Hacker News Reader

Comment by auiya | Hacker News Reader

It feels like an intelligence shakedown. Nginx has a rather large install base. FSB would love to have an entry point in it I'm sure, or maybe they previously had one and are trying to gain it back?

View on HN

NGinx is owned by F5 Networks [1]. F5 customers could probably open a case and ask what contingency plans are in place.

[1] - https://www.f5.com/company/news/press-releases/f5-completes-...

NGINX still has separate support from F5 Support.

Is their support team in Russia? They may have their hands tied at the moment.

This is what's really concerning. If FSB was able to actually implement something and shell all nginx boxes (and thusly obtain SSL certs, intercept communications, etc..) imagine how much access they'd have.

Then they would definitely advertise it by attacking the company so that the whole world would know about their secret backdoor. Very smart, indeed!

Just thinking about it would have a chilling effect which to the authorities may be better than actual access.

I'm going to switch from nginx to Caddy, so I guess?

Physical access is easier to get than remote access when you have a baton and the intelligence of a cop.

FSB/GRU are more than just thugs with batons, they are professionals who could easily slip in to a building at night and access computers without anyone knowing. Basically the Russian CIA.

GRU have been severely embarrassed quite a few times in the last few years. It does seem that they're much closer to thugs with batons.

On the flip side I feel like nginx has too high of a profile. It'd be better to target some other low level system package or npm/pip module, etc.

that's not going to happen, too many security experts constantly monitoring nginx. That's the beauty of it being a high profile open source project.

Yeah?

https://en.wikipedia.org/wiki/Kleptography

https://en.wikipedia.org/wiki/Heartbleed

https://en.wikipedia.org/wiki/Shellshock_%28software_bug%29

https://www.computerweekly.com/news/252473363/EU-patches-20-...

https://en.wikipedia.org/wiki/Dual_EC_DRBG

"I keep track of these things, Clark. One of us has to."

Just like too many security experts monitoring crypto standards so NIST wouldn’t try to slip in a backdoor?

No, not similar. Crypto is very different.

Conspiracy theories are fun, but no, it doesn’t feel like an intelligence shakedown if you know even a little bit about intelligence shakedowns. Or about backdooring software.

Clandestine ops have an extremely low probability of success using this strategy and nobody who does them is this incompetent. Especially not Russia.

nginx is open source. I tend to use the distribution provided packages which in case of debian are reproducible builds.

(yeah, i know there's a pro version of nginx. never used it)

"It's open source, someone surely is doing regular thorough security audits."

Auditing one of the world's most used pieces of internet facing software that also isn't "a huge codebase"? Yes I do think nginx will be just fine. Security experts are constantly combing through that sort of software looking for holes, as well as AI tools. duh. It ups your brand to find holes.

Counterpoint: https://en.wikipedia.org/wiki/Heartbleed - 2 years is a long time

the thing is: you have to introduce very subtle bugs when the code is open. And if you exploit it in the millions someone is going to notice.

Indeed. If, as suggested, a backdoor is planted by something like a three letter agency they're not going for mass surveillance or "hacking all the things". It's a very valuable asset that you use wisely, maybe even just once if the target is worth being discovered afterwards.

Someone surely is doing regular thorough security audits of nginx, yes. Even at maximal cynicism, discovering a backdoor in its source code would get someone niche fame and a job at Project Zero (or a nice windfall on the black market, I guess).

or maybe or maybe ...

Reply on news.ycombinator.com