| XZ Backdoor symbol deobfuscation. Updated as i make progress |
| 0810 b' from ' | |
| 0678 b' ssh2' | |
| 00d8 b'%.48s:%.48s():%d (pid=%ld)\x00' | |
| 0708 b'%s' | |
| 0108 b'/usr/sbin/sshd\x00' | |
| 0870 b'Accepted password for ' | |
| 01a0 b'Accepted publickey for ' | |
| 0c40 b'BN_bin2bn\x00' | |
| 06d0 b'BN_bn2bin\x00' | |
| 0958 b'BN_dup\x00' |
This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.
On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that
| package main | |
| import ( | |
| "crypto/aes" | |
| "crypto/cipher" | |
| "fmt" | |
| "os" | |
| ) | |
| const transformerPrefix = "k8s:enc:aescbc:v1:k-wcldg:" |
| ! Title: ClearURLs for uBo | |
| ! Homepage: https://gist.github.com/iam-py-test/1db25658541945170eaaf191b399fac0 | |
| ! Note: This was forked from https://gist.github.com/rusty-snake/5cd83a87d680ecbd03e79a1a06758207, which is based off of https://github.com/ClearURLs/Rules. I - iam-py-test - have made some modifications as to keep it up-to-date with the source and to fix bugs | |
| $removeparam=/^p[fd]_rd_[a-z]*=/,domain=amazon.* | |
| $removeparam=qid,domain=amazon.* | |
| $removeparam=/^srs?=/,domain=amazon.* | |
| $removeparam=/^__mk_[a-z]{1\,3}_[a-z]{1\,3}=/,domain=amazon.* | |
| $removeparam=spIA,domain=amazon.* | |
| $removeparam=ms3_c,domain=amazon.* |
Stable enough for my initial use-case, light-duty laptop for travel and presentations, running Linux all the time but retain a small ChromeOS volume for firmware updates and restoring settings.
1st attempt I wiped the drive and then found that when the machine attempted to suspect when the lid closed it wiped the NVRAM with no other option to boot into legacy mode than to restore ChromeOS and enable it again.
| # | |
| # Comic Chat fixer MITM proxy: fixes Comic Chat to (sort of) work with modern | |
| # IRC servers. Tested with Microsoft Chat 2.5 on Windows XP, 8 and 10 | |
| # | |
| # This program is free software: you can redistribute it and/or modify | |
| # it under the terms of the GNU General Public License as published by | |
| # the Free Software Foundation, either version 3 of the License, or | |
| # (at your option) any later version. | |
| # | |
| # This program is distributed in the hope that it will be useful, |
| import xmlrpclib | |
| class ProcessStatus(object): | |
| RUNNING = 'RUNNING' | |
| STOPPED = 'STOPPED' | |
| FATAL = 'FATAL' | |
| RESTARTING = 'RESTARTING' | |
| SHUTDOWN = 'SHUTDOWN' |
