XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by dolmen on Saturday March 30, 2024 @06:39PM (#39879378)

Do you have some scripts publicly available to reproduce your research?

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by mik1998 on Saturday March 30, 2024 @07:14PM (#39879579)

I used the git repo at https://git.phial.org/d6/xz-analysis-mirror/commits/branch/m... and simply did

  git log --format=%cd --author="Jia Tan"

and then processed it a bit with gnuplot. Should not be difficult to reproduce this graph, but I am not too much of a gnuplot wizard so I first preprocessed this into some different files in a REPL. Don't have the full code of what I did but it should not be difficult to reproduce, just parse the dates and look at the hours.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by Aloisius on Saturday March 30, 2024 @11:25PM (#39881115)

You should include git log --committer=Jia too as they committed what appears to be their other fake account's changes as well.

Also there are separate author times vs. commit times.

[ Parent | on HN ]