thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

rise-worlds

for 4.2.4 or higher, 4.2.5,4.2.6,4.3.7, it's works, this is the way which makes Always in evaluation mode.

1. open Terminal, go to the dir : cd /Applications/Beyond Compare.app/Contents/MacOS
2. change the name BCompare to BCompare.bak: mv BCompare BCompare.bak
3. touch a file name BCompare , and chmod a+ux BCompare : touch BCompare && chmod a+ux BCompare
4. open BCompare with text editor, insert the script :

#!/bin/bash
rm "/Users/$(whoami)/Library/Application Support/Beyond Compare/registry.dat"
"`dirname "$0"`"/BCompare.bak $@

LucasBonafe

NetLimiter 3
Registration name:  Peter Raheli
Registration code:  C99A2-QSSUD-2CSBG-TSRPN-A2BEB

NetLimiter 4
Registration Name:  Vladimir Putin #2
Registration Code:  XLEVD-PNASB-6A3BD-Z72GJ-SPAH7

https://www.netlimiter.com/download
# Netlimiter Full Netlimiter Activated Netlimiter cracked Netlimiter Full Version Netlimiter Serial Netlimiter keygen Netlimiter crack Netlimiter 4 serial Netlimiter 4 Crack Netlimiter 4 register Netlimiter 4 patch Netlimiter full Full version Netlimiter 4 Activated Netlimiter 4 Cracked Netlimiter Pro

ItsAdventureTime

#
#
# The Seedbox From Scratch Script
#   By Notos ---> https://github.com/Notos/
#
#
######################################################################
#
#  Copyright (c) 2013 Notos (https://github.com/Notos/)
#

alirobe

### 
###
### UPDATE: For Win 11, I recommend using this tool in place of this script: 
### https://christitus.com/windows-tool/
### https://github.com/ChrisTitusTech/winutil
### https://www.youtube.com/watch?v=6UQZ5oQg8XA
### iwr -useb https://christitus.com/win | iex
###
###

Manouchehri

# Source:
# https://www.cloudflare.com/ips
# https://support.cloudflare.com/hc/en-us/articles/200169166-How-do-I-whitelist-CloudFlare-s-IP-addresses-in-iptables-

for i in `curl https://www.cloudflare.com/ips-v4`; do iptables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done
for i in `curl https://www.cloudflare.com/ips-v6`; do ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $i -j ACCEPT; done

# Avoid racking up billing/attacks
# WARNING: If you get attacked and CloudFlare drops you, your site(s) will be unreachable. 
iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP

pawelszydlo

#!/bin/bash

# Clears finished downloads from Transmission.
# Version: 1.1
#
# Newest version can always be found at:
# https://gist.github.com/pawelszydlo/e2e1fc424f2c9d306f3a
#
# Server string is resolved in this order:
# 1. TRANSMISSION_SERVER environment variable

superjamie

Raspberry Pi VPN Router

This is a quick-and-dirty guide to setting up a Raspberry Pi as a "router on a stick" to PrivateInternetAccess VPN.

Requirements

Install Raspbian Jessie (2016-05-27-raspbian-jessie.img) to your Pi's sdcard.

Use the Raspberry Pi Configuration tool or sudo raspi-config to:

zachflower

<?php

$ip = '127.0.0.1';
$port = '9051';
$auth = 'PASSWORD';
$command = 'signal NEWNYM';
 
$fp = fsockopen($ip,$port,$error_number,$err_string,10);
if(!$fp) { echo "ERROR: $error_number : $err_string";
    return false;

rain-1

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

• Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
• Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
• Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
• Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
• Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru