Understanding the Linux Backdoor: Implications for Open Source [When Penguins Cry]

Dave's Garage

4 Apr 202410:06

Summary

TLDRThe video discusses a recent SSH vulnerability back door found in Linux, inserted by a developer in XZ utils versions 5.60 and 5.61. This back door allows anyone with the private key to gain unfettered root access to any Linux system running the exploit. The video highlights the importance of security in open source and closed source systems, and shares a personal anecdote from the speaker's time at Microsoft, emphasizing the significance of thorough code review and build processes in preventing such security breaches.

Takeaways

🔑 A new SSH vulnerability back door has been discovered in Linux, which if exploited, allows unauthorized access to any Linux system without a password.
💡 The back door was inserted by checking in a code that searches for a private key, providing the attacker with root access if they possess the corresponding public key.
🛠️ The vulnerability was introduced in the XZ utils, specifically versions 5.60 and 5.61, which are considered bleeding edge and not widely adopted yet.
📈 A Microsoft employee who works on benchmarking discovered the SSH login delays and further investigation led to the detection of the back door.
🤔 The incident raises questions about the security of open-source versus closed-source systems and whether one is more protected against such vulnerabilities.
🔍 The back door was not easily detected because it was inserted as encrypted and compressed binary data, not as a change to the source code itself.
🚧 The complexity and obtuseness of make files made it difficult to spot the malicious changes, which were added via the build process.
🛑 The vulnerability would have been catastrophic if not detected early, as it could have been exploited by nation-states or other malicious actors.
📚 The speaker shares a personal anecdote from 1993 about an intern who inserted a prank command line switch into MS-DOS, highlighting the importance of code review.
🏛️ The speaker suggests that structured processes and checks and balances, as seen in commercial software development, can help catch and prevent such vulnerabilities from making it into production.

Q & A

What is the main topic of discussion in the video?
-The main topic of discussion is a new SSH vulnerability back door that was inserted into Linux, its implications, how it works, and a comparison between open source and closed source systems in terms of security.
What is the potential impact of the Linux SSH back door if it had not been detected early?
-If the Linux SSH back door had not been detected early, it would have been catastrophic for Linux systems as it would allow an attacker with the private key to gain unfettered root access to any Linux system running the exploit without needing a password.
How was the back door inserted into the Linux system?
-The back door was inserted by one of the main developers of XZ utils who checked in encrypted and compressed binary data that was decrypted and inserted into the build process via the make file, without modifying the source code directly.
Which versions of XZ utils were affected by the back door?
-The affected versions of XZ utils are 5.60 and 5.61.
How was the back door in Linux discovered?
-The back door was discovered by a Microsoft employee who was running benchmark tests on the PostGIS database and noticed that SSH logins were taking longer than usual. His investigation led to the discovery and publication of the back door.
What is the speaker's opinion on whether open source or closed source systems are better protected against back doors?
-The speaker believes that the source code itself is not as relevant as the processes and checks in place. While open source code is accessible for review, the actual protection against back doors depends on the scrutiny and verification processes, which may be more rigorous in closed source systems like Windows.
What was the speaker's experience with a back door in Microsoft DOS 6.2?
-During an internship at Microsoft, the speaker was unaware of a fellow intern who inserted a special command line switch in the copy command to print 'I love sex' repeatedly. This was caught in a manual source code review and the intern was not invited back.
How does the speaker suggest that such back doors can be caught in closed source systems?
-The speaker suggests that in closed source systems like Windows, there are multiple layers of review and verification tests that any change to the product must go through. This includes build lab testing, basic verification tests, and performance benchmarks, which can catch significant changes that could indicate the presence of a back door.
What is the speaker's conclusion on the effectiveness of processes in preventing back doors?
-The speaker concludes that while processes and checks and balances cannot guarantee catching every back door, they significantly increase the chances of detection due to mandatory reviews and tests, making people more honest and reducing the potential for harm.
What is the speaker's personal experience with code reviews in the past?
-The speaker shares that during his time at Microsoft, he was involved in code reviews where changes were carefully scrutinized, especially for critical components. He suggests that the level of scrutiny might vary depending on the popularity and关注度 of the part of the system being modified.
What is the speaker's final message to the viewers?
-The speaker thanks the viewers for joining him and encourages them to leave a subscription and a like if they found the episode informative or entertaining. He also promotes his book on autism for those who are on the spectrum or know someone who is.

Outlines

00:00

🔒 The Hidden Dangers of Backdoors in Linux and MSDOS

Dave Plummer, a retired operating systems engineer from Microsoft, shares alarming incidents of backdoors inserted into Linux and MSDOS. He details a recent discovery of a backdoor in Linux's SSH, allowing attackers unfettered root access to systems without needing a password. This vulnerability stems from malicious code inserted into XZ utils, which, if undetected, could have had catastrophic implications for Linux users worldwide. Dave contrasts this with his early days at Microsoft, recounting a colleague's attempt to insert a non-malicious 'easter egg' into MSDOS. Both stories underline the perpetual risk and vigilance required to safeguard operating systems from internal and external threats.

