Hacker News Reader

Comment by gavinhoward | Hacker News Reader

If that's true, then I am 100% certain that this backdoor is from a nation state-level actor.

I already felt like this was way too sophisticated for a random cybercriminal. It's not like making up fake internet identities is very difficult, but someone has pretended to be a good-faith contributor for ages, in a surprisingly long-term operation. You need some funding and a good reason to pull off something like that.

This could also be a ransomware group hoping to break into huge numbers of servers, though. Ransomware groups have been getting more sophisticated and they will already infiltrate their targets for months at a time (to make sure all old backups are useless when they strike), so I wouldn't put it past them to infiltrate the server authentication mechanism directly.

Whoever this was is going after a government or a crypto exchange. Don't think anything else merits this effort.

Otoh, maybe they just wanted to create a cryptomining farm. Lol.

Don't underestimate the drive some people have to make a buck.

people downvoting you already forgot the cia fundraiser in the 80s...

I don't know that they had a singular target necessarily. Much like Solarwinds, they could take their pick of thousands of targets if this had gone undetected.

I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice.

I think the attacker had a target in mind. They were clearly focused on specific Linux distros. I'd imagine they were after a specific set of sshd bastion machine(s). Maybe they have the ability to get on the VPN that has access to the bastion(s) but the subset of users with actual bastion access is perhaps much smaller and more alert/less vulnerable to phishing.

So what's going to be the most valuable thing to hack that uses Linux sshd bastions? Something so valuable it's worth dedicating ~3 years of your life to it? My best guess is a crypto exchange.

> But why would a government want to own tons of random Linux machines that have open sshd mappings?

They don’t want tons. They want the few important ones.

Turns out it was easiest to get to the important ones by pwning tons of random ones.

That still implies there was a target in mind. But also they would've had to assume the access would be relatively short-lived. This means to me they had something specific they wanted to get access to, didn't plan to be there long, and weren't terribly concerned about leaving a trail of their methods.

Why couldn't they have had 50 or 100 targets in mind, and hoped that the exploit would last for at least the month (or whatever) they needed to accomplish their multiple, unrelated goals?

I think your imagination is telling you a story that is prematurely limiting the range of real possibilities.

> Something so valuable it's worth dedicating ~3 years of your life to it?

This isn't the right mindset if you want to consider a state actor, particularly for something like contributing to an open source project. It's not like you had to physically live your cover life while trying infiltrate a company or something.

Yes, this is a lot of resources to spend, but at the same, even dedicating one whole FTE 3 years isn't that much resources. It's just salary at that point.

Government have lot of money and time to spend. So having one more tool in box for that single time you need to access a target where this work is entirely reasonable investment. Would this if it weren't used have been noticed possibly in years? That gives quite a lot of room to find target for times when it is needed.

And you could have multiple projects doing this type of work in parallel.

Those guys are estimated to have made $1 billion last year - have to think that buys some developer talent.

I would expect a nation state to have better sock puppet accounts though.

>better sock puppet accounts though.

Seems like to me they had perfectly good enough sock puppet accounts. It wasn't at all obvious they were sock puppets until someone detected the expliot.

That's what this feels like. That, or someone who wanted to sell this to one. Can't imagine the ABC's are sleeping on this one at this point.

I imagine such actors are embed within major consumer tech teams, too: Twitter, TikTok, Chrome, Snap, WhatsApp, Instagram... covers ~70% of all humanity.

This could be something that agent that infiltrated into companies could use to execute stuff on internal hosts that they have SSH connectivity to but no access.

You could get into bastion hosts and then to PROD and leave no log traces.

What is the possibility of identity theft that is commenced on state-level? There are reports that the time the backdoor was pushed do not match the usual timing of changes committed by the author.

It also seems like a convenient ground for a false flag operation: hijacking an account that belong to a trustworthy developer from another country.

And risk discovery by the trustworthy developer? Unlikely.

What if the developer passed away? It is also easy to blame the developer with mental issues otherwise.

Reply on news.ycombinator.com