Kubwerera ku SSH
Woyang'anira woipa kapena wosokoneza anaika khalidwe loipa mu laibulale yotchedwa liblzma, gawo la zida zochepetsera xz ndi malaibulale, zomwe zimapangitsa kuti pakhale chitseko chakumbuyo mu SSH. Ichi ndi chiwembu chapamwamba cha mapulogalamu operekera mapulogalamu chifukwa laibulale idasinthidwa mwadala kuti ikhale chitseko chakumbuyo, ndi njira zobisika komanso zobisika zobisira chiwembucho kwa owunikira.
Inapezeka ndi kuwululidwa posachedwapa (pa Marichi 29 apitawa), ndipo njira yothana ndi kuukira ikupitirira. Komabe, inaletsedwa mwachangu chifukwa ikuwoneka kuti ikukhudza mitundu yoyambirira ya malo ochepa (ma DEB ndi RPM package, a x86_64 architecture, ndipo yomangidwa ndi GCC). Mulimonsemo, CVE anapatsidwa Chigoli cha CVSS mwa 10, zomwe zimasungidwa kwa omwe ali ndi vuto lalikulu la chitetezo cha pa intaneti. Ngati zilowa m'magawo okhazikika, zotsatira zake zingakhale zazikulu.
Kusanthula kwaukadaulo kwa kuukiraku, kuphatikizapo xz backdoor yafotokozedwa mozama, idasanthulidwa kwina. Nkhaniyi ikuyang'ana kwambiri nthawi yomwe kuukiraku kunachitika, momwe kungadziwikire, momwe chochitikachi chinachitidwira mpaka pano, komanso maphunziro omwe angatenge kuchokera ku kuukiraku.
Mchira wautali wa chitseko chakumbuyo wapitirira kale kuposa chigamba choyamba. Mu Ogasiti 2025, patatha chaka chimodzi kuchokera pamene CVE-2024-3094 yawululidwa, ofufuza zachitetezo ku Binarly adapeza kuti chitseko chakumbuyo chikadalipo m'zithunzi khumi ndi ziwiri za Debian Docker zomwe zidasindikizidwa pa Docker Hub, pomwe gulu la Debian likukana kuzichotsa, likuziona ngati zinthu zakale zopanga chitukuko m'malo mochita zoopsa. OpenSSF ndipo OpenJS idapereka chenjezo limodzi patangopita nthawi yochepa kuchokera pamene XZ idachitika kuti kuyesa kofanana ndi kutenga ulamuliro wa anthu kunali kale kolunjika ku mapulojekiti a JavaScript, zomwe zikusonyeza kuti njira yowukira maintainer-trust yomwe imagwiritsidwa ntchito pano ikugwiritsidwanso ntchito kwina.
Momwe chitseko chakumbuyo cha XZ chinalowetsedwa
Chidziwitso: Malo osungiramo zinthu a git ali mkati git.tukaani.org. Komabe, panalinso Malo osungiramo zinthu omwe ali ku GitHub (yotsekedwa pakadali pano) komwe akaunti ya GitHub inali kutumiza zosintha zomwe pambuyo pake zidaphatikizidwa mu malo osungira a Git.
Gawo limodzi la chitseko chakumbuyo likuwoneka kuti lili m'ma tarball ogawidwa a mitundu ya 5.6.0 ndi 5.6.1, osati m'malo osungiramo ma git ndipo limadalira mzere umodzi mu build-to-host.m4 fayilo ya macro yomwe imagwiritsidwa ntchito ndi autoconf. Gawo lina linali mu mafayilo awiri oyesera omwe amaganiziridwa kuti ndi bad-3-corrupt_lzma2.xz ndi good-large_compressed.lzma
zomwe zinali commitTed ndi akaunti ya GitHub ya “Jia Tan” (Mtengo wa T75) mu malo osungiramo zinthu a xz Pa 23 Feb. Kunali kusintha kopanda vuto powonjezera ma testfiles (omwe amati ndi ma blocks a .lzma ndi .xz). Chosangalatsa n'chakuti, ma test files sanagwiritsidwe ntchito ndi ma test! Mzere mu fayilo ya .m4 umalowetsa script yobisika (yomwe ili mu tarball) kuti ichitike kumapeto kwa configure ngati zinthu zina zikugwirizana. Imasintha Makefile ya liblzma laibulale ili ndi code yomwe imachotsa deta kuchokera mu fayilo ya .xz, yomwe pambuyo pa deobfuscation imatha mu script iyi, imayitanidwa kumapeto kwa configure. Imasankha ngati isinthe njira yomangira kuti ilowetse code: pansi pa GCC ndi GCC linker, pansi pa Debian kapena rpm, komanso pa x86_64 Linux yokha. Ikagwirizana, code yolowetsedwa imaletsa kuchitapo kanthu mwa kusintha ziwiri. ifunc zosinthira kotero kuti ma call ena amasinthidwa. Izi zimapangitsa kuti matebulo a zizindikiro aziwerengedwa mu kukumbukira (izi zimatenga nthawi, zomwe zidapangitsa kuti zidziwike, monga tafotokozera pambuyo pake).
