XZ Utils Backdoor(en.wikipedia.org) |
XZ Utils Backdoor(en.wikipedia.org) |
Classic Debian security management
Do you have many more examples to call that a "classic" Debian security behaviour?
Not Slackware since Slackware does not patch xz or many other utilities. Plus it does not use systemd. From what I remember a patch was put in to give systemd extra functionality and someone used that patch to sneak in the backdoor.
This wasn't exactly necessary since the protocol has been stable for external use for ages (since its inception IIRC) and is relatively trivial to implement.
Since the attack happened openssh gained native support for the sd-notify protocol, the sd-notify man page has an example implementation that is freely usable and libsystemd now only loads xz (and most of its other libraries) when explicitly requested by one of the tools via `dlopen`.
It's an old legacy technology that needs to die out from all forms of distributions (looking at you GNU)
I worked at a company that got red teamed. The pen testers were inside the network and were only found by a random employee who happened to be running little snitch and got a weird pop-up
Nobody celebrated the fact that the intrusion was detected. It was pure luck, too late, and the entire infosec leadership was fired as a result.
Like this xv issue, none of the usual systems meant to detect this attack seemed to work, and it was only due to the diligence of a single person unrelated to the project was it not a complete show.
Who vets contributors, maintainers and submissions?
Answer: Unknown in many (if not most) cases. Unless you have the time and expertise to do so yourself; it is purely based on trust.
This ideal obviously did not happen here.
And there are no consequences for those who fail to do so.
A human name is not required for legal accountability.
A human name is required in order to be legally employed.
None of this applies to open source in many (if not most) cases --- the subject one being an example.
Just like there's basically no reputational harm anymore for leaking all your users details for most leaks
Yes, installing any software of "unknown origin" is a gaping security hole --- whether FOSS or not.
The fact that some people do dumb stuff does not negate the fact that a lot (if not most) FOSS fits in this category. Anonymous maintainers and contributors is pretty normal operating procedure which equates to zero accountability.
The common retort is, "Well, the source is available for review". But as this example shows, this is a very weak indicator of security or safety. A review is often not done before (or even after) distribution --- and certainly not with a malicious actor in charge.
> Anonymity is the unique aspect of open source that opens the door for malicious activity without consequences.
If you'd like to amend to something like
> Anonymity, which is in play for most FOSS and a decent chunk of proprietary software, opens the door for malicious activity without consequences.
Then I wouldn't strongly disagree. I'm still a little skeptical, because people keep finding backdoors in non-FOSS software/firmware, of course, but it'd at least be a defensible claim. I'm only really objecting to the notion that this is unique to FOSS.