junon

64 ms·

961.
by junon 3y ago
In the case of XZ it was more akin to burnout based on the literature around the time Jia Tan was instated.
962.
by junon 3y ago
Bad. And we don't know if the intended target, if any, was ever hit. They might still have gotten what they wanted. In terms of severity and nefarious intent, it's probably the worst that's happened.
963.
by junon 3y ago
This is a cute game that I've played just a bit with some friends. I can recommend it if you like voxel stuff :)
964.
by junon 3y ago
Working on an OS in Rust, rust-analyzer chokes. A _lot_. I end up just having to run a compilation to see what I've broken. Haven't tried it yet but it looks like it'll be an invaluable part of my toolbox. Thanks for posting
965.
by junon 3y ago
This is probably the worst backdoor in history in the open source sphere, if not ever. Certainly the worst of my career.
966.
by junon 3y ago
This is a lot of fun :)
967.
by junon 3y ago
Because it needs to be able to spawn processes as any user.
968.
by junon 3y ago
There's a reasonably high chance this was to target a specific machine, or perhaps a specific organization's set of machines. After that it could probably be sold off once whatever they were using it for was finished. I doubt we&#
969.
by junon 3y ago
Siblings saying "we don't know" haven't really groked the post I don't think. If I'm understanding the thread correctly, here's a (not so) succinct explanation. Please, if you know better than I do, correc
970.
by junon 3y ago
Right, though if I'm understanding correctly, this is targeting openssl, not just sshd. So there's a larger set of circumstances where this could have been exploited. I'm not sure if it's yet been confirmed that this is
971.
by junon 3y ago
Unless the payload did something that produced evidence, or if the program using openssl that was affected was, for some reason, having all of its actions logged, then no, probably not.
972.
by junon 3y ago
That's what this feels like. That, or someone who wanted to sell this to one. Can't imagine the ABC's are sleeping on this one at this point.
973.
by junon 3y ago
It appears to be an RCE, not a public key bypass: https://news.ycombinator.com/item?id=39877312
974.
by junon 3y ago
EDIT: Here's some more RE work on the matter. Has some symbol remapping information that was extracted from the prefix trie the backdoor used to hide strings. Looks like it tried to hide itself even from RE/analysis, too. https:&
975.
XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."(bsky.app)
1323 points by junon 3y ago|810 comments
976.
by junon 3y ago
Lasse has also started his own documentation on the incident. https://tukaani.org/xz-backdoor/
977.
by junon 3y ago
Don't agree here. I've only ever seen GitHub do this in extreme circumstances where they were absolutely warranted.
978.
by junon 3y ago
I am not LE nor a government official. I did not present a warrant of any kind. I asked in a channel about it. Libera refused to provide information. Libera respecting the privacy of users is of course something I applaud and respect. Why w
979.
by junon 3y ago
Good question, though I can imagine they took this action for two reasons: 1. They don't have the ability to freeze repos (i.e. would require some engineering effort to implement it), as I've never seen them do that before. 2. Man
980.
by junon 3y ago
Good catch, thanks :)
981.
by junon 3y ago
Just for posterity since I can no longer edit: Libera staff has been firm and unrelenting in their position not to disclose anything whatsoever about the account. I obtained the last point on my own. Libera has made it clear they will not b
982.
by junon 3y ago
It's worth mentioning Lasse is still online in the Libera chat room, idling. Nothing's been said.
983.
by junon 3y ago
GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has also been suspended. EDIT: Github has disabled all Tukaani repositories, including downloads from the releases page. -- EDIT: Just did a bit of pokin
984.
by junon 3y ago
From what I'm understanding it's trying to patch itself into the symbol resolution step of ld.so specifically for libcrypto under systemd on x86_64. Am I misreading the report? That's a strong indication it's targeting s
985.
by junon 3y ago
This is all I can find on them. carrd.co jiat0218@gmail.com business https://jiat0218@gmail.com.carrd.co eBay JiaT75 shopping https://www.ebay.com/usr/JiaT75 giters jiat0218 coding https:/&#x
986.
by junon 3y ago
Ehhh idk. I actually knew one of the famous glassholes (one of the guys interviewed in the infamous glassholes documentary). He was a well known nuisance outside of the Google glass thing, to boot. He was taking pictures of people at clubs
987.
by junon 3y ago
This article is 100% accurate. I found myself agreeing with everything written here. Hopefully someone at Apple reads this and takes it to heart when deciding what to improve for a V2. I might actually buy one if they address some of these
988.
by junon 3y ago
Haha. Nice sources. And nice work, curious what the larger response to this will be. https://github.com/Notselwyn/CVE-2024-1086/blob/main/src/mai...
989.
by junon 3y ago
Welp, as if Affinity didn't already have problems... Also, this. https://twitter.com/affinitybyserif/status/15707285663500206...
990.
by junon 3y ago
Agreed. Shrooms were way more meaningful than any of my LSD trips, personally.

More ›