thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

dougallj

# IDA (disassembler) and Hex-Rays (decompiler) plugin for Apple AMX
#
# WIP research. (This was edited to add more info after someone posted it to
# Hacker News. Click "Revisions" to see full changes.)
#
# Copyright (c) 2020 dougallj


# Based on Python port of VMX intrinsics plugin:
# Copyright (c) 2019 w4kfu - Synacktiv

lf94

WHEN WILL BROWSERS BE COMPLETE?
A short exploration into the end game of web browsers.

This article may seem to be about bashing Google but it isn't. It's just about
reflecting on the current state and how much longer we should see ourselves
here.

So what is the Web? Well we can agree the Web is a conglomerate of standards
proposed by the W3C. So what do those standards define?

ysc3839

HMODULE hUser = GetModuleHandleA("user32.dll");
if (hUser)
{
	pfnSetWindowCompositionAttribute setWindowCompositionAttribute = (pfnSetWindowCompositionAttribute)GetProcAddress(hUser, "SetWindowCompositionAttribute");
	if (setWindowCompositionAttribute)
	{
		ACCENT_POLICY accent = { ACCENT_ENABLE_BLURBEHIND, 0, 0, 0 };
		WINDOWCOMPOSITIONATTRIBDATA data;
		data.Attrib = WCA_ACCENT_POLICY;
		data.pvData = &accent;

kyontan

#!/usr/bin/env ruby

# how to use:
# 1. domains ファイルをこのスクリプトを同じディレクトリに配置し、リモートフォローしたいインスタンスのドメインを記載してください
#  (place `domains` file located same directory as the script file, and write the domain name of instance which you want to remote follow.)
# 2. run this script
# 3. 発見されたアカウントがあなたのインスタンスに登録されます, ただ、リモートアカウントとして登録されるだけで、実際にフォローなどは行われません
#  (new accounts might have registered to your insntance, but not yet `followed` by your account (only registered to instance as a remote account))
# 4. なんらかのお好きな方法でフォローしてください
#  (please follow them by your account yourself, your ways)

rygorous

Brief explanation what I did to get the speed-up, and the thought process behind it.

The original code went:

EnterLoop:
			movaps		xmm3, xmmword ptr [edx+ecx*2]		// Box1YZ
			cmpnltps	xmm3, xmm2
			movmskps	eax, xmm3

			cmp			eax, 0Ch

DaBs

var str = 'class ಠ_ಠ extends Array {constructor(j = "a", ...c) {const q = (({u: e}) => {return { [`s${c}`]: Symbol(j) };})({});super(j, q, ...c);}}' + 
          'new Promise((f) => {const a = function* (){return "\u{20BB7}".match(/./u)[0].length === 2 || true;};for (let vre of a()) {' +
          'const [uw, as, he, re] = [new Set(), new WeakSet(), new Map(), new WeakMap()];break;}f(new Proxy({}, {get: (han, h) => h in han ? han[h] ' + 
          ': "42".repeat(0o10)}));}).then(bi => new ಠ_ಠ(bi.rd));';

try {
  eval(str);
} catch(e) {
  alert('Your browser does not support ES6!')
}

rngtm

///////////////////////////////////////////////////////////
// 動作環境: processing-2.2.1    Windows10
// Gif書き出しには GifAnimation のインストールが必須です
///////////////////////////////////////////////////////////

// import gifAnimation.*;
// GifMaker gifExport;

// 色
final color WHITE = color(255);

yvt

$ curl https://api.github.com/repos/yvt/Agiletimbres/releases  | jq '[.[]|.assets] | flatten(1) | [.[] | {name: .name, count: .download_count}]'
[
  {
    "name": "Agiletimbres-0.0.2.zip",
    "count": 142
  }
]

yurydelendik

NOTE: the content is out-of-date. All development is moved to the https://github.com/yurydelendik/wasmception

Using WebAssembly in LLVM

Compiling

# locations, e.g.
export WORKDIR=~/llvmwasm; mkdir -p $WORKDIR
export INSTALLDIR=$WORKDIR