187
Did One Guy Just Stop a Huge Cyberattack? (www.nytimes.com)
submitted 5 months ago by testeronious@lemmy.world to c/linux@lemmy.ml
44 comments fedilink hide all child comments
all 45 comments
sorted by: hot top controversial new old
[-] QBertReynolds@sh.itjust.works 137 points 5 months ago* (last edited 5 months ago)

"Engineers have been circulating an old, famous-among-programmers web comic about how all modern digital infrastructure rests on a project maintained by some random guy in Nebraska. (In their telling, Mr. Freund is the random guy from Nebraska.)"

That's not quite right. Lasse Collin is the random guy in Nebraska. Freund is the guy that noticed the whole thing was about to topple.

[-] BlueEther@no.lastname.nz 52 points 5 months ago

and that one guy (Lasse) was burnt out and pressured [by jia?] to step back and let jia be the person that the whole internet infrastructure relied upon

[-] Bitrot@lemmy.sdf.org 44 points 5 months ago

Publicly pressured by sock puppets. You can see some rando doing similar in repositories for projects like Avahi.

[-] treadful@lemmy.zip 50 points 5 months ago

I suspect this was just a lucky catch of shit that happens all the time. Supply chain attacks are super scary and effectively impossible to eliminate in modern software development.

[-] Contend6248@feddit.de 28 points 5 months ago* (last edited 5 months ago)

Obviously not impossible, just the best reason for open source software

[-] treadful@lemmy.zip 31 points 5 months ago

It's almost impossible to spot by people looking directly at the code. I'm honestly surprised this one was discovered at all. People are still trying to deconstruct this exploit to figure out how the RCE worked.

And supply chain attacks are effectively impossible to eliminate as an attack vector by a developer-user of a N-level dependency. Not having dependencies or auditing every dependency is unreasonable in most cases.

[-] possiblylinux127@lemmy.zip 11 points 5 months ago* (last edited 5 months ago)

There are sysadmins that discover a major vulnerabilities though troubleshooting

The key is the number of people involved

[-] acockworkorange@mander.xyz 5 points 5 months ago

So obscure projects are fucked.

[-] possiblylinux127@lemmy.zip 5 points 5 months ago

No one cares about obscure projects from an attack perspective. What you should be worried about is the dependency chain.

[-] fruitycoder@sh.itjust.works 2 points 5 months ago

Right now the greatest level of supply chain secuirty that I know of is formal verification, source reproducible builds, and full source bootstrapping build systems. There was a neat FPGA bootstrapping proj3ct (the whole toolchain to program the fpga could be built on the FPGA) at last years FOSDEMs conference, and I have to admit the idea of a physically verifiable root of trust is super exciting to me, but also out of reach for 98% of projects (though more possible by the day).

[-] Cyber@feddit.uk 45 points 5 months ago

So, Microsoft saved everyone from the bad Linux then?

/s

[-] rollingflower@lemmy.kde.social 97 points 5 months ago* (last edited 5 months ago)

"Linux saved itself."

  • having FOSS code
  • being able to silence all system services to detect that bump
  • being able to run stuff in different ways, without a core system component (with and without systemd, as that backdoor only used data when sshd was started via systemd)
  • having people be perfectionist about performance measurements
  • having devs test upstream code not shipped to normal distros
  • being so good microsoft pays people to work on software for it
[-] possiblylinux127@lemmy.zip 14 points 5 months ago* (last edited 5 months ago)

Yeah no Microsoft saved it

[-] Entropywins@kbin.social 74 points 5 months ago

A nerd who was benchmarking their ssh connection saved it...I love everything about that fello

[-] greywolf0x1@lemmy.ml 16 points 5 months ago

Also, the man has said repeatedly on hackernews that he's a postgresql developer working at microsoft. I imagine that distinction is important.

[-] EdgelDil@lemmy.world 23 points 5 months ago

And if he was a postgresql dev working on linux but employed by the cheesecake factory it would mean that the cheesecake factory saved linux? or was that rather due to that clever dev, and helped by the platform he worked on?

[-] mcc@sh.itjust.works 4 points 5 months ago

but if cheesecake factory hired him and supported him to make this discovery, you would look at the menu differently.

[-] p03locke@lemmy.dbzer0.com 5 points 5 months ago

WTF is this whole thread?

