Kevin Beaumont
I don’t agree with all the doom saying about XZ incident.
You just know orgs are going to return after Easter and panic about it unnecessarily (they’re likely still on Redhat 6). It doesn’t impact them as it was caught super early.
Regarding the narrative that there’s nothing that can be done about these type of attacks - I also don’t agree. There’s already a change in the pipeline to systemd which would have prevented it.
The thing needs rational, calm reaction and response.
Kevin Beaumont
Before anybody points it out, I know I am in the wrong industry if I want rational calm response - LinkedIn in still full of people saying the boat got ‘cyber attacked’, and governments are busy trying to solve supply chain risks by banning HUAWEI.
The industry is basically powered by people running into a crowded theatre and shouting CYBER. Then when people point out there’s no cyber, they’re like ‘yes.. but there COULD be cyber’. Thanks, very helpful.
0x6B757261
@GossiTheDog it was depressing watching some people on the XZ IRC the 36ish hours I was lurking.
You had a small group of people trying to get hold of Lasse Collin, and get an FAQ and write-up done. A few trying to analyse the vuln.
And then people just joining to wildly speculate and draw insane conclusions like claiming Jia Tan means Come Home or some shit like that.
And then also another handful that kept trying to impersonate Jia Tan.
Kevin Beaumont
For those asking what systemd change, easy write up: https://github.com/systemd/systemd/issues/32028
It was in train before the XZ issue was discovered, which may be why the threat actor sped up, started making mistakes and started begging distros to upgrade XZ.
Pär Björklund
@GossiTheDog these proposed changes don't protect against a similar attack though. They do reduce the attack surface making it harder to pull off.
Just moving to dlopen depends a lot on the implementation and how easy it is to trigger the loading of a vulnerable library
mroszko
@GossiTheDog The systemd change would have sealed off the ssh attacker vector. But liblzma is linked into plenty of other libraries. Just using rdepends even python,tor has a depend on it. So they could have still had value in alternate attack vectors, just not ssh which may have been more universal.
Heck libxml2 depends on liblzma5, so there are even more attack targets like postgres, ruby, php, etc
Kind of a waste to rush, but it may be why they added a plugin system for additional payloads.
Rich Felker
@GossiTheDog Are they deprecating the sd notify library call so that all the programs gratuitously linking libsystemd for socket notification will instead have to read the spec and write the 5 lines of code needed to do it by the spec rather than by a library function? This would help so much to undo the damage systemd did to dependency creep.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.