Philip Gardner gaahrdner

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Anti-hype LLM reading list

Goals: Add links that are reasonable and good explanations of how stuff works. No hype and no vendor content if possible. Practical first-hand accounts of models in prod eagerly sought.

Foundational Concepts

Pre-Transformer Models

Base64 Patterns - Learning Aid

Base64 Code	Mnemonic Aid	Decoded*	Description
`JAB`	🗣 Jabber	`$.`	Variable declaration (UTF-16), e.g. `JABlAG4AdgA` for `$env:`
`TVq`	📺 Television	`MZ`	MZ header
`SUVY`	🚙 SUV	`IEX`	PowerShell Invoke Expression
`SQBFAF`	🐣 Squab favorite	`I.E.`	PowerShell Invoke Expression (UTF-16)
`SQBuAH`	🐣 Squab uahhh	`I.n.`	PowerShell Invoke string (UTF-16) e.g. `Invoke-Mimikatz`
`PAA`	💪 "Pah!"	`<.`	Often used by Emotet (UTF-16)

'Users hate change'

This week NN Group released a video by Jakob Nielsen in which he attempts to help designers deal with the problem of customers being resistant to their new site/product redesign. The argument goes thusly:

Humans naturally resist change
Your change is for the better
Customers should just get used to it and stop complaining

There's slightly more to it than that, he caveats his argument with requiring you to have of course followed their best practices on product design, and allows for a period of customers being able to elect to continue to use the old site, although he says this is obviously only a temporary solution as you don't want to support both.

Cloudflare fragment rendering/caching

This worker script will evaluate your origin response, and replace html comments marked as fragment:key with a respective prefetch defined in a X-Fragments response header.

Usage

Your origin must include the X-Fragments header, specifying the a comma separated list of prefetch requests to make for that response.

< HTTP/1.1 200 OK

	#!/usr/bin/env bash

	set -Eeuo pipefail
	trap cleanup SIGINT SIGTERM ERR EXIT

	script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd -P)

	usage() {
	cat <<EOF
	Usage: $(basename "${BASH_SOURCE[0]}") [-h] [-v] [-f] -p param_value arg1 [arg2...]

	/*
	* John Conway's Game of Life.
	*
	* This is written for POSIX, using Curses. Resizing of the terminal is not
	* supported.
	*
	* By convention in this program, x is the horizontal coordinate and y is
	* vertical. There correspond to the width and height respectively.
	* The current generation number is illustrated when show_generation is set.
	*

	#!/usr/bin/env bash
	# usage: chris-terraform ... (any terraform command you want)

	role=XYZ
	credentials=(`aws sts assume-role --role-arn "${role}" --role-session-name terraform --query '[Credentials.AccessKeyId,Credentials.SecretAccessKey,Credentials.SessionToken]' --output text`)

	AWS_ACCESS_KEY_ID=${credentials[0]}
	AWS_SECRET_ACCESS_KEY=${credentials[1]}
	AWS_SESSION_TOKEN=${credentials[2]}
	AWS_SECURITY_TOKEN=${credentials[2]}

	EXE = shell
	SRC = .
	LDFLAGS = -ldflags="-s -w"

	windows:
	GOOS=windows go build -o $(EXE)_win.exe $(LDFLAGS) $(SRC)

	macos:
	GOOS=darwin go build -o $(EXE)_macos $(LDFLAGS) $(SRC)

	#!/usr/bin/env python3
	# encoding: utf-8
	# author: Lorenz Hübschle-Schneider

	# This is really really simple. Twitter, you have no excuse for not doing something like this!

	import codecs
	import json
	import re
	from unicodedata import normalize