[-] SnotFlickerman 3 points 5 months ago* (last edited 5 months ago)

Neeeeeeeeerrrrds

[-] bruhduh@lemmy.world 2 points 5 months ago* (last edited 5 months ago)

No matter how much you wouldn't like it, there's fallacy in your statement, either that single individual singlehandedly saved everyone without community and such, or Linux was saved by everyone, Microsoft included, i mean, going to such lengths in mental gymnastics just to exclude some corporation, albeit evil one, is funny i must say, in my opinion it's either single individual, or everyone included, no need to specifically exclude someone just because they evil or something, and yes, if cheesecake factory hired someone, they shouldn't be excluded too

[-] rollingflower@lemmy.kde.social 2 points 5 months ago

They wanted to get a benchmark environment as silent as possible, connected over ssh and it didnt get silent

[-] spongeborgcubepants@lemmy.world 1 points 5 months ago

A ~~nerd~~

A specialist

[-] psmgx@lemmy.world 36 points 5 months ago

You're late to the party NYT.

Also, dude made a good save. Only arch users got hit lol

[-] DumbAceDragon@sh.itjust.works 30 points 5 months ago* (last edited 5 months ago)

  1. The hack mainly targeted Debian and fedora

  2. Arch doesn't directly link openssh to liblzma, so the hack doesn't affect arch users.

[-] Revan343@lemmy.ca 7 points 5 months ago

The hack mainly targeted Debian and fedora

But on Debian it only shipped on sid. This is the reason for Debians slow as fuck release cycle

[-] qaz@lemmy.world 26 points 5 months ago

Arch didn't patch it with systemd so it didn't really affect them afaik. It did hit OpenSUSE Tumbleweed users.

[-] Disonantezko@lemmy.sdf.org 25 points 5 months ago

Do you know the exploit was detected in Debian Sid? (by a PostgreSQL developer), Arch got the update (with both compromised versions), but because don't directly link openssh to liblzma (as Debian), and thus this attack vector is not possible.

Also, other rolling distros also got the compromised versions, maybe: openSUSE Tumbleweed, Endeavour OS, Fedora Rawhide, Slackware -current, etc.

[-] seaQueue@lemmy.world 6 points 5 months ago

There was some checking in the exploit to verify that it was being built for a deb or rpm package, it didn't build for anything else. Also, the way the exploit was loaded at runtime relied on features of systemd that Arch isn't using. It was a dud on Arch.

[-] EpicFailGuy@lemmy.world 5 points 5 months ago

nothing of value was lost

[-] gnuplusmatt@reddthat.com 5 points 5 months ago

Fedora 40 testing branch and rawhide got it as well, as well tumbleweed and debian sid

[-] possiblylinux127@lemmy.zip 1 points 5 months ago* (last edited 5 months ago)

And how many people actually use those? Arch got hit the hardest

Ok that's a bad joke. The exploit targeted Debian, Ubuntu and RHEL

[-] gnuplusmatt@reddthat.com 5 points 5 months ago* (last edited 5 months ago)

I was on Fedora Kinoite 40 testing compose when it hit... so me

[-] possiblylinux127@lemmy.zip 1 points 5 months ago

You were not the target. The idea probably was to get it pushed into downstream over a longer period

[-] gnuplusmatt@reddthat.com 8 points 5 months ago

I understand that the Linux ecosystem in general was ultimately the target, yes.

I was answering "how many people use those?"

[-] lemmyreader@lemmy.ml 21 points 5 months ago

https://web.archive.org/web/20240405080123/https://www.nytimes.com/2024/04/03/technology/prevent-cyberattack-linux.html

[-] possiblylinux127@lemmy.zip 1 points 5 months ago* (last edited 5 months ago)

Thanks but Firefox already has a reading mode

[-] lemmyreader@lemmy.ml 7 points 5 months ago

Well, I had to solve three CAPTCHA puzzles before getting through to the page itself, so I figured to insert that link.

[-] possiblylinux127@lemmy.zip 1 points 5 months ago

Maybe they don't like you

[-] MossyFeathers@pawb.social 20 points 5 months ago

A picture of the man

[-] just_another_person@lemmy.world 16 points 5 months ago

Yuuuuuuup. We all owe this man beer for life.

[-] m4@kbin.social 8 points 5 months ago

It felt like it had a bit of sensationalism, which alas is not uncommon in today's journalism, but can it be too much that a major newspaper like the NYT covering this story can bring indirect attention to the problem of hugely underpaid/no paid people working on (and mantaining) critical FOSS stuff?

[-] acockworkorange@mander.xyz 5 points 5 months ago

They did claim his work is “boring to tears” right after saying it was “thankless”. What a condescending piece of shit journalist.

[-] baldturkeyleg@lemmy.world 3 points 5 months ago

Yes

[-] possiblylinux127@lemmy.zip 2 points 5 months ago

https://www.foxnews.com/tech/us-avoids-digital-security-crisis-developer-uncovers-sabotage-software

this post was submitted on 05 Apr 2024
187 points (100.0% liked)

Linux

47380 readers
660 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz