloffen #backdoor #github #CVE20243094 #ssh

#XZUtils 5.6.2 (stable) has been released (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression / #CVE / #CVE20243094) https://tukaani.org/xz/

@jrt @ph0lk3r @hisolutions @HonkHase

Vielen Dank für den Aufschrieb. Ich hoffe, dass jemand aus dieser Vorlage einen Krimi macht.

Hättet ihr Lust, das als szenische Lesung oder (Socken-)Puppentheater beim #38c3 aufzuführen?

#CVE20243094 #xz #liblzma #Hintertür

The xz Issue Isn’t About Open Source | The Changelog

https://changelog.complete.org/archives/10642-the-xz-issue-isnt-about-open-source
#rr #xz #cve20243094 #OpenSource

Putting an xz Backdoor Payload in a Valid RSA Key | rya.nc

https://rya.nc/xz-valid-n.html

#xz #cve20243094 #security #backdoor #rsa #ssh #rr

nice demo and explanation of #xz #liblzma #ssh #exploit #backdoor #CVE20243094
https://www.youtube.com/watch?v=vV_WdTBbww4

What we know about the xz Utils backdoor that almost infected the world

#security #cve20243094 #devops
https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/

[Announcement] "Xz/liblzma security update (post #2)" from the Ubuntu developers regarding #cve20243094

https://discourse.ubuntu.com/t/xz-liblzma-security-update-post-2/43801?u=popey

#ubuntu #linux #xz

Critical XZ Utils Backdoor (CVE-2024-3094) Leads to SSH Compromise https://thecyberexpress.com/xz-utils-backdoor-cve-2024-3094/ #remotecodeexecution #TheCyberExpressNews #SSHauthentication #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE20243094 #XZUtils

This really was a well thought out supply chain attack. Jia Tan submitted a PR for OSS-Fuzz back in July 2023 to intentionally ignore the IFUNC feature which is used (maliciously) to perform runtime hooking/redirection of OpenSSH's authentication routines.
#cve20243094 https://www.reversinglabs.com/blog/a-software-supply-chain-meltdown-what-we-know-about-xz-trojan

Perhaps the long con is an even longer con in which an attacker attempts to drive many #infosec people into burnouts over time by hiding malware in packages that are then discovered just before holiday weekends.

#xz #xzbackdoor #xzorcist #cve20243094

Security Week 2414: последствия взлома xz-utils

История со взломом набора утилит xz-utils, несомненно, войдет в категорию легендарных событий в сфере информационной безопасности. Эта тщательно спланированная атака на цепочку поставок была в шаге от полного успеха. Могла быть реализована ситуация, когда десятки и сотни тысяч систем на базе Linux имеют в своем коде скрытый бэкдор, задействуемый организаторами атаки с помощью известного им приватного ключа. Поражает как сложность самой атаки, так и неординарная история обнаружения бэкдора. Последнее все же заставляет надеяться, что сообщество разработчиков открытого ПО найдет средства противодействия подобным атакам в будущем. Таймлайн атаки достаточно подробно описан на Хабре здесь (еще одна обновляемая статья — тут ), подверженные дистрибутивы приведены здесь , в этой статье мы постараемся выделить самые важные моменты и попробуем представить, как это повлияет на разработку ПО с открытым исходным кодом.

https://habr.com/ru/companies/kaspersky/articles/804537/

#xzutils #CVE20243094

Achtung Linux Nutzer: Backdoor in XZ-Tarballs entdeckt - MichlFranken

https://www.michlfranken.de/linux-backdoor-xz-tarballs-entdeckt/

#backdoor #xz #CVE20243094 #Sicherheitslücke

Nice! @amlw wrote a PoC exploit and a honeypot for the xz backdoor.

https://github.com/amlweems/xzbot

#xz #liblzma #cve20243094 #infosec

Put yourself in Jia Tan's shoes, the malicious contributor to the xz backdoor...

It's been, what, two... three?... years since you started this campaign. You've had the entire support of your team and of your chain of command.

Your coders created a complex and sublime backdoor. A secure! backdoor that only you and your team could connect to. Heck it can even be deleted remotely. This is clean code. A responsible hack that doesn't open up the backdoor for others to hijack.

You spend years on your long con - your social engineering skills are at the top of the game. You've ingratiated yourself painstakingly into multiple teams. Finally it all pays off and you're ready to go!

You succeed multiple times in getting your backdoor inserted in all the major Linux distributions!!! Now its just a matter of weeks before it makes it to production and stable releases!

