Xz/liblzma: Bash-stage Obfuscation Explained

Re:Xz/liblzma: Bash-stage Obfuscation Explained by temp12237792 on Saturday March 30, 2024 @07:55PM (#39879862)

OMG that's evil. The diff just shows:

  +
  +.
  +

and the dot goes unnoticed

[ Parent | on HN ]

Re:Xz/liblzma: Bash-stage Obfuscation Explained by cqqxo4zV46cp on Saturday March 30, 2024 @09:32PM (#39880509)

like a more (ostensibly) malicious “goto fail”

[ Parent | on HN ]

Re:Xz/liblzma: Bash-stage Obfuscation Explained by emmelaich on Saturday March 30, 2024 @10:15PM (#39880731)

I wonder why they didn't use a non-breaking space or similar. I guess it's possible a nbsp would stand out even more.

[ Parent | on HN ]

Re:Xz/liblzma: Bash-stage Obfuscation Explained by jetpks on Saturday March 30, 2024 @11:49PM (#39881234)

the extra dot is easily hand waved away as a mistake. a non breaking space looks intentional.

[ Parent | on HN ]

Re:Xz/liblzma: Bash-stage Obfuscation Explained by IshKebab on Sunday March 31, 2024 @07:26AM (#39883256)

They could have just misspelt one of the constants. Even less obvious and more deniable.

There's multiple things like this in this backdoor that seems like they've been super sneaky (using a compile check to disable Landlock is genius) but then half-assed the last step.

[ Parent | on HN ]

Re:Xz/liblzma: Bash-stage Obfuscation Explained by account42 on Monday April 08, 2024 @04:30AM (#39967491)

Plausible deniability probably. A dot could be a typo, a NBSP is less likely.

[ Parent | on HN ]