Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by 7373737373 on Monday April 01, 2024 @03:03PM (#39897827)

I read someome speculating that the performance issue was intentional, so infected machines could be easily identified by an internet wide scan without arousing further suspicicion.

If this is or becomes a widespread method, then anti-malware groups should perhaps conduct these scans themselves.

[ Parent | on HN ]

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by zarzavat on Monday April 01, 2024 @05:09PM (#39899376)

Very small differences in performance can be detected over the network as long as you have enough samples. Given that every port 22 is being hit by a gazillion attempts per day already, sample count shouldn’t be an issue.

So if distinguishing infected machines was their intention they definitely over-egged it.

[ Parent | on HN ]