The Linux Hack was an inside job…

TechLinked

3 Apr 202410:28

Summary

TLDRThe video discusses a serious security back door discovered in a widely used Linux compression utility, XZ utils, by developer Andres Frey. The malicious code, which could allow unauthorized remote access, was detected before causing widespread issues. Additionally, the video covers Amazon's decision to abandon its cashierless checkout system in favor of Dash Carts and Google's agreement to delete a large store of web data collected via Chrome's incognito mode, updating their privacy policy to better inform users of data collection practices.

Takeaways

🔍 A serious security back door was discovered in a widely used compression utility for Linux, XZ utils, by developer Andres Frey from Microsoft.
🕵️‍♂️ The vulnerability was found by chance during micro benchmarking, which revealed excessive CPU usage with encrypted logins related to the exed compression library.
🚨 The malicious code was present in beta releases for Fedora Rawhide, Debian, and a stable release of Arch Linux, but was caught before widespread exploitation.
💡 The back door functioned by injecting code during SSH authentication, potentially allowing unauthorized remote access.
👤 The code appears to have been introduced by one of XZ utils' primary developers, giaan AKA GIA, who had been contributing since 2021.
🤔 It is theorized that GIA's involvement may have been part of a long-term scheme to gain increasingly invasive permissions within the project.
🛒 Amazon is discontinuing its cashierless checkout system, 'Just Walk Out', in its fresh grocery stores due to reliance on human oversight.
👁️ Amazon's system required an estimated 70% of sales to be reviewed by human monitors, contrary to the fully automated impression the company had given.
📃 Google has agreed to delete a large cache of web data collected while users browsed in Chrome's incognito mode as part of a class action lawsuit settlement.
🔒 Google will also update its privacy policy and incognito mode landing page to clarify that data collection continues regardless of browsing mode.
🏅 Qualcomm's new Snapdragon X Elite laptop processors have outperformed Intel's Meteor Lake Core Ultra chips in benchmarks, showing 50% faster performance at half the power consumption.

Q & A

What security issue was discovered in a widely used compression utility for Linux?
-A serious security back door was discovered in the XZ utils, a compression utility for Linux, which could potentially allow unauthorized remote access by injecting code during SSH authentication.
Who discovered the security back door in XZ utils and how did they notice it?
-Andres Frey, a developer who works for Microsoft by day and maintains PostgreSQL by night, discovered the security back door. He noticed the issue while doing micro benchmarking during his Easter Long Weekend and observed that encrypted logins to part of the XZ utils compression library were using an unusually high amount of CPU.
Which distributions of Linux were found to have the malicious code in their beta releases?
-The malicious code was found in beta releases for Fedora Rawhide, Debian, and a stable release of Arch Linux.
What is the speculated motive behind the introduction of the malicious code in XZ utils?
-It is theorized that one of the primary developers of XZ utils, giaan AKA GIA (also known as t75), may have introduced the malicious code as part of a long con to gain increasingly invasive permissions through genuine code contributions and a pressure campaign against the original developer, Lassie Colin.
What was the original purpose of Amazon's cashierless checkout system, 'Just Walk Out'?
-The 'Just Walk Out' system was designed to allow customers to scan in at the door, take the items they want, and automatically be charged for them upon exiting the store without the need for a cashier.
How accurate was the portrayal of Amazon's 'Just Walk Out' system being fully automated?
-The portrayal was inaccurate as an estimated 70% of 'Just Walk Out' sales required a human review. The system relied on a small army of over a thousand overseas workers to monitor and review transaction footage.
What has Google agreed to do as part of a settlement in a class action lawsuit?
-Google has agreed to delete a massive store of web data collected while users browsed using Chrome's incognito mode. They have also agreed to update their privacy policy and the incognito mode landing page to explicitly notify users that data is still collected from third-party sites and apps, regardless of the browser mode.
What new security feature is Google testing to prevent unauthorized access to sensitive accounts?
-Google is testing Vice bound session credentials, a form of encryption that ties authentication cookies to the user's PC, to block malicious actors from accessing sensitive accounts by stealing and cloning a person's session credentials.
How did TSMC respond to the strongest earthquake in 25 years in Taiwan?
-Workers at TSMC returned to factories less than 24 hours after the earthquake. Within 10 hours of the earthquake, 70% of TSMC's chip operations had recovered.
What is Australia's solution to the problem of large animal detection systems failing to detect kangaroos?
-Australia is turning to virtual fences, which are activated by approaching headlights and use flashing lights and high-pitched alarms to scare animals away from roadsides.
What unusual event occurred in Naples, Florida, allegedly related to the International Space Station?
-A 2B piece of cylindrical metal, allegedly part of a 2.9-ton cargo pallet containing nine batteries that was tossed from the ISS three years ago, ripped through the roof and two floors of a home in Naples, Florida.

