Vulnerability Assessment & Penetration Testing (VA/PT)
Nation-state attackers apparently backdoored widely used, open-source data compression software as part of a supply chain attack.
See Also:
4 Steps to Prove the Value of Your Vulnerability Management Program
The malicious code inserted into versions 5.6.0 and 5.6.1 of XZ Utils, a set of open-source tools and libraries for the XZ compression format initially released as LZMA Utils in 2009 and present in nearly every open-source and commercial Linux distribution, appears to have been detected quickly. This may have helped blunt widespread use of the vulnerability, which appears to have been designed to facilitate remote, unauthorized access to infected systems.
The U.S. Cybersecurity and Infrastructure Security Agency on Friday stated it “advises developers and users to downgrade XZ Utils to an uncompromised version – such as XZ Utils 5.4.6 Stable,” along with “searching for any malicious activity and report any positive findings” to the agency.
The vulnerability in XZ Utils, referred as CVE-2024-3094, involves liblzma, which is a part of the XZ package. The susceptibility is employed to provide full remote access to a system through SSHD, which is the OpenSSH server process.
The vulnerability could “empower a malicious actor to crack sshd authentication and attain unauthorized access to the entire system remotely,” alerted Linux distribution maker Red Hat. “Fortunately, xz 5.6.0 and 5.6.1 have not yet been extensively implemented by Linux distributions, and where they have, primarily in pre-release versions.”
GitHub has disabled the repository employed to disperse the backdoored code.
“Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code,” the U.S. National Vulnerability Database said. “This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.”
“The Trojan allows somebody a private key to hijack SSHD to execute commands, amongst other functions,” said British security expert Kevin Beaumont in a blog post. “It is highly advanced.”
The Open Source Security Foundation reported that the attack, at least so far, appears to only be designed to work with Debian or RPM Package Manager packages. “While the motivation behind this backdoor remains unknown, the intent was to compromise specific distributions, as the backdoors were only applied to DEB or RPM packages for the x86-64 architecture built with GCC and the GNU linker,” it said, referring to the GNU Compiler Collection as well as the GNU linker, used to create an executable file or library.
Credit for discovering the compromised code goes to Andres Freund. On Friday, the principal software engineer at Microsoft posted to the Open Source Software Security mailing list that after “observing a few odd symptoms around liblzma” in installations of Debian Unstable – a rolling development version of Debian with the codename “Sid” – he discovered that “the upstream xz repository and the xz tarballs” – or archive files compressed via the tar utility, “have been backdoored” since February, after which the new version of the utility began to make its way downstream into other software.
His notification landed just before 9:00 a.m. Pacific Time on Friday, marking the beginning of a lengthy Easter holiday weekend for several people, inclusive of those in many regions of Europe and various U.S. states and school districts.
Following this incident, numerous software developers have alerted users about the possiblity of having received compromised software.
Red Hat issued a warning asking users to “promptly cease the use of any Fedora Rawhide instances for work or leisurely purposes.” For those who may not know, Rawhide is a continuous rolling, development distribution of the Red Hat Enterprise Linux distribution and it forms the foundation for future Linux builds.
Further, Red Hat noted that some Fedora Linux 40 beta version users might have been given tampered versions of the XZ libraries, “contingent on the timing of system updates,” although the OS “doesn’t seem to be affected by the actual malware assault.” Nonetheless, the company strongly advised all Fedora 40 Linux beta users to revert immediately to 5.4.x versions.
The team behind Debian’s development mentioned that even though there seems to be no affected stable versions of its OS, the upcoming point release for 12.6 has been delayed as they continue to examine the impact of this CVE on the archive.
Ubuntu stated that none of the “released versions” of its OS have been impacted.
The development team for Kali alerted that users who have updated their Kali installation on or post March 26 should be cautious.
Arch Linux sheared that there is no malicious code in the Arch version of sshd as it doesn’t link to liblzma. They further advised users to steer clear of the vulnerable code in their system as there’s a possibility that it can be activated from other unidentified vectors.
The vulnerability may also be present for anyone who used the Homebrew utility to install Python v3 on macOS.
The operational security expert known as The Grugq said the backdooring appears to be the result of a two-year, sophisticated and “patient” intelligence operation that targeted the individual maintaining XZ in his spare time, Lasse Collin, and “invested more resources into subverting him than anyone invested into his project.”
Collin “is blameless in this,” The Grugq said. “There is no individual, and very, very few organizations, able to detect, let alone resist!, the directed interest of an intelligence agency.” In this case, he said, the initial stages of this “predominantly human intelligence” type of operation appeared to begin around March 2022, with messaging to Lasse, especially from a persona named “Jigar Kumar,” decrying the lack of updates to XZ. Later, attackers appeared to introduce a persona named “Jia Tan,” who magically offered to help Lasse with his workload and then socially engineered Lasse into giving him the right to directly push code updates.
The cybersecurity expert SwiftOnSecurity said that while the attack is interesting, security teams at any organization not targeted via the backdoor should still be focusing on much more basic and pressing security concerns, such as getting hacked because they failed to patch known flaws – for example in their remote-connectivity software – in a timely manner.
“If you’re worth risking burning this kind of global backdoor because they can’t figure anything else out to hit you with tens of billions of dollars and an army of cyber goons you’re already a winner. They had to cheat. Collect your prize,” SwiftOnSecurity said. “The rest of these people are getting popped over email attachments and unpatched VPN concentrators.”
Security experts have been warning for years that many open-source components provide critical functionality yet too often don’t enjoy adequate backing.
This problem continues to be highlighted, including in 2014 with the discovery of the Heartbleed flaw in the OpenSSL crypto library, which led to new initiatives for plowing more money into open-source projects. In 2021, the discovery of Log4Shell, a flaw in the Apache Software Foundation’s widely used Log4j logging software, highlighted the supply chain risks posed by open-source components, which can be present in many different types of software, old and new, although not always documented.
Expect attackers to keep trying to turn this state of affairs to their own advantage, as the XZ Util attack highlights, said veteran technology columnist Dan Gillmor, a professor of practice at Arizona State University’s Walter Cronkite School of Journalism and Mass Communication.
“Even though it was caught before widely deployed, the reality that a patient ‘bad actor’ can insert malicious code into key open-source repositories – a known possibility – now becomes a looming reality,” Gillmor said.
Executive Editor, DataBreachToday & Europe, ISMG
Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.
Cyberwarfare / Nation-State Attacks
From heightened risks to increased regulations, senior leaders at all levels are pressured to improve their organizations’ risk management capabilities. But no one is showing them how – until now.
Learn the fundamentals of developing a risk management program from the man who wrote the book on the topic: Ron Ross, computer scientist for the National Institute of Standards and Technology. In an exclusive presentation, Ross, lead author of NIST Special Publication 800-37 – the bible of risk assessment and management – will share his unique insights on how to:
Sr. Computer Scientist & Information Security Researcher, National Institute of Standards and Technology (NIST)
ChicagoVPS is your gateway to unparalleled hosting solutions. Our state-of-the-art datacenters and powerful network ensures lightning-fast speeds and uninterrupted connectivity for your websites and applications. Whether you’re a startup looking for scalable resources or an enterprise in need of enterprise-grade hosting, our range of plans and customizable solutions guarantee a perfect fit. Trust in ChicagoVPS to deliver excellence, combining unmatched reliability and top-tier support.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@chicagovps.net.
