thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

simonpai

import { writeFile } from 'fs/promises';
import { resolve } from 'path';
import glob from 'fast-glob';

const cwd = process.env.PWD;

async function outputConfigJson(file) {
  const outputFile = file.replace(/\.js$/, '.json');
  // use import() so both CJS and ESM work
  let config = await import(resolve(cwd, file));

graffic

Framing the issue

With almost no bandwith at home, I needed a way to download DOOM that didn't involve blocking the home internet line for two days.

Approach

Using steamcmd you can use any computer to download steam games.

Downloading

1. Install it
2. Open it and loging with your username and password: login username password

n1ru4l

export const fetchAsBlob = url => fetch(url)
    .then(response => response.blob());

export const convertBlobToBase64 = blob => new Promise((resolve, reject) => {
    const reader = new FileReader;
    reader.onerror = reject;
    reader.onload = () => {
        resolve(reader.result);
    };
    reader.readAsDataURL(blob);

badboy

Original link: http://www.concentric.net/~Ttwang/tech/inthash.htm
Taken from: http://web.archive.org/web/20071223173210/http://www.concentric.net/~Ttwang/tech/inthash.htm
Reformatted using pandoc

Integer Hash Function

Thomas Wang, Jan 1997

last update Mar 2007

JChristensen

Simple demonstrations of putting AVR microcontrollers to sleep in power-down mode,
which results in minimum current.  Coded with Arduino IDE version 1.0.4 (and with
the Arduino-Tiny core for the ATtiny MCUs, http://code.google.com/p/arduino-tiny/)

For ATmega328P, ~0.1µA.
For ATtinyX5 revisions that implement software BOD disable, ~0.1µA,
for ATtinyX5 revisions that don't, ~20µA.