The attackers want to wiggle in

Topic

New Reply

Alex posted the other day about some issues with specific RedHat distros. But there’s a tad more to the story than just some bad software that was fix
[See the full post at: The attackers want to wiggle in]

Susan Bradley Patch Lady/Prudent patcher

7 users thanked author for this post.

AlexEiffel, Charlie, Steve S., SueW, David F, TechTango, Alex5723

Reply | Quote

Replies

Bottom line the attackers are trying to get into any platform. No one is immune these days. Not even open source.

I think Open Source is more vulnerable to hackers even under ‘thousands’ watchful eyes.

Thanks for ‘Microsoft engineer’ link.

Reply | Quote

Alex5723 wrote:

I think Open Source is more vulnerable to hackers even under ‘thousands’ watchful eyes.

What evidence, other than anecdotal, do you have to support that?

A few quick searches on Mitre’s CVE site…

Total Windows CVEs

Total Linux CVEs

Total Apple CVEs

Total Open Source CVEs

 

1 user thanked author for this post.

windbg

Reply | Quote

Bases on his book, a good documentary on Cliff Stoll, done by WGBH Boston in 1990…

The KGB, the Computer and Me

 

Reply | Quote

OldGuyForum wrote:

What evidence, other than anecdotal, do you have to support that?

CVEs has nothing to do with injecting malicious code into software components.

Reply | Quote

Alex5723 wrote:

CVEs has nothing to do with injecting malicious code into software components.

Are you sure?

CVE for the Red Hat issue…

https://nvd.nist.gov/vuln/detail/CVE-2024-3094

In combination, CVEs show the history of the types of vulnerabilities, including malicious code injection…which provides data to help make an informed opinion.

 

 

 

 

Reply | Quote

Commentary from the Linux world…

https://lwn.net/Articles/967420/

1 user thanked author for this post.

Alex5723

Reply | Quote

Microsoft FAQ and guidance for XZ Utils backdoor

On March 28, 2024 a backdoor was identified in XZ Utils. This vulnerability, CVE-2024-3094 with a CVSS score of 10 is a result of a software supply chain compromise impacting versions 5.6.0 and 5.6.1 of XZ Utils. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recommended organizations to downgrade to a previous non-compromised XZ Utils version. See below details and Microsoft response for this vulnerability…

Guidance on using Microsoft products to assess your exposure to CVE-2024-3094

In the last few days our teams have worked to provide Microsoft customers with enhancements and guidance to assist in detecting software products in your environments which are affected by the vulnerability and a thorough discovery of the impacted devices which have the vulnerable software version installed. Below you will find guidance on how you can use Defender Vulnerability Management, Defender for Cloud and Microsoft Security Exposure Management to start with and we will continue our work and will update this blog with more product updates and guidance…..

Reply | Quote

Only 16/64 security vendors and no sandboxes flagged this file as malicious

trojan.xzbackdoor

https://www.virustotal.com/gui/file/257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc/detection

2 users thanked author for this post.

Cybertooth, windbg

Reply | Quote

From the original article:

“It was a backdoor that nearly entered into all Linux distributions.”

I think that is an overstatement.

Most Linux distros use a periodic release model, where most packages are kept in a given version, or as close as possible, for the duration of time that release is supported. An upstream provider releasing a new version of a given package does not mean all of the distros will immediately push it out to users.

Even when it is time for a given distro to release a new version, it is typical that most or all of the packages with which it is released are not the completely new, up to date versions either. They will be newer than the previous release, but it does not mean they are anything close to the cutting edge, either.

Because of these factors, it can often take considerable time, even in the time frame of years, for a new version of anything to work its way into the PCs of Linux users. This is the case with Red Hat Enterprise Linux, which is much more oriented toward stability (API/ABI and lack of crashing both) than having the newest packages. Rawhide is their most experimental rolling branch, on the appropriately-named bleeding edge, but it is a long way from there to RHEL, Red Hat’s money-making product that is their reason to exist.

I saw that the perpetrator(s) of this crime hid their efforts by having the actual source code clean, so that anyone who inspected it would not find any trace of subterfuge, but the precompiled binary was another story. The miscreant(s) attempted to get distros to use the sabotaged binary blob rather than compiling it themselves. It is quite normal for distros to compile everything from source prior to packaging in the preferred format, and this demonstrates why. No one knows what is in a binary blob.

Most of the distros that pushed out the tainted blob were bleeding-edge rolling distros… Fedora Rawhide, OpenSUSE Tumbleweed, and Debian’s testing (non-release) distros. The lone exception among mainstream distros was Fedora 41, which is a periodic release distro that prides itself on being “cutting edge,” almost a rolling distro in terms of how up to date its packages are at any given time.

