An interesting thing about the XZ sabotage is that, while it was very cleverly obfuscated (congratulations to Andres Freund for finding it!), once found, it is very clear that it's a deliberate backdoor. It can't be explained away as an ordinary bug that introduced a vulnerability.
Says something about the tradeoff space the attacker was working in.
Another notable thing: the backdoor, as far as I've been able to glean, is "NOBUS" ("nobody but us"), requiring knowledge of not just the existence of the backdoor, but also a secret key, to exploit. NOBUS backdoors would be very hard to camouflage as innocent bugs, so that could explain why the attacker chose this risky approach.
But that raises the question of why they wanted a NOBUS backdoor. A state actor trying to limit colateral risks would likely care about this.
(continuing on my thread from last week on the XZ)
The XZ compromise is getting a lot of attention for two (entirely reasonable) reasons: It backdoors an obviously important service (ssh) and it's clearly a malicious, deliberate act of sabotage, unable to be explained away as an ordinary bug. The latter is likely, as I mentioned earlier, because the attacker wanted to introduce a NOBUS backdoor, which is harder to camouflage as a careless bug.
So that raises another question...
We have no real idea how common a threat malicious developers in open source or inside proprietary systems actually are.
State actors would likely prefer NOBUS backdoors, especially in systems they themselves use, but it seems reasonable to assume that in many cases they'd happily settle for subtle general vulnerabilities that they know about from day one. And those are easy to ignore, since ALL developers introduce bugs in their code.
How many are put there on someone's behalf?
@mattblaze I wonder if the principle might be more general than just NOBUS attacks? The more something resembles a good-faith bug, the more likely it is to behave like a bug and return some unexpected result. Unexpected results make some random guy debugging a home system go "hmmmm". As we just witnessed.
Would it matter if the attacker(s) cared about burning the identity involved? Krebs mentioned that this case involved very good opsec. The identities were phantoms from the beginning.
@raven667 @mattblaze This person did a bit of detective work. "Jia Tan" wants us to think they're Chinese (the name, and they use time zone UTC+8 for their commits when they don't forget), but the pattern of when they were active suggests somebody in Eastern Europe working Monday-Friday 9am-6pm.
https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
@AndresFreundTec yes, thatās what I mean by collateral risk here. Easy to shoot yourselves in the foot with a general vulnerability.
Great work, by the way!
@fl0_id @xahteiwi @mattblaze Also probably in how they had to choose between obfuscating versus looking like an oversight, like HeartBleed's underflow ( https://youtu.be/rE5dW3BTpn4?si=9ZE5-F1gLz7FcQr8 ).
In comparison versus, say pulling a Dual Elliptic Curve ( https://youtu.be/nybVFJVXbww?si=xWfpgg9In7GSWk5m ), where the potential for a backdoor was sort of presumed in the design by people reviewing the implementation.
@mattblaze You're one of the first I've seen to analyze this in terms of the adversary's constraints. I am not a computer scientist, but in terms of constraints, resources, and targeting, this doesn't "feel" like a state actor.
So, this is highly targeted, and the social engineering tactics seemed personal. You're not getting that from a committee. And it was a long game, which would have meant supervisors coming and going, changes in priority, etc in government.
@mattblaze Ah, is that part of why intelligence types complain that the rest of the government keeps giving them side-eye?
Because yeah, that sort of unprofessional obsession...huh, Le CarrƩ really wasn't exaggerating if that's how they act.
Matt Blaze
mmzeeman
Noah Cook
Raven667
BenAveling
Robin Adams
Aaron Davis
Matt Bauman 
AndresFreundTec
gary
Florian Haas
Florian Idelberger
Alexander The 1st
Dan Riley
ShutterBugged
skry