This is the culmination of years of labor and planning and of a massive team and budget.

You did good.

This will get you promoted. Esteemed by your colleagues and leadership alike. Your spouse and kids will understsnd why you haven't been at home lately and why you've spent all those late nights at the office.

It's finally going to pay off.

But what's this?! Some rando poking around in their box running a pre-release unstable version of linux has found everything?!?! It's all being ripped down?! And on a Friday before a western holiday weekend?!?!

Fuck. Fuck. FUCK!!!

Three years for nothing!!! My wife is going to leave me! I missed my kid's recital for this!!! They'll hate me because I told them it was worth it. Daddy will be able to play with you again once Daddy finishes this last bit of work. But it was all for nothing!!!

Leadership took a big risk on me and my team but I kept assuring them it would pay off!

It would be one thing if another nation state found it and stopped it. But one random dude poking his nose where it shouldn't belong?! Ohhh fuck, I'm going to be fired. We're going to lose our budget. My team is going to be fired. I've let down everyone that ever believed in me and supported me and relied on me!

Oh fuck!!!

#xz #backdoor #xzBackDoor #cve #cve20243094 #infosec #hacking #FOSS

#JustInCase I have mirrored @thesamesam gist at https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 (the xz backdoor/exploit FAQ) locally and on https://codeberg.org/jwildeboer/gists/src/branch/main/20240401CVE20243094FAQMirror.md Will setup some sort of automatic update script later. I don't think Github will somehow interfere with this FAQ, but hey, better safe than sorry and stuff :)

This is just a FYI. Please do NOT use my manual mirror of the FAQ and bookmark ONLY the original source.

#CVE20243094 #xz #liblzma #backdoor

Advice to the entire IT industry: Andres Freund needs to get very very rich.
The only resource large enough, skilled enough or obsessive enough to prevent many (MANY) more of these is The Crowd, as in “crowd-sourcing”.
How do you motivate all the nerds on earth to scour every significant code-base obsessively, forever?
Bug bounties. You fucking pay them.
How much? A small % of what they just saved you.
The xz backdoor could have cost the world billions or trillions.
#CVE20243094 #xzbackdoor #xz

Hello #Forgejo admins,

We've published a post regarding the impact of the xz backdoor (CVE-2024-3094) on the Forgejo project.
https://forgejo.org/2024-03-xz/

#xz #cve20243094

Wünsche Euch frohe Feiertage, ohne solche faulen Eier :blobcatpolicepeek:

Damit keine Panik ausbricht, Der #xzorcist getaufte #cve20243094 der Versionen xz 5.6.x erlaubt ssh RCE über den RSA Key 😰

ABER

"In stabile Debian- oder Ubuntu-Versionen hat die Hintertür es nicht geschafft, ...
Der macOS-Paketmanager Homebrew hingegen ist nicht direkt betroffen."

Termux/Gentoo Pakete bitte updaten.

https://social.heise.de/@heisec/112186774018632515

#xz #xzbackdoor #supplychainattack #xz4shell #infosec #cybersecurity

There's A LOT going on (analysis, discussion, vendor notices, etc...) related to the ongoing xz/liblzma compromise so I created a "link roundup" which centralizes and buckets a lot of the awesome links and threads I've seen flying around.

https://shellsharks.com/xz-compromise-link-roundup

I will *try* to keep this up-to-date (ish) for a few days while things are hot but I make no promises beyond that.

#cve20243094 #xz #xzbackdoor #xzorcist #supplychainattack #xz4shell #infosec #cybersecurity

@argv_minus_one

Compliance Officers: „Maintainer, who does not owe me anything, I need you to fill out this form and take responsibility!“

Salespeople: „My product solves this and any other problem in cybersecurity. With a premium sub you can also end world hunger.“

LinkedIn Influencers: „The end is nigh! This time I’m sure!“

#xzbackdoor #xz #xzorcist #cve20243094

Code review
Difficulty: Where’s Wally

#CVE-2024-3094

RE: https://social.lansky.name/users/hn50/statuses/112187041808317429

xz backdoor

Some distro-specific news links:

@archlinux - https://archlinux.org/news/the-xz-package-has-been-backdoored/

@debian - https://micronews.debian.org/2024/1711830544.html

#openwrt - https://forum.openwrt.org/t/project-statement-about-xz-5-6-1-cve-2024-3094/193250

@fedora - https://fedoramagazine.org/cve-2024-3094-security-alert-f40-rawhide/

@opensuse - https://news.opensuse.org/2024/03/29/xz-backdoor/

Missed a distro? Reply and add yours.