Outlines

00:00

🔍 Security Flaw in Linux Compression Utility

A serious security back door was discovered in a widely used compression utility for Linux, called xed utils, by Andres Frey, a developer at Microsoft. The vulnerability was found during micro benchmarking over Easter Long Weekend, when an unusually high CPU usage was detected during encrypted logins. The back door was present in xed utils, which is available for almost every Linux distribution. Fortunately, the malicious code was identified before being integrated into a major distribution's production release. It was detected in beta releases for Fedora Rawhide, Debian, and a stable release of Arch Linux. The back door functions by injecting code during SSH authentication, potentially allowing unauthorized remote access. The malicious code is suspected to have been introduced by one of the primary developers of XZ utils, giaan AKA GIA, who had been contributing to the project since 2021. Researchers are yet to find any evidence of gean's existence beyond his involvement in open-source circles.

05:01

🛒 Amazon's Cashierless Checkout System and Google's Privacy Update

Amazon is discontinuing its cashierless checkout system, 'Just Walk Out', across its chain of fresh grocery stores due to its reliance on a large number of overseas workers to monitor transactions, contrary to the fully automated impression it gave. The system used a network of cameras and sensors to track customers and charge them for items upon exiting the store. However, an estimated 70% of these sales required human review. Amazon disputes this figure, stating that reviewers primarily annotated videos for machine learning improvements. In a separate development, Google has agreed to delete a vast amount of web data collected through Chrome's incognito mode as part of a class action lawsuit settlement. Google will also update its privacy policy and the incognito mode landing page to clarify that data is still collected from third-party sites and apps, regardless of browsing mode. This follows Google's initial argument that users had implicitly consented to data collection in incognito mode because they were warned that their activity might still be visible to visited websites.

10:03

🚀 Tech Innovations and Updates

Qualcomm has released new benchmarks for its upcoming ARM-powered Snapdragon X Elite laptop processors, showing impressive performance and power efficiency, outperforming Intel's Meteor Lake Core Ultra chips, AMD's Ryzen 9 7940 HS, and even Apple's M3. This comes ahead of the processors' anticipated arrival in Microsoft's new Surface lineup. In other news, Google Podcasts will be discontinued, with users outside the US able to access podcasts until June 24th. TSMC, a major chip manufacturer responsible for 80-90% of the world's high-end chips, quickly resumed operations after a strong earthquake in Taiwan, with 70% of chip operations recovered within 10 hours. Australia is considering virtual fences to address issues with vehicle large animal detection systems, particularly with kangaroos, which have proven difficult to calibrate. Finally, a piece of space debris, allegedly from the International Space Station, crashed through a house in Naples, Florida, raising questions of liability for damages.

Mindmap

Keywords

💡Security Backdoor

A security backdoor refers to a hidden method or vulnerability in a computer system or software that allows unauthorized access or bypasses normal security measures. In the context of the video, a serious security backdoor was discovered in a widely used compression utility for Linux, which could have potentially disastrous consequences if exploited.

💡Linux

Linux is an open-source operating system that is widely used across various devices, from servers to embedded systems. In the video, the mention of Linux pertains to the discovery of a security backdoor in a utility used by many Linux distributions, highlighting the importance of open-source security and vigilance in software development.

💡Andreas Frey

Andreas Frey is a developer who works for Microsoft and maintains PostgreSQL, an open-source relational database management system. In the video, he is credited with discovering the security backdoor in the xed utils library, showcasing the role of individual contributors in maintaining the security of open-source projects.

