thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

llimllib

#!/usr/bin/env bash

# import an MS SQL .bak backup file to an MS SQL database, then export all
# tables to csv. run this script as `import.sh <filename>`. It expects to be
# run in the same directory as the backup file.

# this is only tested on my mac (OS X Catalina). I tried to stick to posix, but
# It will probably require some tweaking for you. I hope it gives a general
# sense of what you need to do at the very least.

paulerickson

package unzip

import "archive/zip"

/**
 * Extract a zip file named source to directory destination.  Handles cases where destination dir…
 *  - does not exist (creates it)
 *  - is empty
 *  - already has source archive extracted into it (files are overwritten)
 *  - has other files in it, not in source archive (not overwritten)

Shazambom

package main

import (
	"errors"
	"fmt"
	"github.com/streadway/amqp"
	"log"
	"math/rand"
	"strconv"
)

mgreen27

<#
.SYNOPSIS
    WMIEvent-BinaryRename.ps1 installs WMI Eventing based Binary rename detection

    Name: WMIEvent-BinaryRename.ps1
    Version: 1.0
    Author: Matt Green (@mgreen27)
    

.DESCRIPTION

arschles

Other Go Libraries to Help With Doing HTTP Clients

• ctxhttp - use HTTP clients but do requests timeouts with a context
  • httptrace - a good library to pair with ctxhttp; you can use this to trace requests up to the server. this is pretty advanced usage, so I recommend you go here once you have basic performance issues sorted out
• fasthttp - slightly easier-to-use HTTP client. you still have to deal with connection pool details though. still useful if you like the API better
• go-cleanhttp - battle-tested HTTP client. useful to compare against the above code
• gorequest - nicer API, not as geared toward load testing. recommend against this for load tests, but for business logic it's good

rakyll

// Copyright 2016 Google Inc. All rights reserved.
// Use of this source code is governed by the Apache 2.0
// license that can be found in the LICENSE file.

// Command caption reads an audio file and outputs the transcript for it.
package main

import (
	"fmt"
	"io"

UndergroundLabs

#!/home/drspock/scripts/FBInvite/bin/python

import argparse
import requests
import pyquery

def login(session, email, password):
    
    '''
    Attempt to login to Facebook. Returns user ID, xs token and

moraes

package main

import (
	"fmt"
)

type Node struct {
	Value int
}