Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by acdha on Monday April 01, 2024 @05:54PM (#39899845)

Guard Duty does have some ptocees level monitoring with some recent additions: https://aws.amazon.com/blogs/aws/amazon-guardduty-ec2-runtim...

The main thing I was thinking is that the audit hooking and especially runtime patching across modules (liblzma5 patching functions in the main sshd code block) seems like the kind of thing a generic behavioral profile could get but especially one driven by the fact that sshd does not do any of that normally.

And, yes, performance and reliability issues are a big problem here. When CarbonBlack takes down production again, you probably end up with a bunch of exclusions which mean an actual attacker might be missed.

[ Parent | on HN ]

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by saagarjha on Wednesday April 03, 2024 @05:56AM (#39915374)

This kind of thing is quite difficult to do generally, because it is very easy to bypass, has significant performance impact, and has low reliability to boot.

[ Parent | on HN ]

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by acdha on Wednesday April 03, 2024 @08:26PM (#39925095)

I’m not saying it’s trivial, but in this case couldn’t you basically do W^X and watch process startup for anomalous behavior? Monkey-patching other libraries’ code should be pretty uncommon.

[ Parent | on HN ]

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by saagarjha on Sunday April 07, 2024 @02:37AM (#39958673)

That's not what liblzma is doing, it's patching GOT entries which are pure data.

[ Parent | on HN ]