GitHub Disables The XZ Repository Following Today's Malicious Disclosure

[Volta]

Good news for winboys!

Windows 11 may be in scope.

Libarchive reviewing Jia Tan commits starting from 2021:

Windows 11 added Libarchive in 23h2 (released in late 2023/early 2024)

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27?permalink_comment _id=5006595#gistcomment-5006595

[Weasel]

It seems the author of the backdoor also contributed suspicious code to the, the more widely integrated, libarchive.

https://github.com/libarchive/libarchive/pull/1609

https://github.com/libarchive/libarchive/issues/2103

How about Microsoft just bans this filth and send the cops his way?

[laffer1]

Github is absolutely stupid for doing this. This makes it harder for me to respond as an OS vendor to the problem. I want to audit this code. Yes, I can look at the alternate site but tracking this rogue user's activity is helpful. The person also had commits against libarchive.

For folks that don't know, lzma compression is used for a lot of things with various OS projects. The MidnightBSD package manager uses it. It's not always called directly as some thing. With bsdtar/libarchive, it's linked against liblzma directly. The mport package manager uses libarchive with liblzma to actually compress data. Now the actual malware uses glibc hooks, so the BSDs are safe from this particular problem. However, the malicious actor could have done other commits that are a problem both to this project and others.

Instead, github should have put a warning up and blocked downloads of the affected two versions known about instead. (the full tarball)

As far as info about the issues: https://boehs.org/node/everything-i-...he-xz-backdoor

[BesiegedAce]

It's a fact Windows is infected by spyware. Keep trying. He was able to discover this, because it slowed his benchmark. Imagine trying the same on Windows where built in spyware slows the OS down and you can't verify the source of packages. Proprietary should be forbidden, because it's unsafe by definition. There's no way for users to check it for backdoors and M$ and apple are as trustworthy as your computer knowledge.

The idea that only FOSS can be validated and analyzed is bizarre. Don't people often complain that systemd or xorg or whatever is huge and bloated and therefore impossible to audit?

Conversely, with the right tools one can analyze the behavior and properties of closed source/binary only software. I've done so in the past for personal (boredom, etc) reasons.

This isn't an attack on open source or a defense of closed source, but it's much more nuanced than "open source is immune to issues."

[BesiegedAce]

Good news for winboys!



https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27?permalink_comment _id=5006595#gistcomment-5006595

...because it pulled in libarchive (known FOSS project)? Not defending windows here but if anything does this not weaken the whole "FOSS has thousands of eyes on it" further?

[reavertm]

How about Microsoft just bans this filth and send the cops his way?

Where, to Chinese "CIA" equivalent agency, Russian (contributions of "Jia Tan" started incidentally the same month Russia invaded Ukraine..) or where?
Jia Tan is just avatar with some email.
You don't know what it is, where and how many people are involved.

[mSparks]

Github is absolutely stupid for doing this. This makes it harder for me to respond as an OS vendor to the problem. I want to audit this code. Yes, I can look at the alternate site but tracking this rogue user's activity is helpful. The person also had commits against libarchive.

Github were genius for doing this, its basically brought all the malware cockroaches into the light so we can all see their bad practices clear as day.

[qarium]

It seems pretty obvious that this "someone else" (Jia Tan) only started contributing to the project with the backdoor being the intended long game. XZ was basically a golden egg for nation state backed APT groups. It's installed by default in all the major enterprise distros and liblzma gets linked against by important shit. The original author was struggling with some real life issues and didn't have time to dedicate to the project and needed to find other maintainers. Voila. A new contributor appears. Jia will likely end up being some pseudonym of course, with potentially multiple real world actors involved in the commits they made. Software supply chain attacks are only going to pick up steam over the next several years.

this nation state backed APT group is probably the group "Magnet Goblin" and i reported this group for attacking members of the open-source community many months ago and they did also attack phoronix.com forum members here in the forum.

https://www.bleepingcomputer.com/news/security/magnet-goblin-hackers-use-1-day-flaws-to-drop-custom-linux-malware/amp/

they are even active in this forum and place links here in the forum to lure forum members into traps to attack zero days in web browsers.

my advice is do not click on links here in the forum from this forum member: sophisticles

or else you maybe get some "logofail" virus

[qarium]

The repo was disabled because it's now a matter national security. NSA/CIA/FBI have full access though because they need to trace every IP and every interaction.
Had this not been discovered and quite serendipitously so, the hackers behind this attack could have compromised RHEL, Ubuntu, SLES and oh boy this is some extremely serious stuff.

what do you think is "Magnet Goblin" ???

i can tell you it is a nation state backed Advanced Persistent Threat actor group

one think is for sure these people: "NSA/CIA/FBI" will never help the open source community they themself spend billions of dollars to spy on members of the opensource community.

[mSparks]

this nation state backed APT group is probably the group "Magnet Goblin" and i reported this group for attacking members of the open-source community many months ago and they did also attack phoronix.com forum members here in the forum.

https://www.bleepingcomputer.com/news/security/magnet-goblin-hackers-use-1-day-flaws-to-drop-custom-linux-malware/amp/

they are even active in this forum and place links here in the forum to lure forum members into traps to attack zero days in web browsers.

my advice is do not click on links here in the forum from this forum member: sophisticles

or else you maybe get some "logofail" virus

This is significantly more complex than that.
Last I saw its a well hidden RCE that can only be exploited by the authors (the hook into RSA_Decypt is to decypt the payload using a fixed public key, so only the attacker could encypt the payload).

https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b

That's a long way from script kiddying a day-1 exploit