💡SSH Authentication

SSH, or Secure Shell, authentication is a cryptographic network protocol used for secure communication and remote login to a server. In the context of the video, the security backdoor in xed utils is said to inject code during SSH authentication, which could allow unauthorized access to systems that use this protocol.

💡XZ Utils

XZ Utils is a software utility used for file compression on Linux systems. The video discusses a security backdoor found in this utility, which highlights the importance of regular security audits and updates in widely used software to prevent potential exploits.

💡GIA (gian AKA GIA)

GIA, also known as 'gian', is one of the primary developers of XZ Utils. The video suggests that this individual may have introduced the security backdoor, either intentionally or due to their system being compromised, raising concerns about the security of open-source projects and the trust placed in their developers.

💡Amazon Go

Amazon Go is a cashierless checkout system used by Amazon in its chain of grocery stores. The system relies on cameras and sensors to track customers and charge them for items they take. The video discusses the challenges faced by this system, including the need for human review of transactions, which contradicts the initial promise of a fully automated shopping experience.

💡Dash Cart

Dash Cart is a system that combines a shopping cart with self-checkout features. It tallies up items as they are added to the cart. In the video, it is mentioned as the next step Amazon will take to move towards a cashierless shopping experience, following the challenges faced with Amazon Go.

💡Incognito Mode

Incognito mode is a privacy feature in web browsers that aims to prevent the browser from storing information about the user's browsing activity. The video discusses a class-action lawsuit against Google for collecting data while users browse in incognito mode, highlighting the gap between user expectations of privacy and actual data collection practices.

💡Session Credentials

Session credentials are data that authenticates a user's session on a website or application. In the context of the video, Google is testing vice-bound session credentials to prevent unauthorized access by blocking malicious actors from stealing and cloning a person's session credentials, enhancing account security.

💡TSMC

TSMC, or Taiwan Semiconductor Manufacturing Company, is the world's largest dedicated semiconductor foundry, producing high-end chips for various technology companies. The video discusses the resilience of TSMC's operations following a significant earthquake in Taiwan, emphasizing the importance of TSMC to the global chip supply.

💡Virtual Fences

Virtual fences are systems designed to deter animals from entering certain areas, such as roads, by using lights and sounds. In the video, virtual fences are mentioned as a solution to prevent collisions with kangaroos in Australia, which traditional large animal detection systems have struggled to manage effectively.

Highlights

A serious security back door was discovered in a widely used compression utility for Linux.

The security issue was flagged by developer Andres Frey, who works for Microsoft and maintains PostgreSQL.

The back door was discovered during micro benchmarking over the Easter Long Weekend.

Encrypted logins using the exed compression Library were found to be consuming an unusually high amount of CPU.

The malicious code was found in xed utils, which is available for almost every distribution of Linux.

The code was detected before being added to the production release of a major distribution.

The back door was present in beta releases for Fedora Rawhide, Debian, and a stable release of Arch Linux.

The back door works by injecting code during SSH authentication, potentially allowing unauthorized remote access.

The malicious code may have been introduced by one of XZ utils' primary developers, Giaan AKA GIA.

GIA's involvement in XZ has been suspected to be part of a long con to gain more invasive permissions.

Amazon is abandoning its cashierless checkout system at its chain of fresh grocery stores due to reliance on human monitors.

The 'Just Walk Out' system used cameras and sensors to track customers and charge them automatically.

About 70% of 'Just Walk Out' sales required human review, indicating the system was not fully automated.

Google has agreed to delete a large store of web data collected while users browsed in Chrome's incognito mode.

Google will update its privacy policy and incognito mode landing page to better inform users about data collection.

Google was sued in a class action lawsuit for data collection practices in incognito mode.

Qualcomm released new benchmarks showing their upcoming ARM-powered Snapdragon X Elite laptop processors.

The X Elite performed around 50% faster and consumed less power compared to Intel's Core Ultra chips.

TSMC announced that operations recovered quickly after Taiwan's strongest earthquake in 25 years.

Australia is turning to virtual fences to address issues with large animal detection systems in vehicles.

A piece of metal from the ISS hit a home in Naples, Florida, possibly making Japan liable for damages.