05:01

🔎 Open vs. Closed Source Security: A Comparative Analysis

Exploring the implications of the Linux SSH backdoor further, Dave Plummer debates the effectiveness of open versus closed source models in preventing such vulnerabilities. He argues that the visibility of source code, as in open source projects, does not necessarily guarantee security, citing the complexity of reviewing changes in make files and the overall scrutiny process. Drawing on his Microsoft experience, he outlines the rigorous review and testing processes in closed source development that might better catch such vulnerabilities. Dave shares a personal anecdote from his internship at Microsoft, illustrating the potential for mischief within development teams and highlighting the importance of oversight and review processes in software development.

10:02

🛡️ Lessons Learned and Closing Thoughts

In the final segment, Dave Plummer reflects on the broader implications of software vulnerabilities and the importance of vigilance in development processes, regardless of the open or closed source model. He emphasizes that while processes and checks are crucial for preventing unauthorized changes, a mix of luck and diligent oversight has historically kept major backdoors out of systems like Windows. Dave's insights offer valuable lessons on the complexities of software security and the ongoing need for comprehensive review mechanisms to protect against vulnerabilities.

Mindmap

Keywords

💡SSH vulnerability

SSH, or Secure Shell, is a protocol used for secure communication over an unsecured network. In the context of the video, an SSH vulnerability refers to a security flaw or weakness that has been intentionally inserted into the Linux system, allowing unauthorized access with a specific private key. This vulnerability is critical as it can provide an attacker with unfettered root access to any Linux system running the exploit, bypassing standard authentication methods and posing a severe threat to system security.

💡Back door

A back door in software refers to a hidden method or feature that allows access to the system without following the normal authentication process. In the video, the term is used to describe a malicious code inserted into the Linux system that enables unauthorized access via SSH. The back door is particularly dangerous because it grants the attacker root access, giving them complete control over the compromised system.

💡Private key

In cryptography, a private key is a piece of information that is kept secret and is used to decrypt messages encrypted with the corresponding public key. In the context of the video, the private key is built into SSH and is used to access the back door in the Linux system. Only those with the private key can exploit the vulnerability and gain unauthorized access to the system.

💡Public key

A public key is a cryptographic key that is made available to others and used to encrypt messages that only the corresponding private key can decrypt. In the video, the public key is incorporated into the SSH of the Linux system, enabling the private key holder to authenticate and gain access. The public key, in this case, is a part of the malicious code that facilitates the back door.

💡XZ utils

XZ utils is a software library and command-line tools for data compression. In the video, it is mentioned that the back door in Linux was introduced through a code change in the XZ utils, specifically versions 5.60 and 5.61. This indicates that the attack vector was not through the core Linux system but through a peripheral utility that is used for compression.

💡Make file

A make file is a file that contains instructions on how to compile and build software. It is used with the 'make' utility to automate the process of building applications. In the context of the video, the make file was manipulated to include encrypted and compressed binary data that inserted the public key into the SSH build process. This change was not obvious and went undetected in the source code review.

💡Open source

Open source refers to a type of software licensing where the source code is made publicly available for anyone to view, modify, and distribute. The video discusses the relative security of open source systems compared to closed source systems in the context of back door vulnerabilities. While open source allows for community scrutiny, the video suggests that this does not guarantee the absence of vulnerabilities, as seen with the Linux back door.

💡Closed source

Closed source, also known as proprietary software, refers to software whose source code is not made publicly available. The video contrasts closed source with open source, discussing the protective measures that might be in place in a closed source environment, such as rigorous testing and review processes, which could potentially catch vulnerabilities like the one found in Linux.

💡Benchmarking

Benchmarking is the process of evaluating the performance, reliability, or other attributes of a system or component by running standard tests and comparing the results to a benchmark. In the video, benchmarking is what led to the discovery of the Linux back door, as a Microsoft employee noticed that SSH logins were taking longer than usual, prompting further investigation.

💡Regression testing

Regression testing is a type of software testing that ensures that newly added code has not adversely affected the existing functionality of the software. In the video, regression testing is mentioned as a process that would likely have caught the Linux back door vulnerability if it had been part of a closed source development process, as it would have detected the significant impact on the login process.

💡Code review

Code review is the process of examining source code changes to detect errors, improve code quality, and ensure that the changes align with project requirements. In the video, the lack of thorough code review is highlighted as a factor that allowed the back door to be inserted into the Linux system, as the malicious code was not detected during the review process.

Highlights

A new SSH vulnerability back door has been discovered in Linux systems.

The back door allows an attacker with the private key to log into any affected Linux system without a password.

The vulnerability provides root access, giving the attacker unfettered access to the system.

The back door was inserted by checking code into XZ utils, which is used in the build process of Linux.

The malicious code was inserted in versions 5.60 and 5.61 of XZ utils, affecting bleeding-edge builds.

The back door was not immediately obvious due to its clever insertion via encrypted and compressed binary data.

The vulnerability was detected by a Microsoft employee running benchmarks on the PostGIS database.

Open source versus closed source systems were discussed in terms of their susceptibility to such back doors.

The importance of rigorous code review and build processes in commercial releases was highlighted.

The potential protective nature of having multiple layers of review and testing in closed source systems was mentioned.

The speaker shares a personal anecdote from 1993 about an intern who inserted a prank command into MS-DOS.

The prank could have been caught by thorough manual source code review, which is more common in commercial software development.

The speaker asserts that throughout their career at Microsoft, no back doors were inserted into Windows.

The importance of processes, checks, and balances in software development to prevent malicious code insertion was emphasized.

The speaker concludes by appreciating the audience for their attention and participation.