News for hackers. Stuff that matters.

A comment on Xz/liblzma: Bash-stage Obfuscation Explained. Parent comment

Re:Xz/liblzma: Bash-stage Obfuscation Explained by emmelaich on Saturday March 30, 2024 @10:15PM (#39880731)
I wonder why they didn't use a non-breaking space or similar. I guess it's possible a nbsp would stand out even more.
[ Parent | on HN ]
Re:Xz/liblzma: Bash-stage Obfuscation Explained by jetpks on Saturday March 30, 2024 @11:49PM (#39881234)
the extra dot is easily hand waved away as a mistake. a non breaking space looks intentional.
[ Parent | on HN ]
Re:Xz/liblzma: Bash-stage Obfuscation Explained by IshKebab on Sunday March 31, 2024 @07:26AM (#39883256)
They could have just misspelt one of the constants. Even less obvious and more deniable.

There's multiple things like this in this backdoor that seems like they've been super sneaky (using a compile check to disable Landlock is genius) but then half-assed the last step.

[ Parent | on HN ]
Re:Xz/liblzma: Bash-stage Obfuscation Explained by account42 on Monday April 08, 2024 @04:30AM (#39967491)
Plausible deniability probably. A dot could be a typo, a NBSP is less likely.
[ Parent | on HN ]