Polish security researcher Gynvael Coldwind writing on malware analysis, reverse engineering, exploits and low-level programming, with some game-porting work.
Commenters call his analyses great, including the xz/liblzma backdoor write-up, and say his posts are interesting and often innovative.
SE Linux comment by @poettering, https://news.ycombinator.com/item?id=39867126
> Libselinux pulls in liblzma too and gets linked into tons more programs than libsystemd. And will end up in sshd too (at the very least via libpam/pam_selinux). And most of the really big distros tend do support selinux at least to some level. Hence systemd or not, sshd remains vulnerable by this specific attack.
Devuan comment by @capitainenemo, https://news.ycombinator.com/item?id=39866190
> The sshd in Devuan does link to a libsystemd stub - this is to cut down on their maintenance of upstream packages. However that stub does not link to lzma.
Future proofing, https://gynvael.coldwind.pl/?lang=en&id=782
Stage 2 "extension" mechanism This whole thing basically looks like an "extension/patching" system that would allow adding future scripts to be run in the context of Stage 2, without having to modify the original payload-carrying test files. Which makes sense, as modyfing a "bad" and "good" test files over and over again is pretty suspicious. So the plan seemed to be to just add new test files instead, which would have been picked up, deciphered, and executed.
Also known as "bswap ax", and research shows that it does something surprising but consistent on almost all hardware: It zeros the register.
https://www.ragestorm.net/blogs/?p=141
https://gynvael.coldwind.pl/?id=268
However, this page, now gone, suggests that some CPUs (early 486s?) did something different: http://web.archive.org/web/20071231192014/http://www.df.lth.se/~john_e/gems/gem000c.html
Unfortunately I have not found any evidence nor reason to believe that this "inner swap" behaviour you mention exists in some CPU --- except perhaps some flawed emulators?
This reminds me of a tool that came out 10 or 15 years ago, which allowed you to feed it arbitrary binary data that it could display in 3D.
I remember reading a Slashdot article on it in which one of the examples was a 3D, freely-rotating view of the Linux kernel binary.
Does anyone know what I'm talking about? I can't seem to recall the name of the project or find it.
Also related:
http://vimeo.com/110257380
http://gynvael.coldwind.pl/?id=199
https://www.youtube.com/watch?v=5f7hZBoEwV0
https://github.com/pwaller/binview
Gynvael Coldwind - one of the guys from Dragon Sector (but probably not a member of the team that hacked those trains)
wrote an article about why company's line of defence that malicious code could be injected is flawed
https://gynvael.coldwind.pl/?id=777
It is mostly about reverse engineering, compilation process, how thing are laid out in the final binary -.text, .data sections, offsets and stuff like
https://en.wikipedia.org/wiki/Code_cave
https://en.wikipedia.org/wiki/Hooking
Disregard the comment you're replying to, they're either misinformed or deliberately inaccurate in their assessment.
The backdoor consisted of a combination of publicly visible code and binary blob test files available in the project's repository as well as obfuscated build scripts which were contained only in the released tarballs, tucked away, which, nevertheless, were also publicly accessible, decompressable and auditable[1]
[1] https://gynvael.coldwind.pl/?lang=en&id=782
> For security stuff it's 100% twitter
It saddens me that this is the case. Security types are techies, so should be all over RSS feeds. For example I follow the usual suspects on RSS:
* https://www.schneier.com/feed/atom/
* https://gru.gq/feed/
* https://gynvael.coldwind.pl/rss_en.php
Ideally please post on Twitter AND an RSS feed.