Millions of eyeballs, but it still gets a commit
https://www.theregister.com/2024/03/29/malicious_backdoor_xz/

Millions of eyeballs, but it still gets a commit
Malicious SSH backdoor sneaks into xz, Linux world's data compression library

Wow... Thanks for that one.

That is one devious piece of obfuscation, aided and abetted by some incomplete security on the GitHub sources repository, and enabled by the overly obscure all-encompassing mess that is Systemd...

... Unfortunately, Systemd is here to linger on, just like Microsoft Windows...

Note the good comment here about the unusual dependencies that compromised Systemd with the xz library. Notably, non-Systemd systems are not workably compromised in that the xz backdoor remains inert.

This example will tighten the security of the source code repository for xz, and hopefully also prompt a check for the configs controlling other repositories.


So, the eyeballs did indeed stumble across this one. But in far faster time than certain other proprietary systems suffer!

Happy secure computing!!
Martin


ps: I can stay smug:

1: I avoid the use of the unhealthy mess that is Systemd;
2: My system is using the xzlibs 5.4.2;
3: The later releases are disabled, see the following note...

Newer releases were signed by a potentially compromised upstream maintainer. There is no evidence that these releases contain malicious code, but masked out of an abundance of caution. See bug #928134.

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

What a move!

Seeing is believing:


Linus Tech Tips - It’s Time to Downsize - New Studio Tour


Also, full geek-out kudos for being a world first with Kiribati...


Enjoy this time of year!!
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Is privacy Dead?
https://phys.org/news/2024-04-breakthrough-prime-theory-primes.html

Is privacy Dead?
https://phys.org/news/2024-04-breakthrough-prime-theory-primes.html

Integer factorization and thus RSA will be weakened eventually. I don't see where this simplifies solving discrete logarithms (DH, ECC). Privacy can (still?) be maintained.

There's already research on post-quantum cryptography, which assumes that at some point there will be usable, powerful quantum computers, so that integer factorization and discrete logarithms (e.g. eliptic curves) will no longer be a hard problem.

All change again:


German state ditches Windows, Microsoft Office for Linux and LibreOffice
wrote:

'Complete digital sovereignty' ... sounds familiar...

... starting its switch from Microsoft Office to LibreOffice, and is planning to move from Windows to Linux on the 30,000 PCs it uses for local government functions...

... "LiMux started in 2004 and reached its peak in 2013, before coming to a halt as decisions about its future were made. Linux and LibreOffice have matured significantly since then, with the latter having way more commercial support options, huge Microsoft Office compatibility improvements, and a tabbed user interface to ease transition.

"LiMux faced some technical challenges at first, but by 2017 Karl-Heinz Schneider (the head of IT services) said: 'We are not aware of any large technical problems with LiMux and LibreOffice ... We don't see any urgent technical reasons to return to Windows and Microsoft Office'."

Haven't we heard this before though?...

... While this might not bode well for Schleswig-Holstein, its strategy seems substantially different. Both Munich and Lower Saxony never fully transitioned to Linux, which created the compatibility issues that encouraged both governments to go back to Windows...

... "the reasons for switching to Linux and LibreOffice are different today. Back when LiMux started, it was mostly seen as a way to save money. Now the focus is far more on data protection, privacy and security...

Interesting freedoms loving times!

IT is very much what we make it...
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Well it finally came out. There were only 4 eyeballs and half of them belonged to the bad actor.

Of all the places to inject, the makefile!

Is that all that stands between open source and open terror?

One has to wonder now, is this the first attempt for this kind of vector or only the first time it has been spotted?

And why is Micto$oft the security force for Linux?

What details have you seen?


The reports I'm following show this attempted exploit to be very determinedly to have taken YEARS to incrementally place the pieces together, for some fantastic obfuscation, to then be undone by the keen eye of a tester who happens to work for Microsoft.

His keen eye was on the test results of some automated performance testing. The rest is his time and diligence in following up the unexpected test results. (Don't know if his time was paid or not.)

The live exploit never got beyond testing.


So...

Yes, a close call that could have been oh so different...


There's a lot of questions there for the consequences for all the software we depend upon...

Commercial pressure in the present form of commercial profitable haste doesn't help...



IT is what we make it...
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Is this news from Amazon be a warning flag to those who have invested heavily in employing "cloud services" for their company & personal IT services?
https://www.bbc.co.uk/news/business-68729318

Another "victim" of this move looks to be the stores without check-outs (to me these sounded like a shoplifter's paradise).

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Well it finally came out. There were only 4 eyeballs and half of them belonged to the bad actor.

... at least three malign actors (supposedly a government) who started this sophisticated attack years ago (social engineering, gaining trust, convincing people to share responsibility).

