Cybereason issues Threat Alerts to inform customers of emerging impacting threats, including critical vulnerabilities. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them.
A sophisticated backdoor has been discovered in the open source compression library XZ Utils versions 5.6.0 and 5.6.1 for Linux Operating Systems.
XZ is a widely used compression format in Linux, found in most distributions, both open-source and commercial. It compresses large files into smaller sizes, making them easier to share and transfer.
This supply chain attack targets to compromise the integrity of Secure Shell (SSH) - a cryptographic network protocol used to operate systems using remote command execution over an unsecured network.
This vulnerability is being tracked as CVE-2024-3094, and has been assigned CVSS score of 10 out of 10. The backdoor is suspected to have the capability to completely compromise the integrity of the encrypted communications channel of SSH and take over the machine that has a vulnerable XZ Utils library installed.
Currently impacted systems are Linux distributions with the majority of the vulnerable libraries being on the development/experimental branches of the distribution release channels.
The following is a list of Linux Operating Systems susceptible to this vulnerability, as available in the following link:
|
Distribution |
Affected Branches |
Affected Packages |
Remediation |
|
40, 41, Rawhide (active development) |
xz-5.6.0-* xz-5.6.1-* |
Fedora 40 BETA Distribution – Update to latest version (5.4.x). Fedora 41 & Rawhide – Stop using immediately. |
|
|
testing, unstable (sid), experimental |
xz-utils 5.5.1alpha-0.1 (uploaded on 2024-02-01), up to and including 5.6.1-1 |
Update to latest version (5.6.1+really5.4.5-1) |
|
|
Edge (active development) |
xz 5.6.1-r0, 5.6.1-r1 |
Update to latest version (5.6.1-r2) |
|
|
N/A |
xz-utils 5.6.0-0.2 (Kali installations updated between March 26th to March 29th) |
Update to latest version (5.6.1+really5.4.5-1) |
|
|
Tumbleweed |
xz-5.6.0, xz-5.6.1 |
Update to latest version (5.6.1.revertto5.4) |
|
|
N/A |
xz 5.6.0-1 |
Update to latest version (5.6.1-2) |
Cybereason Global Security Operations Center (GSOC) Team is conducting proactive threat hunting in the scope of the Cybereason Managed Detection and Response (MDR) service to identify any potential exploitation of these vulnerabilities to be able to detect any compromise before.
Supply chain attacks aim to compromise an organization by targeting a 3rd party trusted software component used in the organization's IT infrastructure. Cybereason has written about Supply chain attacks on multiple occasions with one of the most notable examples being the Solarwinds supply chain compromise.
Free and Open Source Software (FOSS) is often thought of as being more secure than closed source software, due to the source code being made available for public scrutiny. FOSS projects rely on a team of dedicated developers that is often overstretched and overworked to maintain the software that often integrates with the OS of critical systems. Although FOSS source code is publicly available a lot of projects rarely receive code reviews that check the security of their codebase.
XZ Utils is a set of free software command-line lossless data compressors, and almost ubiquitous in Linux. XZ Utils plays a vital role in compressing and decompressing data for various operations. Additionally, it supports the legacy lzma format, allowing for compatibility with older systems. To put it plainly, XZ Utils is a vital part of Unix systems and is widely used. The XZ utils project is hosted in the public code repository Github. The XZ-utils distribution is used as a core system module in many OS distributions, providing native support for the Linux operating system to handle xz and lzma compressed file formats.
On Friday the 29th of March 2024, a backdoor was identified in XZ Utils library and publicly disclosed by Andres Freund (Principal Security Engineer at Microsoft and PostgreSQL developer and maintainer). This vulnerability allows an attacker to utilize a predefined encrypted private key to run commands on the victim machine as root. This vulnerability was introduced by a sophisticated supply chain attack which occurred over the course of approximately two years. During these two years the team that maintained the XZ Utils repository had been joined by user "JiaT75", who established themselves as a reputable contributor to the open source project, but ultimately introduced this backdoor that was pushed to end users in XZ Utils versions 5.6.0 and 5.6.1, while reducing the security checks in projects such as OSS-Fuzz with the objective of hiding the backdoor.
This backdoor was introduced to the open source project through two "test files", which contain the payload; and a modified m4 script (m4/build-to-host.m4) which initiates the process of loading the payload. The test files were added to the open source project first and could be found in the git repository. The m4 modification, however, was only made in the github tarball, and is not checked into git. The build process of the vulnerability can be summarized is as follows:
A malicious script build-to-host.m4 is run during the library’s build process on the victim host, and decodes the “test” file bad-3-corrupt_lzma2.xz into a bash script, located at "tests/files/bad-3-corrupt_lzma2.xz".
The bash script then carries out a more complex decode process on an additional “test” file, good-large_compressed.lzma, decoding it into another script.
That script then extracts a shared object, liblzma_la-crc64-fast.o, which is added to the compilation process of liblzma.
