This study focuses on the strategies used by the "xz backdoor", an extremely
complex piece of malware that contains its own x64 disassembler inside of it
to find critical locations in your code and hijacks it by swapping out your
code with its own as it runs. Because this a machine-code based attack,
all code written in any program language can be attacked and is vulnerable.
Instead of targeting sshd directly, the xz
backdoor injects itself in the parent systemd process then hijacks the
GNU Dynamic Linker (ld), before sshd is even started or libcrypto.so is
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?xml version="1.0"?> | |
<project name="Demo" default="version" basedir="."> | |
<macrodef name="git"> | |
<attribute name="command" /> | |
<attribute name="dir" default="" /> | |
<element name="args" optional="true" /> | |
<sequential> | |
<echo message="git @{command}" /> | |
<exec executable="git" dir="@{dir}"> |