Is that all that stands between open source and open terror?

Open Source is not more secure than Closed Source if there is only a single person who maintains a piece of code... who made a good job when he/she was young and had plenty of time for this "hobby". Now one or two decades later with childs, wife, family, job, ... he or she is overworked with being the maintainer of an important open source library. It's surprising that so many billion dollar commercial software businesses crucially depend on a few important open source libraries which are maintained by volunteers without payment. That's not a sustainable company policy. Commercial users of open source software should invest much more in the maintenance and further development of such widely-used libraries and tools.

One has to wonder now, is this the first attempt for this kind of vector or only the first time it has been spotted?

!!!!!!!!!

The only thing which delays such attacks to mainstream enterprise or long term support Linux distributions are conservative policies to only include older, stable versions of apps and libraries, waiting years until including novel ones.

And why is Micto$oft the security force for Linux?

Pure coincidence! A Microsoft engineer found that a newer SSH version (linking to a newer version of the compression library liblzma) takes half a second longer to establish a SSH session and consumes significant more CPU cycles. That surprised him, so he digged for the cause. It was pure coincidence that this sophisticated attack was discovered and that it was a Microsoft employee of all people.

[EDIT to add:] ML1 already explained it (sorry, only read ML1's post later)

What details have you seen?
The reports I'm following show this attempted exploit to be very determinedly to have taken YEARS to incrementally place the pieces together, for some fantastic obfuscation, to then be undone by the keen eye of a tester who happens to work for Microsoft.

https://www.inc.com/reuters/the-cyberattack-stopped-by-a-microsoft-engineer-was-scarier-than-we-realize.html

XZ, a suite of file compression tools packaged into distributions of the Linux operating system, was long maintained by a single author, Lasse Collin.
In recent years, he appeared to be under strain.
In a message posted to a public mailing list in June 2022, Collin said he was dealing with "longterm mental health issues" and hinted that he working privately with a new developer named Jia Tan and that "perhaps he will have a bigger role in the future."

This is a spy agencies wet dream. To simply be given the keys to nearly every data base on the planet. How much would any nation state invest in such an operation? How much time would a nation state invest in such an operation? What is the value to them? More importantly what has every other nation state's spy agencies learned for their next attempt?

Very few understand what an intrusion at the nation state level is versus the far more common criminal level. That is a problem in security.

In the open-source community, the discovery has been sobering. The volunteers who maintain the software that underpins the internet aren't strangers to the idea of little pay or recognition, but the realization that they were now being hunted by well-resourced spies pretending to be Good Samaritans was "incredibly intimidating," said Arasaratnam, of the Open Source Security Foundation.
Government officials are also weighing the implications of the near-miss, which has underlined concerns about how to protect open-source software. Assistant national cyber director Anajana Rajan told Politico that "there's a lot of conversations that we need to have about what we do next "to protect open source code."

BTW 2022 to 2023 isn't plural number of years. And don't forget nation states embed their operatives for decades.

Very few understand what an intrusion at the nation state level is versus the far more common criminal level. That is a problem in security.

If so, then hardened, greatly simplified OS must be mandatory there instead of the latest, comprehensive mainstream Linux flavour with fancy convenience features, or Windows.

In theory secure crypto systems consists of a publicly known algorithm which was widely discussed and evaluated within a global scientific community. Only the non-derivable secret keys should be crucial for confidentiality. I was told by people who know their business that still today governments maintain and further develop their own, national, top secret (closed source) crypto algorithms which are implemented in all kinds of hardware stuff. In theory the strenght of such crypto systems can't compete with the publicly evaluated ones. But it's somehow the concept of a hidden fallback level in case all publicly known crypto systems turn out to be compromised at some point. Eventually governments should pursue similar concepts for their crucial IT systems? Supposedly, too expensive or unworkable.

Government officials are also weighing the implications of the near-miss, which has underlined concerns about how to protect open-source software. Assistant national cyber director Anajana Rajan told Politico that "there's a lot of conversations that we need to have about what we do next "to protect open source code."

There is much to be learned from how the aviation industry specifies, develops, and evaluates software that flies on airplanes. There is an endless set of mandatory rules. The protection of “open source code” could be based on such concepts. You can't protect each component. If you try, it would be prohibitively expensive. But the crucial gears should be protected extremely well independent of costs. That is a concept of criticality levels for sub components within an OS which defines the necessary level of "protection".

The first question would be: Why was secure remote login (SSH) somehow intertwined with data compression (xz, ... liblzma). Security aware design should prevent such dependencies. Example: The old (1977) DES crypto algorithm mixes two functions: data encryption and data integrity (using parts of the key as a checksum). It's modern successor AES only handles encryption, not integrity.