It would appear that the pressures of being “cutting edge” mean that the distros don’t always take the time to compile each binary themselves.

The outlier is Kali Linux, a specialized distro based on Debian Testing that is used for penetration testing and for showing off that the individual in question is a ”1337 h4x0r.” This distro is never meant to be used for use as a general purpose OS, and those who do anyway are already ignoring security, as it always runs as root, a huge security risk.

How likely it would be that other distros would distribute the prepackaged (tainted) binary is a good question. From what I know about the distro family I use (Ubuntu), I do not think the compromised code would have ever been pushed. As far as I know, Ubuntu compiled everything themselves that is not in their “restricted” subrepo.

Now that this event has shaken everyone up, it is even less likely that any distro is going to include someone else’s precompiled blobs. The way the bad actors wormed their way in and played the long con to become trusted contributors is going to be on everyone’s mind from here on out.

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

7 users thanked author for this post.

Mothy, AlexEiffel, Alex5723, Cybertooth, SueW, NaNoNyMouse, satrow

Reply | Quote

Ascaris wrote:

How likely it would be that other distros would distribute the prepackaged (tainted) binary is a good question. From what I know about the distro family I use (Ubuntu), I do not think the compromised code would have ever been pushed. As far as I know, Ubuntu compiled everything themselves that is not in their “restricted” subrepo.

Why this delay then?

Ubuntu announcements — Noble Numbat Beta delayed (xz/liblzma security update)

It appears to me that the distributors don’t share your confidence that everything would have been fine even if Microsoft hadn’t noticed.

2 users thanked author for this post.

OldGuyForum, Alex5723

Reply | Quote

b wrote:

Why this delay then?

Debian has delayed as well.

https://fulda.social/@Ganneff/112184975950858403

 

Reply | Quote

This is a demonstration of the principle of abundance of caution.

The version of XZ that was, and still is, slated to be included in 24.04 is the older, non-sabotaged version. Some packages were linked using the tainted version, though, and even though the tainted code is not included in those compiled packages (that would only happen with static linking, and these packages are dynamically linked), and even then only if the tainted XZ binary blob was used rather than the the locally compiled version, the principle of ‘abundance of caution’ dictates that things be rechecked and redone anyway, removing and redoing all packages linked against the tainted version, so that Ubuntu users and customers can be certain that Canonical has taken all possible steps to ensure the product they receive is safe.

This way, even if the source-compiled version of XZ did happen to contain the exploit (it doesn’t, as the attackers have made sure that their attack code cannot be analyzed by keeping it secret… closed-source, in essence), and even if the dynamic linking process did somehow statically link some part of the library, which is not the way it works, customers would still know they are protected.

 

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

3 users thanked author for this post.

Mothy, satrow, Cybertooth

Reply | Quote

Wasn’t the exploit also contained in the source code?

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Priority reason: Results in a backdoor in sshd

The affected version of xz-utils was only in noble-proposed, and was removed before migrating to noble itself. No released versions of Ubuntu were affected by this issue.

https://ubuntu.com/security/CVE-2024-3094

Ubuntu were due to release this today, until notified by Microsoft?

The affected library has been removed from our Ubuntu 24.04 LTS (Noble Numbat) proposed builds.

Reply | Quote

https://www.404media.co/xz-backdoor-bullying-in-open-source-software-is-a-massive-security-vulnerability/

Everyone got lucky there was a Microsoft engineer who had the knowledge and time to question this.   We trust this “check in” process way too much.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

[satrow]

https://www.nytimes.com/2024/04/03/technology/prevent-cyberattack-linux.html

Susan Bradley Patch Lady/Prudent patcher

• This reply was modified 1 year, 1 month ago by satrow. Reason: Cleaner link

4 users thanked author for this post.

SueW, windbg, satrow, RetiredGeek

Reply | Quote

Very scary stuff!

May the Forces of good computing be with you!

RG

PowerShell & VBA Rule!
Computer Specs

Reply | Quote

RetiredGeek wrote:

Very scary stuff!

“Leave the World Behind”, currently on Netflix, is an interesting take on what a cyberattack could do.

Good cast (Julia Roberts, Ethan Hawke, Kevin Bacon, et. al.)

1 user thanked author for this post.

windbg

Reply | Quote

OldGuyForum wrote:

Leave the World Behind

I loved the part where thousands of Tesla cars on autopilot, crash.

Reply | Quote