amlweems/xzbot
View on GitHub ↗ ★ 3,558 Go
notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)
3 mentions on Hacker News by 3 people: 1 story, 2 comments · first 2024-04-01 · latest 2024-08-23
20082026
-
…; that set of tweets has the high level overview. They in turn links to https://github.com/amlweems/xzbot which has more details. The TL;DR is that is hooks the RSA bits to look for an RSA cert with a public key that isn't really
comment by deathanatos · 2024-08-23 · in OpenSSH Backdoors -
Instead of needing the honeypot openssh.patch at compile-time https://github.com/amlweems/xzbot/blob/main/openssh.patch How did the exploit do this at runtime? I know the chain was: opensshd -> systemd for notifications -> xz included as…
comment by MuffinFlavored · 2024-04-01 · in Xzbot: Notes, honeypot, and exploit demo for the xz backdoor