that ain't legal either

transcriptScreenshot of github showing part of the commit message of this commit with this text: Remove the backdoor found in 5.6.0 and 5.6.1 (CVE-2024-3094). While the backdoor was inactive (and thus harmless) without inserting a small trigger code into the build system when the source package was created, it’s good to remove this anyway: - The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines. - On machines that see lots bots poking at the SSH port, the backdoor noticeably increased CPU load, resulting in degraded user experience and thus overwhelmingly negative user feedback. - The maintainer who added the backdoor has disappeared. - Backdoors are bad for security. This reverts the following without making any other changes:The sentence “This was a blatant violation of the Debian Free Software Guidelines” is highlighted. Below the github screenshot is a frame of the 1998 film The Big Lebowski with the meme caption “What, are you a fucking park ranger now?” from the scene where that line was spoken.

Jomosoto,

Best part to me is “The maintainer who added the backdoor has disappeared.” implying it was removes because there’s nobody left to maintain it

merthyr1831,

reminds me of the infamous NSA backdoor patch blog for Notepad++

UserMeNever,

Backdoors are bad for security.

No shit…

flashgnash,

You’ve gotta wonder what else you’d write though

Especially given the urgency guy’s probably not gonna sit there and ponder

FrankTheHealer,

Nobody fucks with the Linux

https://lemmy.world/pictrs/image/d3ad6c2a-2827-4d15-8f1c-d868cf5a785a.gif

neo,

This guy Archs! Am I right!? You know I’m right!

Boomkop3,

I don’t get the joke

deltapi,

Yep, probably because it’s not funny or clever. My guess is that you look for funny and/or clever in your jokes.

Boomkop3,

Someone explained it, turns out it’s just not my kind of joke. I get it now tho

computergeek125,

I’m still lost… I’ve been following the XZ thing since it broke, so I get the context, but I’m not sure how the meme at the bottom is connected?

Boomkop3,

On the photo you see a violation of rules listed as one of the reasons this commit is made. Because it’s at the top the meme creator is presuming that’s their main priority.

And they disagree with that, so they’re calling them a “park ranger”. I’m guessing they’re alluding to an old but common media presentation of park rangers being childish about rules.

I get the joke with that it looks a bit odd to put that reason at the top of the list, but their response I find more unkind than funny

loutr,
@loutr@sh.itjust.works avatar

It’s a scene from The Big Lebowski, right after The Dude got tortured with a marmot by German nihilists. Walter focuses on the legality of keeping a marmot as a pet, which is obviously not the main issue.

Boomkop3,

Yea, I’ve seen that kind of humour in my grandpa’s movies sometimes too. Not my thing

loutr,
@loutr@sh.itjust.works avatar

The Big Lebowski is the pinnacle of humour! Now get off my lawn!

cypherpunks,
@cypherpunks@lemmy.ml avatar

As the image transcript in the post body explains, the image at the bottom is a scene from a well-known 1998 film (which, according to Wikipedia, was in 2014 selected for preservation in the United States National Film Registry by the Library of Congress as being “culturally, historically, or aesthetically significant”).

This meme will not make as much sense to people who have not seen the film. You can watch the referenced scene here. The context is that the main character, The Dude (played by Jeff Bridges) has recently had his private residence invaded by a group of nihilists with a pet marmot (actually portrayed by a ferret) and they have threatened to “cut off his Johnson”. In an attempt to express sympathy, The Dude’s friend Walter (played by John Goodman) points out that, in addition to the home invasion and threats, the nihilists’ exotic pet is also illegal. The Dude’s retort “what, are you a fucking park ranger now” is expressing irritation with that observation, because it is insignificant compared with the threat of the removal of his penis.

This meme attempts to draw a parallel between this humorous scene and XZ developer Lasse Collin’s observation that the XZ backdoor was also a violation of Debian’s software licensing policies.

Thank you for reading my artist’s statement.

computergeek125,

I don’t think I’ve seen that movie, so that explains why I missed the joke

Boomkop3,

I just don’t like derogatory jokes

Galli,

I can excuse attempting to compromise millions of computer systems worldwide for nefarious purposes but I draw the line at violating the contributor guidelines of an opensource project.

xilliah,

Scene (invidious)

lefixxx,

Its like saying bank robbery is against bank’s gun carrying policy.