The first question would be: Why was secure remote login (SSH) somehow intertwined with data compression (xz, ... liblzma).

In the old old days of dialup compressing the data sent was necessary.

The question that needs to be answered by every distro is how many packages that are in your distro have two or fewer maintainers?

Or is this attack vector something that is a design fault in the model of FOSS and Github?

... Or is this attack vector something that is a design fault in the model of FOSS and Github?

Nothing amiss with GitHub other than the users using it...


From my lunchtime reading we have this excellent deep-dive summary:


XZ Utils Supply Chain Attack: A Threat Actor Spent Two Years to Implement a Linux Backdoor
wrote:

... compression/decompression algorithms widely used in Unix-based systems, including Linux systems. XZ Utils is used by many operations...

... The backdoor enabled an attacker to execute remote code via an SSH login certificate. Only XZ Utils versions 5.6.0 and 5.6.1 are impacted...

... Freund explained that the discovery of the backdoor in XZ was luck, as it “really required a lot of coincidences.”

... implementation of the backdoor has been a very quiet process that took about two years. In 2021, a developer named Jian Tan, username JiaT75, appeared out of the blue...

... In the months that followed, Tan became increasingly involved in XZ Utils and became co-maintainer of the project. In February 2024, Tan issued commits for versions 5.6.0 and 5.6.1 of XZ Utils, both of which contained the backdoor...

... Finally, several persons responsible for different Linux distributions have been contacted by the attacker to include the backdoored versions of XZ Utils in their own distributions. ... “Very annoying – the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it’s ‘great new features’. We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added)...

... In addition to the highly elaborated social engineering covered previously in this article, the backdoor itself is very complex...

... [VERY sophisticated] “someone put a lot of effort for this to be pretty innocent looking and decently hidden. From binary test files used to store payload, to file carving, substitution ciphers, and an RC4 variant implemented in AWK all done with just standard command line tools. And all this in 3 stages of execution, and with an ‘extension’ system to future-proof things and not have to change the binary test files again.”...

... “this appears to be a meticulously planned, multi-year attack, possibly backed by a state actor. Considering the massive efforts invested and the low prevalence of vulnerable systems we’re seeing, the threat actors responsible must be extremely unhappy right now that their new weapon was discovered before it could be widely deployed.”...

... Thanks to Freund’s discovery, the attack was stopped before being spread on a wider scale...

And a much lighter summary is on:

XZ Utils backdoor
wrote:

... While xz is commonly present in most Linux distributions, the backdoor only targeted Debian- and RPM-based systems running on the x86-64 architecture...

... The backdoor gives an attacker who possesses a specific Ed448 private key remote code execution capabilities on the affected Linux systems. The issue has been assigned a CVSS score of 10.0, the highest possible score...

... Freund noticed that SSH connections were generating an unexpectedly high amount of CPU usage as well as causing errors in Valgrind,[7] a memory debugging tool...

... the campaign to insert the backdoor into the XZ Utils project was a culmination of approximately three years of effort by a user going by the name Jia Tan and the nickname JiaT75 to gain access to a position of trust within the project...

... Some of the suspected sock puppetry characters are Jigar Kumar, krygorin4545, and misoeater91. It is suspected that the names Jia Tan, as well as the supposed code author Hans Jensen (for versions 5.6.0 and 5.6.1) are simply pseudonyms invented by participants of the campaign...

... The backdoor was notable for its level of sophistication and for the fact that the perpetrator practiced a high level of operational security for a long period of time while working to attain a position of trust. American security researcher Dave Aitel has suggested that it fits the pattern attributable to APT29, an advanced persistent threat actor believed to be working on behalf of the Russian SVR. Others[who?] have suggested that it could be any state actor or a non-state actor of considerable resources...

... "this could have been the most widespread and effective backdoor ever planted in any software product", noting that had the backdoor remained undetected, it would have "given its creators a master key to any of the hundreds of millions of computers around the world that run SSH".[24] In addition, the incident also started a discussion regarding the viability of having critical pieces of cyberinfrastructure depend on unpaid volunteers.

Significant. Indeed: World-wide significant.

On a fundamental level, the various FLOSS licenses encourage free use and redistribution.

However... There is no requirement made for financial contribution to keep things working. Hence 'industry' takes a free-of-cost ride?...


IT is what we make it!
Martin


ps: The "an RC4 variant implemented in AWK" is a fantastic piece of obscure obfuscation that is a long way away from where all the eyes will be looking on the source code! AWK is a command-line/script tool that is outside of the source code...

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

... Or is this attack vector something that is a design fault in the model of FOSS and Github?

Nothing amiss with GitHub other than the users using it...