Kenako zinthu zimakhala zosangalatsa: Chitseko chakumbuyo chimayika cholumikizira chowunikira mu cholumikizira champhamvu, kuyembekezera chizindikiro cha ntchito ya RSA_public_decrypt kuti chifike, chomwe chimatumizidwa ku mfundo ina mu code yakumbuyo, yomwe imayimbanso. libcrypto, mwina kuchita kutsimikizira kwabwinobwino. Ndipo katundu wolipidwa umayatsidwa ngati pulogalamu yomwe ikuyenda ili ndi dzina la njira /usr/sbin/sshdZinali zoonekeratu kuti ma seva a SSH ndiwo anali cholinga chawo. Mwachikhalidwe, sshd ma seva ngati OpenSSH sanalumikizidwe ndi liblzma, koma sshd ndi nthawi zambiri zimakonzedwa kuti zithandizire systemd-notify kuti ntchito zina ziyambe pamene sshd ikugwira ntchito. Kenako liblzma imalowetsedwa mwachindunji ndi systemd, kutseka bwalo.
Chitseko chakumbuyo sichinafufuzidwe mokwanira, koma zikuwoneka kuti kulola kuphedwa kwa lamulo lakutali (RCE) ndi mwayi wa daemon ya sshd, ikuyenda munthawi yotsimikizika isanakwane. Chidziwitso kuchokera ku satifiketi yakutali, ikalumikizidwa ndi chitseko chakumbuyo, chimachotsedwa muchinsinsi ndi ChaCha20, ndipo ikachotsedwa bwino muchinsinsi imaperekedwa kwa dongosolo()Kotero iyi ndi RCE yotsekedwa, yoyipa kwambiri kuposa kungodutsa makiyi apagulu.
Mpira wa tarball wa 5.6.1 wotsatira unawonetsa khama lowonjezera lobisa zizindikirozo, kuwonjezera kubisika kwina kwa mayina a zizindikiro, ndikuyesera kukonza zolakwika zomwe zawonedwa. njira yowonjezera komwe mafayilo ena oyesera anafunidwa kuti awonjezere zizindikiro zina ku backdoor anayikidwanso.
Kuukira kumeneku kwanzeru sikungadziwike mpaka kugawa kwa Linux kokhazikika kufikire. Mwamwayi, anthu ena amakonda kuwona chifukwa chake zinthu zachilendo zimachitika.
Kupezeka kwa XZ Backdoor Attack
Nthawi zambiri khalidwe loipa lomwe limalowetsedwa limapezeka mwangozi kapena mwangozi. Chitsanzo chabwino chinali chenjezo la kusiya ntchito (“Ndani amasamala za machenjezo?”) zomwe zinapangitsa kuti apezeke kuukira kwa zochitika mu Okutobala 2018. Wina ndi wogwiritsa ntchito amene anachenjeza Kodikov Mu Epulo 2021, script yawo ya bash uploader sinapambane checksum ("Ndani amatsimikizira kukhulupirika kwa zinthu zakale ndi checksums"?) Zovuta ndi zizindikiro zachilendo ndi ssh logins (loginKutenga CPU yambiri ndi nthawi yochulukirapo, zolakwika za Valgrind) zidadzutsa chidwi cha Andres Freund, katswiri wokonza PostgreSQL yemwe ndi watcheru koma osati katswiri wofufuza zachitetezo (monga momwe adanenera)Pambuyo pofufuza ndi OpenSSH pa Debian Sid, adatsimikiza kuti vuto la nthawi yoyankhira limadalira laibulale, liblzma, Gawo la xz-zida laibulale yokakamiza. Chifukwa chake: “malo osungiramo zinthu zakale a xz ndi ma tarball a xz atsekedwaKuzindikira kumeneku kunali kolondola kwambiri! Pa Marichi 29, 2024, Andres adalemba mu Openwall kusanthula koyamba: “chitseko chakumbuyo mu xz/liblzma chakumtunda chomwe chimapangitsa kuti seva ya ssh igwirizane". Zoona zake: Ma tarball a XZ Utils 5.6.0 ndi 5.6.1 ali ndi chitseko chakumbuyo. Ma tarball awa adapangidwa ndikusainidwa ndi akaunti ya Jia Tan