The backdoor is complex, consisting of multiple stages executed during the build process and the full capabilities and inner workings of the backdoor are still being analyzed by security researchers. The backdoor employs code obfuscation, anti-analysis and conditional execution methodology to avoid detection. The execution of the payload is itself a multi-step process:
The payload uses the GNU indirect functions (ifuncs) like a switchboard operator for a program. This allows a program to choose between different versions of a function at runtime. The intended use case for this is for situations where there are multiple possible implementations of a function, each optimized for a different type of hardware or a different set of system conditions. This decision is made very early on, even before the main part of the program is executed, which allows for a dynamic modification of the process execution. This is like deciding which tools you are going to use before you start building something.
The payload uses audit hook modification. An audit hook is a tool that can change a program's map GOT (Global Offset Table) of functions to memory addresses. This function is normally used for security purposes (to prevent buffer overflows), however in this case attackers can use it to redirect function calls to harmful code, even after the program has started and initial linking is done. It's like changing the directions on the map while someone is already on their way. This allows the attacker to change what the program does while it's running.
In this case an audit hook is used to get visibility and control over the dynamic linking process that is required to trigger the backdoor, while ifunc provides the mechanism for conditional function redirection. Think of an ifunc as a traffic light which can redirect cars (functions) based on certain conditions.
The combination of those allowed the attacker to load into the GOT while the table is still editable and replace the OpenSSL’s (open source toolkit for general-purpose cryptography and secure communication) function RSA_public_decrypt with the backdoored version. This function is used normally in OpenSSH to validate the key pre-authentication, however now instead points to the attacker's own malicious code which verifies that the connection is coming from the Attacker (via asymmetric key exchange), and extracts the commands from the authenticating client's certificate. This achieves full pre-authentication remote code execution by the attacker.
The Backdoor is triggered by connecting to the victim host with an SSH certificate, with a payload in the Certificate Authority (CA) signing key N value. The payload is encrypted using the attacker’s ED448 key. When a certificate exchange occurs, the Backdoor will check to see if the certificate has been signed by the attacker, and if confirmed, will carry out the remaining steps. However, if the Backdoor fails to verify that the SSH certificate is the Attacker, the Backdoor will return to normal functionality, rendering the detection of this Backdoor even more difficult.
Once the Backdoor has verified that the SSH certificate is from the Attacker, the payload located in the CA signing key N value is decrypted. The command from the payload is then passed to system() and is executed as root. Thomas Roccia (Sr. Security Researcher at Microsoft) has prepared the following two graphics that break down the discovery and the execution of the backdoor.
Executable binaries can be influenced by the libraries they are linked to. It is a common practice for developers to link executables to requisite libraries. In the case of Debian and numerous other Linux distributions, the sshd (Secure Shell Daemon - a background process that handles SSH connections) is linked to liblzma, which provides the XZ Utils with the capability to manipulate the behavior of sshd.
At present, the backdoor’s goal is to be integrated into the Secure Shell Daemon (sshd) on the susceptible system, thereby granting a remote attacker the capability to execute arbitrary code. This means that any system with the compromised package that has SSH exposed to the internet could be at risk to remote code execution with root privileges.
sshd process loading liblzma module (in this case non vulnerable 5.2.2 version) as seen on the Cybereason investigation screen (process element)
One can use these module names to identify if the backdoor is present on the system:
In order for the key exchange to take place, the attacker’s public key is located in the binary of the lzma file.
—-------------------------------------------------------------------
0a 31 fd 3b 2f 1f c6 92 92 68 32 52 c8 c1 ac 28
34 d1 f2 c9 75 c4 76 5e b1 f6 88 58 88 93 3e 48
10 0c b0 6c 3a be 14 ee 89 55 d2 45 00 c7 7f 6e
20 d3 2c 60 2b 2c 6d 31 00
---------------------------------------------------------------------
Cybereason has compiled a list of over 60 SHA256 hash signatures associated with this vulnerability (This list is being updated and modified as our research continues).
Brian Fox, Security Operations Analyst at Cybereason
Brian is a senior Analyst with the Cybereason Global SOC Team. Brian’s primary focus is on Threat Hunting, Malware Analysis and Extended Detection and Response. Brian has a background in Mobile Forensics for the Irish Police Force and has been working in CyberSecurity for international security firms for over 2 years.
Ruslan Rustchev, Global SOC Manager EMEA at Cybereason
Ruslan is leading the Cybereason Global Security Operations Center team in EMEA and managing a team of analysts delivering Managed Detection and Response Service.
Cybereason is dedicated to teaming with Defenders to end cyber attacks from endpoints to the enterprise to everywhere. Learn more about Cybereason XDR powered by Google Chronicle, check out our Extended Detection and Response (XDR) Toolkit, or schedule a demo today to learn how your organization can benefit from an operation-centric approach to security.
Raspberry Robin involves a worm that spreads over USB devices or shared folders, leveraging compromised QNAP (Network Attached Storage or NAS) devices as stagers and an old but still effective method of using “LNK” shortcut files to lure its victims...
Cybereason discovered an undocumented RAT dubbed StrifeWater attributed to Iranian APT Moses Staff who deploy destructive ransomware following network infiltration and the exfiltration of sensitive data...
