thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

RubenNL

#!/bin/bash
files=(/etc/gotify/cli-bash.json $HOME/.gotify/cli-bash.json .cli-bash.json)
for filepath in "${files[@]}"
do
	if [ -f $filepath ]; then
		break;
	fi
done
case $1 in
"init")

fntlnz

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

rootux

/* 
Simple WhatsApp Web Spam Bot Originally written by Pablode. Modified by Gal Bracha.
Use with love <3. Do not act reckless.
====================================================================================
DISCLAIMER: I do not take any responsibility for any damage caused with this script. 
WhatsApp might be able identify script users if this becomes a problem. Do only use 
this if you are aware of the consquences. 
====================================================================================
Usage: Copy all of this script (Ctrl+A, Ctrl+C). Add a new Bookmark. In the URL section,
write "javascript:" and paste (Ctrl+V) this script. Visit WhatsApp Web, select your