yomwe yatchulidwa pamwambapa. He yolembedwa mu Mastodon Pambuyo pake tsiku lomwelo, pozindikira kuti zomwe zapezekazo zinali mwangozi ndipo zinafuna zochitika zambiri mwangozi. Ndemanga zochokera kwa ogwiritsa ntchito ena ndizofunikira kuziwerenga. Wogwiritsa ntchito GitHub thesamesam (wodziwikanso kuti Sam James) adalemba nkhani yabwino kwambiri Mafunso Ofunsidwa Kawirikawiri pa xz-utils backdoor kumene kuukiraku kunafupikitsidwa, kulumikiza ku zina zambiri kusanthula mozama ya katundu wolipidwa wa kuukira. Kusanthula kumeneku kunali kosangalatsa kwambiri, ndipo kunatithandiza kumvetsetsa bwino jakisoni, yomwe inafotokozedwa bwino kwambiri:- xz/liblzma: Kufotokozera kwa Bash-stage ObfuscationKusanthula kwabwino pa deobfuscation pogwiritsa ntchito script yojambulira, m'magawo anayi.
- Ulusi wa buluu wa Filippo Valsorda Kusanthula kwa chitseko chakumbuyo mu RSA_public_decrypt, komwe kukuwonetsa mtundu wake: RCE, osati auth bypass, ndi geted (imavomereza kiyi yachinsinsi ya wolemba ndipo ngati sichoncho, imabwerera ku khalidwe labwinobwino) / yosabwezeredwa. Wolembayo ankafuna kubisa mbiri yake kuti asadziwike!
- Kusanthula kwa XZ Backdoor ndi @smx-smx (WIP) - Kusanthula kwina kwa chitseko chakumbuyo (ndinasochera pafupifupi pachiyambi 😀)
- xz zolemba zakumbuyo wiki, kusanthula kwina kwa script ya 5.6.1 yopangira jekeseni.
Momwe nkhaniyi inachitikira
Kuwululidwa kwa Andreas Freund kunali kosamala chifukwa, m'mawu ake omwe:"Popeza kuti vutoli likuoneka kuti lafika pamwamba pa tsamba, sindinanenepo za vuto la pamwamba pa tsamba. Poyamba ndimaganiza kuti ndi vuto la debian, ndinatumiza lipoti loyamba ku security@...ian.org. Pambuyo pake, ndinanena za vutoli ku distros@." CISA adadziwitsidwa ndi kugawa.
Ndani ali pansi pa kuukiridwa?
Kaya akaunti ya GitHub JiaT75 idasokonekera (kumbukirani kuti GitHub idalamula 2FA posachedwapa) kapena wogwiritsa ntchito yemwe adalipira akauntiyo adapita kumbali yoyipa. Koma pali zifukwa zomveka zoganizira za chiwopsezo chopitilira (APT), mwina chothandizidwa ndi boma, chifukwa cha luso laukadaulo la kuukiraku. Kafukufuku wowonjezereka wochitidwa ndi mabungwe achitetezo cha pa intaneti ndi apolisi adzatiuza ... Cholowa ichi Nkhani za YCombinator Hacker zokhudza Jia Tan imawunikira "ndani" ndi zochita zake. Yalangizidwa! Imapereka zambiri zokhudza momwe anthu oipa amayesera kunyenga ogwiritsa ntchito ena, pogwiritsa ntchito ukadaulo wa anthu."Zokhumudwitsa kwambiri - wolemba wa backdoor anali kulankhulana nane (rwmj) kwa milungu ingapo akuyesera kuti xz 5.6.x iwonjezedwe ku Fedora 40 ndi 41 chifukwa cha "zinthu zatsopano zabwino". Tinagwiranso ntchito naye kukonza vuto la valgrind (lomwe tsopano layamba chifukwa cha backdoor yomwe adawonjezera). Tinayenera kuthamanga usiku watha kuti tikonze vutoli titasiya kuletsa mwangozi. Iye wakhala mbali ya projekiti ya xz kwa zaka ziwiri, akuwonjezera mitundu yonse ya mafayilo oyesera a binary, ndipo kunena zoona ndi luso ili ndingakhale wokayikira ngakhale mitundu yakale ya xz mpaka itatsimikiziridwa kuti si yolondola."
