XZ backdoor killswitch | Hacker News Reader

XZ backdoor killswitch

43 pointssgammon20 comments

There appears to be a string encoded in the binary payload:

https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01...

Which functions as a killswitch:

https://piaille.fr/@zeno/112185928685603910

Thus, one workaround for affected systems might be to add this to `/etc/environment`:

```

echo "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" | sudo tee -a /etc/environment

```

+ restart ssh and systemd

View on HN

It should go without saying: don't rely on this.

You probably don't have 100% certainty that the RCE hasn't already dropped a secondary payload.

Nice try, Jia Tan.

Tell HN:

Also, more discussion in here: https://news.ycombinator.com/item?id=39877267

You can also just set TERM or any of about a dozen other env vars.

I believe that is just to disable the inclusion of the payload, the given env variable will disable the payload when it is live.

It prevents registration of the dl-audit hook, very early on. So no redirection of RSA_public_decrypt occurs.

good point; i don't want to be sensational, so i updated the headline

So DPRK, Russia, or China, right? The USA and any country affiliated with it can just seize servers.

Well the more likely reason for that is that the exploit doesn't work if you have the LANG env var set. The US is the primary place where it wouldn't be set and hence where the malware would be active.

Does sshd normally run with any LANG env set when it’s run as a daemon?

Does that mean setting a Lang environment variable is a mitigation?

My understanding was the opposite. Two examples I found where backdoor is working are:

  env -i LANG=en_US.UTF-8 /usr/sbin/sshd -D
  env -i LANG=C /usr/sbin/sshd -h

Commits had a UTC +8 timestamp, so most likely China or possibly Russia unless Australia or Taiwan decided to do something really weird. Probably not DPRK.

The commit timestamps are not a reliable indicator of this actor's work day. It's trivial to work on a different schedule than local 9-5, or simply falsify the time stamps [1].

[1] https://github.com/jbranchaud/blog/blob/master/_posts/2013-0...

People thinking like you still astonishes me. We are talking about someone who is able to build a backdoor like this, and be so careless of:

- using a name that reveals their nationality?

- commiting at a timezone that reveals where are they located?

Please. We have no idea who's behind this. The only legitimate question is (as usual): who benefits from this? Answer: any government on earth (most likely: USA, China, Russia, etc.)

This analysis strongly suggests an Eastern European locale masquerading (with occasional oversights) as Chinese: https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

If an attacker is so smart and patient to pull of a sneaky supply chain attack like this, I'd say he/she/they must have been quite carefully choosing the moniker and hide/obfuscate other potentially identity revealing information (afaik, there is no reliable identity information found at the moment). So by choosing a very typical Chinese name (Jia Tan), I believe this is intentially misleading/smearing. I can't believe a smart ass (potenially a state actor) would be so stupid to use his/her/their actual nationality or other information.

But do you need to also possess the trusted privkey? I wonder why the attacker would build an unauthenticated kill switch.

it's for convenience. if you are aware of the necessity of the kill switch then you can just replace the offending package.

It does not appear you need the secret key to use the kill switch.

Reply on news.ycombinator.com