Jens 2001db8

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Hacks

Some hacks around using NVIDIA GPU for Jellyfin Container with QNAP

Make sure you have NVIDIA driver installed already

Check NVIDIA Driver Path

find /share/ -name "NVIDIA_GPU_DRV"

↗️ This gist has been transferred to tailscale-dev/deck-tailscale

Initial checks

Start by checking that there aren't any previous ssh keys inside the FIDO2 authenticator of your YubiKey. You can check if they exist by running the command below:

nix shell nixpkgs#yubikey-manager -c ykman fido credentials list

If the command above outputs a string mentioning "ssh" or "openssh", then you have already got a key generated and store on your YubiKey.

Evaluating additional authentication factors

Before generating a new ssh key to store on your YubiKey you must consider which additional required authentication factors you want to use. Below you can see a table with the available factors and their corresponding command:

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Proxmox - Email Alerts Setup (gmail)

SSH into proxmox node and become root user. Run the following commands to download extra software dependencies we'll need.
```
apt update
apt install -y libsasl2-modules mailutils
```
Enable 2FA for the gmail account that will be used by going to security settings

Think twice before abandoning Xorg. Wayland breaks everything!

Hence, if you are interested in existing applications to "just work" without the need for adjustments, then you may be better off avoiding Wayland.

Wayland solves no issues I have but breaks almost everything I need. Even the most basic, most simple things (like xkill) - in this case with no obvious replacement. And usually it stays broken, because the Wayland folks mostly seem to care about Automotive, Gnome, maybe KDE - and alienating everyone else (e.g., people using just an X11 window manager or something like GNUstep) in the process.

As 2024 is winding down:

There are several ways to clone a repository from github. Similar from other providers, such as bitbucket, gitlab, etc.

https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols

Mostly, we use

http
ssh

Sample clone commands:

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

	set -l data_status (curl -s https://iceportal.de/api1/rs/status)
	set -l data_trip (curl -s https://iceportal.de/api1/rs/tripInfo/trip)
	# next stop
	echo  (echo $data_trip \| jq -r '([ .trip.stops[] \| select(.info.passed==false) ]
	\| first).station.name')
	# train number
	echo  (echo $data_trip \| jq -r '"\(.trip.trainType)-\(.trip.vzn)"')
	# speed
	echo speed (echo $data_status \| jq -r '"\(.speed) km/h"')