Jia Tan adatenga njira zopewera kutsatiridwa: Zikuoneka kuti adagwiritsa ntchito VPN (vpn.singapore.witopia.net) kuti alumikizane - zomwe zili bwino. Ndipo kusintha kwakukulu kukuwoneka kuti kumathandizidwa ndi maimelo akanthawi, ogwiritsidwa ntchito kamodzi (kuchokera ku ProtonMail pankhaniyi) omwe amalimbikitsa kuphatikiza kusintha.
Wochita seweroli angafune kupita patsogolo kwambiri, mpaka ku kernel ya Linux, monga wopereka chithandizo ku xy-embedded Kufufuza koyamba sikunapeze umboni uliwonse wosonyeza kuti mayi wapita padera, monga momwe zilili masiku ano.
Chidziwitso: china Wopereka ndemanga wa XZ wodziwika bwino "Hans Jansen" (Wogwiritsa ntchito wa GitHub “hansjans162”) ndi moyang'aniridwaAkaunti yake ku debian tsopano ndi atsekezedwaAdapanga zosintha zambiri ku Debian Games kuti abise zomwe amafuna pa debian/xz-utils, zosintha ku upstream 5.6.1 kuti afulumizitse kugawa kwa backdoor ku debian/osakhazikika.
Chomwe tinganene, pakadali pano, ndichakuti iyi ndi APT (yomwe sinadziwikebe) yomwe imagwiritsa ntchito maakaunti osiyanasiyana, ikugwira ntchito kwa zaka zosachepera ziwiri pa kampeni iyi, ndikugwira ntchito moleza mtima kuti ikhazikitse RCE mu SSH.
Mpaka pano, dzina la "Jia Tan" silinatsimikizidwebe. Palibe umboni wodalirika woperekedwa kwa munthu wina, bungwe, kapena wochita sewero m'boma womwe watsimikiziridwa poyera, zomwe zikutsimikizira momwe kayendetsedwe ka ntchito ka munthuyo kanali kogwira mtima.
Kodi kuukira kwa XZ kumbuyo kwa galimoto kunali kotetezeka?
Zovuta kwambiri.
Choyamba, gawo la chitseko chakumbuyo chomwe chinalowetsedwa chinalowa m'mafayilo oyeserera omwe sanagwiritsidwe ntchito ndi mayeso. Poganizira zakale, zimenezo zingachititse kuti pakhale ma alarm ena (aphokoso), koma ndani amasamala kuti aone ngati mafayilo onse oyesera akugwiritsidwa ntchito ndi mayeso enieni? Chachiwiri, gawo la chitseko chakumbuyo chomwe chinalowetsedwa chinalowa m'mafayilo a macro mu ma tarball otulutsidwa, ndipo n'kovuta kuyang'ana pamanja kusiyana ndi ma tarball omwe akuyembekezeka. Automation nayonso ndi yovuta, chifukwa zotsatira zomwe zimayembekezeredwa kuchokera ku kapangidwe kake (kwa aliyense amene akudziwa momwe automake/autoconf imagwirira ntchito) zimakhala zovuta kuyerekeza ngati tarball yeniyeni ikugwirizana ndi zomwe zikuyembekezeredwa. Ena anazifunsa as "Kusiyana kwa ma tarball ndi mtengo wa git ndi chinthu china, osati cholakwika". Kuchokera kwa ma tarball a binary kuchokera ku source code yake ndi vuto lomwe silingathe kuthetsedwa.
Mbiri ya ogwiritsa ntchito? Chabwino, akaunti ya JiaTan75 GitHub sinali kuchita zinthu zachinyengo malinga ndi zakale commits. Inayimitsidwa pokhapokha umboni utasonkhanitsidwa, koma mpaka pa 29 Marichi, wogwiritsa ntchito wamba ankachita bizinesi yachizolowezi. Chabwino, sizinali zachilendo. Pambuyo pake commits (izi, izi, izindipo izi zomwe zinasintha code ya exploit) zinayesa kukonza zolakwika za valgrind ndi ngozi m'makonzedwe ena, chifukwa cha kusiyana kwa kapangidwe ka stack komwe kumayembekezeredwa ndi backdoor. Commit Ndemanga zitha kuzindikira izi, koma ndani ali ndi chipiriro chofufuza kusintha kwa fayilo yoyesera ya binary kapena chifukwa chenicheni cha kusintha kwa makhalidwe a GCC mu code ya C source?