Sure its true, but thats not really the problem being addressed. The massive, notorious security vulnerability is.

lefixxx,

Oh the big lebowsky part, i dont get it either

Boomkop3,

I got that part, which is funny. The movie below tho, I don’t think is

DmMacniel,

Far out

xantoxis,

Well, I think they should revoke that guy’s PGP key

computergeek125,

Isn’t the point of PGP/GPG that there’s no central database?

Bene7rddso,

Yes, he will always be able to prove that’s it’s him. But if they revoke the permissions of that key he can’t do any more damage

unreasonabro,

What’s even going on here? cuz it looks like we’re trying to suggest that somebody having a way into your system when you don’t want them there isn’t a problem, but that’s retarded

Wooki,

The binaries had part of the source hidden in them implying it was closed source code. But it wasnt compiled code its just poorly obfuscated code. The pattern is pretty simple.

SnotFlickerman,
@SnotFlickerman@lemmy.blahaj.zone avatar

Oh please, dear? For your information, the Supreme Court has roundly rejected prior restraint.

Plasma,

Backdoors are bad for security 😆😆

shootwhatsmyname,
@shootwhatsmyname@lemm.ee avatar

oh dang removes backdoor from my house

unreachable,
@unreachable@lemmy.world avatar

OnlyFansrontDoor

Potatos_are_not_friends,

Hell yeah. Make the windows difficult to enter, and now you have a singular point of entry.

Then put a gun turret there.

frezik,

Your house isn’t truly secure until you have a lava moat, and other ideas I came up with when I was eight.

eatham,
@eatham@aussie.zone avatar

Just remove the windows

waspentalive,

Don’t remove the back door from your house, bar it with a sturdy 2x4 that holds it closed. Just be sure to use a 2x4 that is not made weak by the application of a specific chemical that only the secret bad guy knows about.

unionagainstdhmo,
@unionagainstdhmo@aussie.zone avatar

Didn’t some pro-gun idiots suggest removing back doors from American schools

Liz,

I’m pro gun and that’s a laughably stupid idea for about a million reasons.

RedWeasel,

Seriously. If you are going to do it, write in assembly or something else no one understands.

Ineocla,

Tbh jia tan really wasn’t lucky some mf at Microsoft noticed a 500ms delay in ssh. The backdoor was so incredibely clever and Well hidden and ingenious i almost feel bad for him lmao

Vilian,

the guy was even in microsoft he was at his house testing debian

conditional_soup,

A really good point I heard is: this was likely a state actor attack, so how many others just like this are out there, undiscovered?

B0rax,

Unpopular opinion: what if it was not a state actor and just some bored person somewhere that thought it would be cool to own a bot net?

What if this is just one of many backdoors and it’s just the only one we found?

agent_flounder,
@agent_flounder@lemmy.world avatar

Nobody is both that bored and that motivated. Unless paid.

B0rax,

You forget that a lot of brilliant open source projects are one man shows from geniuses somewhere around the world. They are usually not paid.

In the other hand, if you get your hands on a powerful botnet, you can rent out its services (like ddos for example) for quite a bit of money.

GissaMittJobb,

Realistically I think it’s probably easier to acquire a botnet of less secure systems. This was a targeted attack.

B0rax,

Easier, yes. But some people will do stuff because it is more challenging.

PapstJL4U,
@PapstJL4U@lemmy.world avatar

The design is Moriarty lvls of complex. State actor might be too specific, but everything but a group of people would be highly unlikely.

InputZero,

Yeah, well that’s just, like, your opinion, man. (You mentioned the word opinion in a post referencing The Big Lebowski. I had to. Thank you for coming to my shit post.)

thisisbutaname,

I heard that person actively contributed for something like 2 years, providing actually useful contributions, to gain the level of trust needed to plant that backdoor. Feels a bit too much to chalk it up to boredom.

As for the second part, that’s an interesting question. Are there lots of backdoors and we just happened to notice this one, or are backdoors very rare exactly because we’d have found them out soon like in this case?

Appoxo, (edited )
@Appoxo@lemmy.dbzer0.com avatar

You’d be surprised what I manage with motivation and boredom.
You’d be surprised what a highly skilled scalled person can manage to achieve.

Boredom, Skills and Motivation are dangerous things to have if improperly handled.

neeeeDanke,

highly scalled person

You might be on to something, it might have been the lizzard people!

trolololol, (edited )

Another speculation from the suse team was a private company with intent to sell the exploit to state across actors

I think there’s lots of known backdoors that are not publicly disclosed and privately sold.

