News for hackers. Stuff that matters.

A comment on Xzbot: Notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094). Parent comment

Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by saagarjha on Wednesday April 03, 2024 @05:56AM (#39915374)
This kind of thing is quite difficult to do generally, because it is very easy to bypass, has significant performance impact, and has low reliability to boot.
[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by acdha on Wednesday April 03, 2024 @08:26PM (#39925095)
I’m not saying it’s trivial, but in this case couldn’t you basically do W^X and watch process startup for anomalous behavior? Monkey-patching other libraries’ code should be pretty uncommon.
[ Parent | on HN ]
Re:Xzbot: Notes, honeypot, and exploit demo for the xz backd... by saagarjha on Sunday April 07, 2024 @02:37AM (#39958673)
That's not what liblzma is doing, it's patching GOT entries which are pure data.
[ Parent | on HN ]