Kodi munthu ayenera kukweza ma alarm akalandira SSH? login imatenga 800 ms m'malo mwa 300 ms? Mwina anthu ochenjera kwambiri okha ndi omwe angazindikire. Cicero anati, "Kupusa ndi kwa unyamata; nzeru ndi za ukalamba."
Zomangamanga za ifunc zidawonjezedwa mu Juni 2023 ndi "Hans Jansen" ndi "Jia Tan". Iyi ndi yoyamba commit kuwonjezera thandizo la ifunc ku crc64_fast.c (pambuyo pake linagwiritsidwa ntchito pobaya chitseko chakumbuyo). Miyezi ingapo musanayambe kubaya zitseko zakumbuyo m'mafayilo oyesera!
Chidziwitso: Wolemba ndi commitPali kusiyana pakati pa izi, koma izi sizachilendo: Lasse Collin ndiye woyang'anira polojekitiyi, ndipo adaphatikiza zosinthazo. Amayamikiranso "Hans Jansen" ...
Palibe amene adadzutsa nkhawa asanafike positi ya Andres Freund ndi CVE yopangidwa ndi RedHat. Ngati muwona zida zambiri zomwe zingathandize kuzindikira izi, tsopano akupeza gawo lomwe lakhudzidwa, zolemba zakale.
Mwina njira yabwino yopewera vutoli idachokera ku mtundu wa magawidwe a Linux, komanso momwe mitundu yosakhazikika komanso yotuluka magazi imapitira ku magawidwe okhazikika pambuyo pa njira yofulumira.
Maphunziro Ochokera ku XZ bBackdoor Attack
Taona momwe zimakhalira zovuta kuzizindikira mwadala Zitseko zakumbuyo. Zitseko zakumbuyo ziyenera kuonedwa ngati chiwopsezo chamkati, chifukwa zimayikidwa ndi antchito amkati kapena kudzera mu akaunti yamkati yosweka. Ndipo anthu amenewo nthawi zambiri amadaliridwa. Ndipo chitseko chakumbuyo chikayikidwa mu chinthu chogawidwa, zimapangitsa kuti zikhale zovuta kuzizindikira.
Olemba ena monga Kevin Beaumont analoza pa dongosolo, zomwe zimatsegula malo akuluakulu owukira a mautumiki a chipani chachitatu kupita ku backdoor. Izi ndi zomwe wochita sewero woyipayu adagwiritsa ntchito molakwika apa. Systemd ili ndi maso ambiri, koma XZ ndi laibulale yosamveka bwino pamwamba pa unyolo. "Pamene mtsinje wakum'mwera uli ndi kachilombo, aliyense amamwa madzi oopsa pansi pa mtsinjewo".
Pempho losintha losagwirizana mu dongosolo la kutsitsa malaibulale opanikizika mosinthasintha, yomwe ingachotse chitseko chakumbuyo, inali italumikizidwa kale mu dongosolo koma sinaperekedwebe. Kudalira kwina komwe kunayambitsidwa ndi libsystemd kungakhale gwero la zovuta, ndi dzulo pempho ili linatsegulidwa.
A ndemanga mu "xz: Letsani ifunc kuti mukonze vuto" commit adapereka chidziwitso chakuya cha komwe tingaike chidwi ngati tikufuna kupewa zochitika zotere (ndikugogomezera):
"Phunziro lomwe tiyenera kuphunzira monga gulu ndi lofunika kwambiri kuti titeteze software supply chain security Mwachidule, kufufuza njira zomangira zinthu kupitirira ma code oyambira okha. Monga kuphwanya malamulo a SolarWinds komwe owukira adasintha zosintha za mapulogalamu a SolarWinds omwe amapereka mapulogalamu owunikira omwe ali ndi magwero otsekedwa.
FAQ
Kodi chitseko chakumbuyo cha XZ chikadali pachiwopsezo masiku ano?
Zambiri zili mkati, koma sizinachoke konse. Mu Ogasiti 2025, ofufuza adapeza kuti chitseko chakumbuyo chikadalipo muzithunzi zingapo za Debian Docker Hub, zomwe Debian amaona ngati zinthu zakale zosagwira ntchito. Magulu ayenera kutsimikizira kuti sakumanga pazithunzi zakale, zosakonzedwa m'malo moganiza kuti chigamba cha 2024 chatseka chitseko kwathunthu.
