Deep Dive into XZ Utils Backdoor [video]

From what I have read so far: speculative, at best.

It’s all based on the sophistication, the level of psychological manipulation, years of effort, multiple actors, and a working theory based on commit timings.

Generally speaking, with attacks of this sophistication, if it's not a state-backed APT, it's someone who operates with the unofficial backing of a government to give plausible deniability.

I suppose it could be a few amateurs who took on a passion project, but... it's unlikely.

AIUI?

I've worked on long projects for a while, you can be relatively invisible for a year and let them know you're getting close (meaning a couple months) and the management will freak out and want it yesterday if it's near the end of a quarter and they think it will look good on quarterly reports. I assume the same can happen with government actors and "security companies".

They may have been rushed. Elsewhere itt:

> A patch was ready to be introduced into Linux to prevent this type of attack (dynamically loading unneeded libraries).

I'm not saying it was a bad target. It was a perfect target. How many more would fullfil these criteria? Those would be the type of repositories I'd go and investigate.

For there to be another repository affected by the same attack you don't even need to think this specific attacker did it twice. You can just consider that multiple attackers had the same idea. I think it's way more likely that there's more repositories affected by the same type of attack than not.

I'd go as far as saying this is an issue of national / global security and there's space for an agency like the IMF but for software security that would be funded by all the countries of the world to bring more resources and assuredness to this type of dependencies.

Because even if this attacker didn't do more than N=1 and other attackers didn't have the idea before, they surely have it now.

I would add to that list:

* Has random binary test files in its repo, ideal for hiding exploit payloads.

Remember that NSA is openly interested in systemd and how it works. It's a double edged sword. They wanted to be sure that it's hardened as they like it, and note any "useful features" that might come handy later.

The thing is, as computers proliferate and we start to use them in more places, the effects of possible holes moves closer to our homes. From distant infra to near infra; from borderlines to our homes and transportation we use everyday. Even to our pockets via smartphones and other smart devices we host in our homes.

Nothing but speculation so far based on the times they were active. No real signatures left behind.

All we know is they were active during business hours of the UTC+1/3 timezones. They used a chinese sounding name as one of their front figures, the one who made most of the commits of malicious code. They wrote english messages that some people claim appear to be a Russian trying to write in English. But that last argument is pretty weak as they could have just masked their origin using Google translate, or even ChatGPT.

One of the biggest clues is actually one little commit that they let slip with a middle name to the chinese persona. And some people claim the names don't match up with different chinese cultures.

After that you can use all your psych 101 experience to try and analyze them but you'll just be guessing.

Personally I think using a chinese front name is a very interesting detail. They could have used any name in the world, there are open source contributors from all over the world.

Using a name in a country where most people have a very little insight is a good way of not being uncovered as fake of course. But why not use a Ugandan name? Also using a Chinese name can be perceived as pointing the blame at China, which might be sensitive geopolitically.

Is there anyone who have made complication on the most famous (searched by the whole world) anonymous people. No 1 must be Satoshi Nakamoto, and No 2 maybe this one? Is there any others?

CISA (https://cisa.gov) are investigating. They got the emails between me and "Jia Tan" and other information we have. They can subpoena Google to get IP addresses behind the emails, but it depends on whether and where a VPN was used if they'll get any further than that. If we will ever see a fully public report is anyone's guess.

While libcurl is an alluring target it is really ill suited for this, Daniel Stenberg is paid to work on it full time and his track record speaks. The situation is really different from xz.

On very old glibc ldd used to set an env variable and run the executable. The assumption being that PT_INTERP is set to glibcs dynamic linker. The dynamic linker would dump resolved libraries and stop execution if the variable was set. My guess is they wanted one and only one code path, whereas a separate resolver in `ldd` could get out of sync with the dynamic linker and therefore report incorrect results. But obviously binaries do not have to have an interpreter set at all, or they may point it to any other executable that's not glibcs dynamic linker, and the result is it would just execute like normal.

The fact that the lecturer is aware of it makes `sudo ldd` look even more odd.

I've never minded ignoring -anyone- who wasn't paying me if they're being disrespectful. I try my best generally, so I don't feel guilty, and if that's not good enough, they can go pound sand and cry about it; a good cry can definitely help you when you're at peak emotions is my thinking. A lot of people have other things going on and just snap at the smallest thing when they get frustrated.