Christian killerbees19

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

m720q Setup with an i7-8700 65W

I had trouble getting my i7-8700 65W to work in my m720q with a 65W PSU. It was working fine in Windows, but was throttling down first to 20 Watt, then to 15, 10, and finally to 7 Watt, which resulted in a maximum clock speed of 800 MHz.

The main problem seems to be a mix of crappy firmware settings from Lenovo/Intel (Reddit Post) and the weak power supply.

To fix this problem, we have to install some tools, and for them to work, you have to make sure that secure boot is OFF; otherwise, the kernel doesn't allow you to set the CPU power limits. The easiest way is to install in legacy mode; therefore, you need to disable secure boot and enable CSM in the BIOS, select legacy boot preferred.

Patches und Anleitung wurden nach eGovPatchesAT/id-austria verschoben, dieser gist wird nicht mehr geupdated.

Alte Anleitung

ID Austria / Digitales Amt mit Root und/oder entsperrtem Bootloader

Ohne Root
Schritt 1: APK downloaden/extrahieren

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

It "types" the contents of the clipboard.

Why can't you just paste the contents you ask? Sometimes pasting just doesn't work.

One example is in system password fields on OSX.
Sometimes you're working in a VM and the clipboard isn't shared.
Other times you're working via Remote Desktop and again, the clipboard doesn't work in password boxes such as the system login prompts.
Connected via RDP and clipboard sharing is disabled and so is mounting of local drives. If the system doesn't have internet access there's no easy way to get things like payloads or Powershell scripts onto it... until now.

Windows

The Windows version is written in AutoHotKey and easily compiles to an executable. It's a single line script that maps Ctrl-Shift-V to type the clipboard.

Simple guide for fulldisk encryption with Proxmox and ZFS native encryption

Install normally using the installer, after the setup reboot into recovery mode (from the USB stick). Make sure to install in UEFI mode (you need systemd-boot).

If the USB stick is not working for you, because of the old Kernel version (2.6.x), you can also use an Ubuntu 19.10 / 20.04 boot stick. ZFS suport is enabled there out of the box.

Steps:

	#!/usr/bin/env python

	import os
	import sys
	import subprocess
	import tempfile
	import struct
	import shutil
	import hashlib

	From self[at]sungpae.com Mon Nov 8 16:59:48 2021
	Date: Mon, 8 Nov 2021 16:59:48 -0600
	From: Sung Pae <self[at]sungpae.com>
	To: [email protected]
	Subject: Permissive forwarding rule leads to unintentional exposure of
	containers to external hosts
	Message-ID: <YYmr4l1isfH9VQCn@SHANGRILA>
	MIME-Version: 1.0
	Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="QR1yLfEBO/zgxYVA"

	#!/usr/bin/env bash

	shopt -s nullglob
	lastgroup=""
	for g in `find /sys/kernel/iommu_groups/* -maxdepth 0 -type d \| sort -V`; do
	for d in $g/devices/*; do
	if [ "${g##*/}" != "$lastgroup" ]; then
	echo -en "Group ${g##*/}:\t"
	else
	echo -en "\t\t"

	/*
	* John Conway's Game of Life.
	*
	* This is written for POSIX, using Curses. Resizing of the terminal is not
	* supported.
	*
	* By convention in this program, x is the horizontal coordinate and y is
	* vertical. There correspond to the width and height respectively.
	* The current generation number is illustrated when show_generation is set.
	*