But given the history of cves in inclined to believe most come from well intentioned developers. When you read the blogs from the Google security team for example, it’s interesting to see how you need to chain a couple exploits at least, to get a proper attack going. Not in this case, it would make it very straightforward to accomplish very intrusive actions.

SzethFriendOfNimi,

It’s scary to think about… a lot of people are now thinking about how we can best isolate our build test process so it works as a test suite but doesn’t have any way to interact with the output or environment.

It’s just blows my mind to think of the levels of obfuscation this process used and how easy it would be to miss it.

RegalPotoo,
@RegalPotoo@lemmy.world avatar

Jia Tan probably wasn’t one person - most likely the identity was operated by a team of people at an intelligence agency, probably Russian or Chinese

OurToothbrush, (edited )

Any sources there or do you just lie for fun?

Edit: an article on this kind of behavior:redsails.org/false-witnesses/

kieron115,

All they did was offer an opinion, chill.

winterayars,

There’s a high likelihood it was Russian or Chinese work tbh. That’s a pretty reasonable take.

TheGalacticVoid,

I’m surprised that nobody suggested that he was a kidnapped dev. This seems like a different implementation of the pig butchering scams that target ordinary people.

davel,
@davel@lemmy.ml avatar

https://lemmy.ml/pictrs/image/0597e652-3d6e-4c51-8912-169f4a13dcf1.jpeg

TheGalacticVoid,

I wasn’t joking.

A good chunk of scam calls and texts come from people who themselves are victims of kidnapping. Many of those victims (primarily in Asia) got into the position they were in because they were looking for work, went to a different country to start a promised job, and then got trapped and forced to work for scam centers that do social engineering attacks.

These scam centers are sophisticated to the point where they can develop very legitimate-looking crypto trading platforms for targets in the US and other wealthy countries. They then assign one of the kidnapped people to a target. These kidnapped people then social engineer their way for months to get what their captors want - usually money in the aforementioned trading platform. Then, they cut all contact once they have control of the funds.

How does this relate to XZ? Well, if they can kidnap ordinary people looking for jobs, there’s not much stopping them from including devs in their pool of targets. Afterward, it’s just a rinse and repeat of what they’d done before.

If you want to look more into pig butchering, John Oliver has a great episode on it.

davel,
@davel@lemmy.ml avatar

You don’t kidnap extremely highly skilled internet malware developers and force them to code for you, you just pay them appropriately.

TheGalacticVoid,

The malware, sure, but you’re ignoring how they were able to push the malware in the first place.

Iapar,

Jupp. If you trap someone highly skilled and give that person a weapon, the chances are good that this person will use that against you.

Like how does a less skilled person know that this code will not send location to the police with a message?

TheGalacticVoid,

A bit late, but the police are often paid by captors, so calling the police just leads to punishment.

ElCanut,

Aggressively writes a backdoor in COBOL

Bene7rddso,

Assembly wouldn’t run on multiple architectures

RedWeasel,

Neither does the blob it downloaded. Would you think twice about AVX10 support if it was commented as AVX10 support in a compression library? Some might, but would they be the ones reviewing the code? A lot of programs that can take advantage of “handwritten” optimizations, like video decoders/encoders and compression, have assembly pathways so it will take advantage of the hardware when it is available but run when it isn’t. If the reviewers are not familiar with assembly enough something could be snuck in.

systemD is using dlopens for libraries now and I am not convinced malware couldn’t modify the core executable memory and stay resident even after the dl is unloaded. Difficult, yes, but not impossible.

Wooki,

Whoa hol up.

Write the build script in assembly?

Thats not okay man.

RedWeasel,

No, it this case the backdoor. Hide it in plain sight.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • programmerhumor@lemmy.ml
  • kavyap
  • mdbf
  • tacticalgear
  • osvaldo12
  • InstantRegret
  • DreamBathrooms
  • cubers
  • magazineikmin
  • thenastyranch
  • khanakhh
  • Youngstown
  • slotface
  • rosin
  • ethstaker
  • JUstTest
  • tester
  • GTA5RPClips
  • Durango
  • modclub
  • Leos
  • ngwrru68w68
  • everett
  • anitta
  • cisconetworking
  • provamag3
  • normalnudes
  • megavids
  • lostlight
  • All magazines
    •