At the very least, the backdoor allowed the attacker to remotely execute arbitrary code on a target machine.<\/p>\n
Although not full access or an authentication bypass, remote code execution can be as good as having total administrative control of a machine.<\/p>\n
Subsequent analyses<\/a><\/strong> of the attack suggest that the backdoor enabled remote code execution.<\/p>\n The vulnerability is being tracked as CVE\u20132024\u20133094<\/a><\/strong> with a CVSS score of 10 \u2014 indicating the highest possible severity.<\/p>\n Freund\u2019s initial detective work also found that the backdoor was not in the XZ Project\u2019s source code \u2014 it only existed in already-compiled versions of the software that distributions like Debian used to create its packages.<\/p>\n XZ used Github for version control, and it revealed that the malicious packages were all uploaded by the same person, \u201cJia Tan\u201d, with the username JiaT75.<\/p>\n At this point, other hackers took the baton from Freund and investigated Jia Tan\u2019s activity on Github, revealing what appeared to be an incredibly sophisticated supply chain attack.<\/p>\n Software developer Evan Boehs has published a summary<\/a><\/strong> of the investigation\u2019s findings so far.<\/p>\n Boehs and other hackers found that Tan created his Github account in 2021 and submitted his first patch to the XZ Project in 2022.<\/p>\n Tan became a regular contributor to the project, building trust over several months.<\/p>\n XZ creator Lasse Collin, under increasing pressure to add more maintainers to the project to help speed up development, gave Tan greater privileges and responsibilities as he demonstrated commitment to the project.<\/p>\n Tan pushed the final parts of the backdoor to GitHub on 23 February and 9 March 2024.<\/p>\n Shortly after this, there was a flurry of activity by Tan and another unknown moniker, \u201cHans Jansen\u201d, to get the new versions of XZ included in various Linux distributions.<\/p>\n According to Orca Security<\/a><\/strong>, Tan got his backdoored code into pre-release versions of Debian and Fedora, and into OpenSUSE Tumbleweed.<\/p>\n As a result of getting into Debian\u2019s unstable branch, the compromised version of XZ also found its way into the security-focused Kali Linux distribution.<\/p>\n While the deception was discovered shortly afterwards, a lot of it was luck.<\/p>\n Analysis of authentication log files<\/p><\/div>\n In a post on Mastodon<\/a><\/strong>, Freund explained that he wouldn\u2019t have spotted the issue had it not been for several coincidences.<\/p>\n Firstly, he happened to be micro-benchmarking changes being implemented in Postgres, a relational database management system.<\/p>\n He also happened to be running a pre-release version of Debian to ensure compatibility.<\/p>\n He also happened to have seen a complaint about a related but separate issue a few weeks earlier, and happened to have an option enabled that caused that complaint to surface again during his benchmarks.<\/p>\n \u201cJust to be clear: I didn\u2019t mean that I didn\u2019t do good \u2014 I did. I mean that we got unreasonably lucky here, and that we can\u2019t just bank on that going forward,\u201d he said.<\/p>\n Senior Google engineer Damien Miller agrees. Miller has over 17 years of experience at Google, chiefly in information security.<\/p>\n \u201cThis is the nearest of near-misses. Anyone who suggests this was any kind of success is a fool,\u201d Miller said on Mastodon<\/a><\/strong>.<\/p>\n \u201cNo system caught this, it was luck and individual heroics. That\u2019s not acceptable when unauthorised access to [nearly] every server on the Internet is on the table. We need to find a way to do better.\u201d<\/p>\n Miller said few of the software supply-chain defences people have been proposing would have prevented this compromise.<\/p>\n \u201cThe attacker was a (relatively) long-term maintainer, was not averse to using sockpuppet accounts and was careful to hide their exploit from automated tools,\u201d he explained.<\/p>\n \u201cWorse, many of the solutions being offered increase the workload on maintainers. But maintainer burnout was another key factor in this incident.\u201d<\/p>\n![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2024\/04\/Analysis-of-authentication-log-files-SSH.jpg\")
<\/a>The Internet dodged a bullet \u2014 but not because it was watching for one<\/h2>\n
![\"\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2024\/04\/Damien-Miller.jpg\")
<\/a>