Gregory's ServerOK, so here's my slightly more eloquent take on the xz thing, complete with a zinger closing paragraph:
https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor
 32 comments
 @lcamtuf @projectgus interesting hypothesis, but surely an earlier/cleaner disclosure could have been run with just a basic “as part of our ongoing program of security review of foundational open source projects”? @rfc6919 @projectgus If you don't have a real program of monitoring the changes to foundational open source projects, lying about it is quite dicey, for a number of reasons - possibly up to being securities fraud. Heck, if you *have* a program but are lying about whether it can be credited with detecting it, that's sketch too. Saying "one guy came across it by accident" doesn't really imply any business assurances, so it's a lot easier. @lcamtuf @projectgus fair point. I guess I’m just thinking that if someone was making up a cover story for the disclosure, surely they could do better than the barely believable “I noticed and investigated a 0.4s slowdown in ssh auth”. I dunno, I don’t play 4D chess.  Fair enough. FWIW I found the narrative about how the Postgres guy turned it up was entirely believable. Sometimes we just get lucky. The scary opinion I’ve read in a couple places now is “how many others like this are lurking out there that we didn’t get lucky with?”  @timbray @lcamtuf @rfc6919 @projectgus we do think there's a good chance of this being an organized effort, as the essay suggests. good piece! thanks for it! we note, however, the existence of ideological motives that could drive an individual to do this. @timbray @lcamtuf @rfc6919 @projectgus online manipulation and bullying tactics such as those sockpuppet complaints about maintainership are well-established in other areas of life, unrelated to software development. they are also well-known, which means lots of unaffiliated actors use them for lots of different goals. @timbray @lcamtuf @rfc6919 @projectgus overall, yeah, this is an absurdly PATIENT attack. we think that more than anything else does suggest organization behind it.  So maybe not a maintenance team, since the crucial software is, as you say, long since finished. Rather, a community of monks, whose religious vocation is to protect and defend the obelisk for eternity.  @irenes @timbray @lcamtuf @rfc6919 @projectgus I think there are many governments that would be willing to do something like this, and wouldn't care if it affected their own systems too as long as only they knew about it. Hell, that probably describes most governments, including in the United States and the UK. There have been several agencies and officials in the U.S. who have openly expressed discomfort with the idea of impenetrable cryptography. @bruce @timbray @lcamtuf @rfc6919 @projectgus oh, absolutely agreed on all that. furthermore, whether or not THIS attack was state-sponsored, now everybody has seen the strategy. @irenes @timbray @lcamtuf @rfc6919 @projectgus  @bruce @irenes @timbray @lcamtuf @rfc6919 @projectgus @jannem @bruce @irenes @timbray @rfc6919 @projectgus This is an awful lot of effort to put into a "product" that has a non-trivial chance of getting burned on first try if your customer is careless. It's something you use when a really compelling need arises, and where you can control most of the variables to minimize the risk of loss.   @lcamtuf I'd be curious if you had anything to back up this claim in my screenshot here. Do you have any data on how much open source code companies vacuum up vs. how many dollars they dish out? (Whether in salaries, grants, or otherwise...)  @lcamtuf One thought: You said this has all the hallmarks of a "foreign government" -- (assuming you're also American) who's to say this wasn't the FBI or the NSA? @lcamtuf One change you might want to consider is to point out that liblzma is not a dependency of OpenSSH but rather a dependency of a systemd code which is pulled in by OpenSSH on several Linux distributions. It is an important difference and means that an attack, if went undetected, could have been extended to other components. @lcamtuf You make very good points here. I also think that this shows that we - speaking of OSS community - are now very much potentially a target of various state-actor interference, and those attacks might not be directly technological. Sometimes projects are very good at technological opsec, but social manipulation is not something we care about - and well, we clearly should.  @lcamtuf@infosec.exchange I hear you and I think what you're saying is the real villain is systemd.  |
@lcamtuf "Those were just very lucky surveillance planes that found the submarine! We certainly didn't crack Enigma."