In addition, the incident also started a discussion regarding the viability of having critical pieces of cyberinfrastructure depend on unpaid volunteers.

However... There is no requirement made for financial contribution to keep things working. Hence 'industry' takes a free-of-cost ride?...

Exactly the design fault of GitHub and FOSS.

Neither GitHub or FOSS have any security to prevent bad nation state users from using it. Something tells me this is not the only exploit planted in distros. Because the exploit code had a bug it was detected, Other exploits may not have bugs.

Isn't the entire point of FOSS to hang a bunch of customization on a O/S? Aren't those customization allowed to run with root and even supervisory privilege?
Ask, it is easier for a nation state to search for a chain of bugs to open the door, or is it easier to simply build the door in the first place.

Criminals won't because they have to find a fast way in to feed themselves, nation states draw a salary so years long waits are totally acceptable.

Security is what you allow it to be.

Fantastic!

Fairphone's Fairbuds Are True Wireless Earbuds With Repairable Design, User-Replaceable Batteries


There's also the hint there that they could be used also as hearing aids...

Way to go!

Enjoy!!
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

This shouldn't still be happening:


It's 2024 and Intel silicon is still haunted by data-spilling Spectre
wrote:

Intel CPU cores remain vulnerable to Spectre data-leaking attacks...

... mitigations put in place at the software and silicon level by the x86 giant to thwart Spectre-style exploitation of its processors' speculative execution can be bypassed, allowing malware or rogue users on a vulnerable machine to steal sensitive information – such as passwords and keys...

... AMD and Arm cores are not vulnerable to Native BHI, according to the VU Amsterdam team. AMD has since confirmed this in an advisory...

... Spectre emerged in public in early 2018, along the related Meltdown design blunder, which The Register first reported. Over the years various variants of Spectre have been found, prompting engineers to shore up the security...

IT is what we make it...
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

This shouldn't still be happening:

It's 2024 and Intel silicon is still haunted by data-spilling Spectre
Intel CPU cores remain vulnerable to Spectre data-leaking attacks...

Another Boeing?

To gain the performance users demand, speculative execution was invented.
If you don't guess you don't have a performance increase but you don't spill data.

Should chips come in two flavors? (1) blazing fast but insecure, (2) snail pace but secure.
Which one will you put into your server?

Perhaps a processor flag, speculative mode on/off. Perhaps any time in supervisory mode, no speculation?
The silicon can support it, but it also has to be baked into the O/S and nation states may not want it to happen.

Security is what we allow it to be.

This is a HACKERS DELIGHT waiting for someone to exploit:
Truck-to-truck worm could infect – and disrupt – entire US commercial fleet

Vulnerabilities in common Electronic Logging Devices (ELDs) required in US commercial trucks could be present in over 14 million medium- and heavy-duty rigs, according to boffins at Colorado State University.

In a paper presented at the 2024 Network and Distributed System Security Symposium, associate professor Jeremy Daily and systems engineering graduate students Jake Jepson and Rik Chatterjee demonstrated how ELDs can be accessed over Bluetooth or Wi-Fi connections to take control of a truck, manipulate data, and spread malware between vehicles.

"These findings highlight an urgent need to improve the security posture in ELD systems," the trio wrote [PDF].

This shouldn't still be happening:[quote]It's 2024 and Intel silicon is still haunted by data-spilling Spectre
Intel CPU cores remain vulnerable to Spectre data-leaking attacks...

Intels vision for a post x86 world was the clean IA64 design aka "Itanium". This CPU design was build upon very long instruction words (VLIW) moving the scheduling complexity into the compilers instead of the fancy speculative µOP reordering logic of the contemporary Intel and AMD CPUs. But even with billion dollars investments and ten years of development AMD easily beat IA64 when they proposed their simple AMD64 extension of IA-32 to 64 bit. Intel's expensive Itanium CPUs never achieved to outperform AMD's AMD64 workstation and server CPUs. Intel then copied AMD's approach and developed IA64 and x86_64 in parallel. IA64 was later burried, the largest misinvestment in the history of semiconductors.

To gain the performance users demand, speculative execution was invented.
If you don't guess you don't have a performance increase but you don't spill data.

The referred article claimed AMD isn't affected. AMD uses the same, complex x86_64 instruction set architecture than Intel. So it's possible to build CPUs which don't spill data due to speculative 'mode'. Back then when SPECTRE and Meltdown first occured Linus Torvalds raged on the kernel mailing list when someone classified it a "Bug" because it wasn't a Linux bug but... [list of curses and unpleasant words]. He explained one needs to get past x86 and x86_64.... The future needs to be built on a clean ISA. He was hoping for ARM64.