News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by tetromino_ on Friday March 29, 2024 @03:50PM (#39868259)
You're right - the two exploit files are lzma-compressed and then deliberately corrupted using `tr`, so a hex dump wouldn't show anything immediately suspicious to a reviewer.

Mea culpa!

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by maxcoder4 on Friday March 29, 2024 @05:51PM (#39869394)
Is this lzma compressed? Hard to tell because of the lack of formatting, but this looks like amd64 shellcode to me.

But that's not really important to the point - I'm not looking at a diff of every committed favicon.ico or ttf font or a binary test file to make sure it doesn't contain a shellcode.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bangoodirro on Saturday March 30, 2024 @07:57AM (#39874005)
it's just an arbitrary section of libcxx-18.1.1/lib/libc++abi.so.1.0
[ Parent | on HN ]