Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library | Hacker News Reader

Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library

cisa.gov

119 pointstaubek21 comments

https://news.ycombinator.com/item?id=39865810 (over 1300 comments)

Is there any information on the actual person that introduced the back door? Possible state actor? Or maybe a black hat that was trying to sell the “back door” for cash/crypto currency?

That was yesterday.

Gotta love that they're now suggesting to downgrade to 5.4.6 with a link to the now defunct (and under control of the same authors) repository. They should have probably released hash and version of a not affected source tarball.

The Debian message is more interesting. They try to find out what happens when all potentially suspect commits disappear. They need to downgrade a lot further - 5.3.1- and break the API. The whole situation seems nasty.

Somebody pointed out fairly early that the current stable release was released by the same account too, and I wondered how deep this hole would go.

That really undersells the significance of this, GJ Cisa /s

I think there is a reasonable likelihood* that the compromise originates from Five Eyes. Would you really want to report IOCs to CISA?

*Given the patience and sophistication of the attack, and my speculation that the NSA likely would’ve caught it and alerted it if it was China or Russia.

If you’re going to be playing that game, consider that his other contributions included optimizing CRC performance on the Chinese LoongArch CPUs with which he appeared to very familiar.

Where are you getting this from? JiaT75 reviewed a pull request by xry111 including said optimization (which hadn't yet been merged), that's all.

I saw https://news.ycombinator.com/item?id=39866716 yesterday but subsequent comments actually linked to it and a quick trip to the internet archive says you’re right.

The perpetrator is clearly a highly skilled dev, it doesn’t seem farfetched that they could become acquainted with a ‘foreign’ tech stack to sell a cover story

I think there is an equally reasonable likelihood that nation state security and intelligence apparatus have disinformation capabilities that include monitoring and when necessary posting to and attempting to influence online forums like HN.

The assumption that the NSA catches (and discloses) most flaws in major open source software requires a high suspension of disbelief.

In particular it requires belief that the NSA ignores its mandated mission to protect U.S. infrastructure and is arrogant enough to think only they could find those problems. The federal government, state and local governments, key service providers, major utilities, etc. all rely on open source software and there’s no plausible way they wouldn’t be leaving those open to attack if they didn’t report a known vulnerability.

https://en.wikipedia.org/wiki/Dual_EC_DRBG

Yes, that’s a good example of what I’m talking about. Even when they tried to subvert a cryptographic primitive, notice how they designed it in such a way that they could exploit it but other parties could not? Even making the attempt was unacceptable but I will say it’s categorically different than leaving an open source vulnerability unpatched. If they weren’t the ones who created it, they wouldn’t have noticed but not reported it – even our closest allies aren’t trusted with root on government servers.

Think you've got that backwards, there's nothing fundamental about Dual_EC_DRBG that prevents anyone else exploiting it, while the xz vulnerability is gated with a specific private key.

Same story with the constants in Dual EC:

http://rump2007.cr.yp.to/15-shumow.pdf

The xz vulnerability is exactly the same in that guarded sense, so I’d be completely unsurprised if the NSA was behind it but I don’t think they’d otherwise help keep it quiet. Even if it was another Fives Eyes country it’s hard to imagine them being okay with that level of risk.

The nsa isnt a boogeyman you can just ascribe action. I mean you can, it's just wrong.

Choosing to fill a void with a boogeyman because it's less uncomfortable than not knowing is exactly the conspiratorial thinking that gets us to chem trails and flat earth

Reply on news.ycombinator.com