How Close We Came to a Digital Apocalypse

So in case you were on a silent retreat or away on vacation, some shocking news came out last week…

A vulnerability was implanted into a little known Linux library that opened an RCE (Remote Code Exploit) backdoor into any server running SSH. The vulnerability was a long tail attack of at least TWO years in the making. It’s been dubbed the XZ attack based on the library (xz-utils) that was affected.

Yes, you can now say THIS is a sophisticated attack. (I don’t use this term lightly). There were multiple “personalities” at play and this person had to build up a reputation to infiltrate the open source community and add this contribution.

Oh, and the worse part of all, it was discovered by accident due to a slow SSH login by a Microsoft engineer working on the project.

The backdoor works by allowing someone with a specific private key to execute commands from anywhere.

Keep in mind, the vulnerability DID make it into source and was shipped.

However it was detected within a few weeks, and unless you are updating your servers nightly, most people were not affected.

So because organizations are slow to update, we were saved? 🤦🏽

This is part of a class of attack called Supply Chain attacks. It’s not the first time this class of attack, but it’s the first time we know about such an attack at wide scale.

A notable example is the Codecov attack where a CI/CD provider was breached and thus was able to extract secrets and environment variable for customers images and builds. (I remember working on this incident!)

Let’s not forget Solarwinds, and many other supply chain attacks. Also let’s not underestimate nation state attacks like Stuxnet and Operation Aurora.

Some Questions To Ask

• How many attacks like this exist that we don’t know about?

• What are we going to do differently?

• Why are we so shocked about this? It was only a matter of time.

XZ Attack Links and Research

I’ve sifted through a bunch of articles and posts on the topic and left a bookmark of all the links here for you to enjoy.

• Original discovery of attack

• Attack Timeline

• Actual Contribution

• FAQ

• Deep Dive On The Attack

• 🔍XZ Detector By Binarly

• 🧑🏽‍💻Test Out XZ Yourself!

• Independent Timezone Analysis Of Commits

Original discovery of attack

https://www.openwall.com/lists/oss-security/2024/03/29/4

Attack Timeline

https://research.swtch.com/xz-timeline

Actual Contribution

https://bugs.launchpad.net/ubuntu/+source/xz-utils/+bug/2059417

FAQ

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

Deep Dive On The Attack

https://tuxcare.com/blog/a-deep-dive-on-the-xz-compromise/

🔍XZ Detector By Binarly

The tool detects implementation of IFUNC and is based on behavioral analysis.

https://xz.fail/

🧑🏽‍💻Test Out XZ Yourself!

Someone created a honeypot and exploit demo!

https://github.com/amlweems/xzbot

Independent Timezone Analysis Of Commits

Based on the activity of the attacker, it seems they worked a 9-6 job and took Holidays as well.

https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and

Thanks for reading!

ps. Is there a link you think I should add? Reply back and let me know!