Christian killerbees19

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

m720q Setup with an i7-8700 65W

I had trouble getting my i7-8700 65W to work in my m720q with a 65W PSU. It was working fine in Windows, but was throttling down first to 20 Watt, then to 15, 10, and finally to 7 Watt, which resulted in a maximum clock speed of 800 MHz.

The main problem seems to be a mix of crappy firmware settings from Lenovo/Intel (Reddit Post) and the weak power supply.

To fix this problem, we have to install some tools, and for them to work, you have to make sure that secure boot is OFF; otherwise, the kernel doesn't allow you to set the CPU power limits. The easiest way is to install in legacy mode; therefore, you need to disable secure boot and enable CSM in the BIOS, select legacy boot preferred.

Patches und Anleitung wurden nach eGovPatchesAT/id-austria verschoben, dieser gist wird nicht mehr geupdated.

Alte Anleitung

ID Austria / Digitales Amt mit Root und/oder entsperrtem Bootloader

Ohne Root
Schritt 1: APK downloaden/extrahieren

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

It "types" the contents of the clipboard.

Why can't you just paste the contents you ask? Sometimes pasting just doesn't work.

One example is in system password fields on OSX.
Sometimes you're working in a VM and the clipboard isn't shared.
Other times you're working via Remote Desktop and again, the clipboard doesn't work in password boxes such as the system login prompts.
Connected via RDP and clipboard sharing is disabled and so is mounting of local drives. If the system doesn't have internet access there's no easy way to get things like payloads or Powershell scripts onto it... until now.

Windows

The Windows version is written in AutoHotKey and easily compiles to an executable. It's a single line script that maps Ctrl-Shift-V to type the clipboard.

	import sys, os, stat, errno, operator, time, datetime, requests
	from fuse import FUSE, Operations, LoggingMixIn, FuseOSError
	from mastodon import Mastodon
	from cachetools import TTLCache, cachedmethod
	from mastodon.return_types import MediaAttachment, Account, Status

	class PathItem:
	def __init__(self, path_type, mtime=None, size=0, symlink_target=None, read_fn=None, listdir_fn=None):
	self.path_type = path_type
	self.mtime = mtime or time.time()

	#!/usr/bin/env python

	import os
	import sys
	import subprocess
	import tempfile
	import struct
	import shutil
	import hashlib

	From self[at]sungpae.com Mon Nov 8 16:59:48 2021
	Date: Mon, 8 Nov 2021 16:59:48 -0600
	From: Sung Pae <self[at]sungpae.com>
	To: [email protected]
	Subject: Permissive forwarding rule leads to unintentional exposure of
	containers to external hosts
	Message-ID: <YYmr4l1isfH9VQCn@SHANGRILA>
	MIME-Version: 1.0
	Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="QR1yLfEBO/zgxYVA"

	#!/usr/bin/env bash

	shopt -s nullglob
	lastgroup=""
	for g in `find /sys/kernel/iommu_groups/* -maxdepth 0 -type d \| sort -V`; do
	for d in $g/devices/*; do
	if [ "${g##*/}" != "$lastgroup" ]; then
	echo -en "Group ${g##*/}:\t"
	else
	echo -en "\t\t"

	/*
	* John Conway's Game of Life.
	*
	* This is written for POSIX, using Curses. Resizing of the terminal is not
	* supported.
	*
	* By convention in this program, x is the horizontal coordinate and y is
	* vertical. There correspond to the width and height respectively.
	* The current generation number is illustrated when show_generation is set.
	*