#CVE20243094 #backdoor #security #Vulnerability #SSH #archlinux #debian #fedora #opensuse

CVE-2024-3094 - xz/liblzma backdoor starting with version 5.6.0

All servers have already been updated and tested. Everything is fine.

If you wanna read a bit more:
https://techsaviours.org/news/en/cve-2024-3094-xz-backdoor-starting-with-version-5-6-0

#CVE20243094 #backdoor #security #Vulnerability #SSH

I wrote a post on the xz backdoor. No backdoor analysis, just considerations on what went wrong.

#cve20243094 #xz

https://appsec.space/posts/xz-backdoor

Some thoughts and speculation of the #liblzma #backdoor
• This smells of highly skilled nation state operator.
• The likely plan was to include this to as many places as possible as an asset to be used only in surgical operations to avoid burning it, or potentially it could have been used to gain foothold in specific high value targets to be compromised / backdoored further.
• It is likely that the project is now abandoned since it was discovered early. Now that people know what to look for it would be way too risky to draw attention by attempting exploitation.
• This is unlikely to be the only instance. There are more, we just haven't found out about them (yet).
#cve20243094 #infosec #cybersecurity

Preliminary results from #liblzma SSH #backdoor CVE-2024-3094 reversing:
"The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable." https://www.openwall.com/lists/oss-security/2024/03/30/36 #infosec #cybersecurity #CVE20243094

many Russian & Chinese names seen as maintainers or key commiter atributations of xz & liblzma:

Larhzu (username of "Lasse Collin")
Jia Tan
Chan Tsune
Wei Dai

Sergey Kosukhin
Igor Pavlov
Ilya Kurdyukov
Dimitri Papadopoulos

DISCLAIMER: This is NOT exhaustive search, just quick. And having one's name in this list does NOT imply guilt or malfeasance, and its possible its all an innocent coincidence! But given what we know about Chin & Rus gov backed hacking/infiltration attempts...

#cve20243094

The whole xz story makes me think of what other backdoors we have missed. Just think of some malicious code in popular packages just chilling there, undetected...

#cve20243094

sysadmins, Sec/Ops, infra FOSS maintainers, cloud IaaS SREs, CSO/CIOs, xz/liblzma devs (not named Jia Tan): WORST EASTER WEEKEND EVER

reverse engineers, red team analysts, crypto geeks: BEST EASTER WEEKEND EVER

#cve20243094
#xz
#lzma
#liblzma
#backdoor
#openssh

And again, it pays off that we never patch! The supply chain can't attack you if you don't use what it supplies!

#cve20243094 #xz #xzbackdoor #shitpost

Lasse Collin, original author of #Xz, replied on #LKML: https://lore.kernel.org/lkml/20240330144848.102a1e8c@kaneli/

"'"[…] I'm on a holiday and only happened to look at my emails and it seems to be a major mess.

My proper investigation efforts likely start in the first days of April. That is, I currently know only a few facts which alone are bad enough.

Info will be updated here: https://tukaani.org/xz-backdoor/"'"

#CVE20243094 #Linux #kernel #LinuxKernel #Backdoor

@anthropy

Or they issue an NSL to Microsoft (or whomever) to add a backdoor to any closed source product.

See also Apple iPhone hardware backdoors.

This could be a government project or it could be a long play by a small group for their own ends.

How much important information or resources are controled by Linux?

What would that be worth if you had theoretically unrestricted access to it?

#XZ #InfoSec #Linux #CVE20243094 #AssBleed

TR-82 - backdoor discovered in xz-utils - CVE-2024-3094

🔗 For more information including detection and information about vulnerable distribution https://www.circl.lu/pub/tr-82/

#xz #vulnerability #infosec #backdoor #vulnerabilities #cve20243094

Gerade meine Systeme mit dem Script

https://github.com/cyclone-github/scripts/blob/main/xz_cve-2024-3094-detect.sh

geprüft. Fazit: ein betroffenes System gefunden und auch gleich gefixt.

#xz
#cve20243094
#CVE

Warning, #XZUtils 5.6.0 has a #backdoor (#xz / #LZMAUtils / #LZMA / #LZMA2 / #DataCompression), please revert quickly! #CVE20243094 (CVE-2024-3094) https://www.openwall.com/lists/oss-security/2024/03/29/4