Gynvael Coldwind

Gynvael Coldwind made a great analysis about it: https://gynvael.coldwind.pl/?lang=en&id=782 https://news.ycombinator.com/item?id=39878681 xz/liblzma: Bash-stage Obfuscation Explained

lcamtuf is just a great man. Take a look at his biography and inventions. I love this works same as Gynvaels http://gynvael.coldwind.pl/?blog=1&lang=en When they post something, it's always interesting and very often innovating.

Hi Philip. Would you be able to share with me just a few anonymized user IDs (random ones are fine)? I wanted to double-check their format, since I'm pretty sure their method is broken. My email address is there → https://gynvael.coldwind.pl/?id=50 (contact section)

(found on vogons: https://www.vogons.org/viewtopic.php?p=1331177) there is a team working on enhancing the original Syndicate Wars port (https://gynvael.coldwind.pl/?id=279) by Unavowed and Gynvael Coldwind github: https://github.com/swfans/swars youtube: https://www.youtube.com/watch?v=eJOnGRdErpg

Also known as "bswap ax", and research shows that it does something surprising but consistent on almost all hardware: It zeros the register. https://www.ragestorm.net/blogs/?p=141 https://gynvael.coldwind.pl/?id=268 However, this page, now gone, suggests that some CPUs (early 486s?) did something different: http://web.archive.org/web/20071231192014/http://www.df.lth.se/~john_e… Unfortunately I have not found any evidence nor reason to believe that this "inner swap" behaviour you mention exists in some CPU --- except perhaps some flawed emulators?

If you're interested in dives that deep, you might like Gynvael Coldwind's hello world in Python on Windows dive [1]. Goes through CPython internals, Windows conhost, font rasterization, and GPU rendering, among others. [1]: https://gynvael.coldwind.pl/?id=754

Disregard the comment you're replying to, they're either misinformed or deliberately inaccurate in their assessment. The backdoor consisted of a combination of publicly visible code and binary blob test files available in the project's repository as well as obfuscated build scripts which were contained only in the released tarballs, tucked away, which, nevertheless, were also publicly accessible, decompressable and auditable[1] [1] https://gynvael.coldwind.pl/?lang=en&id=782

"xz/liblzma: Bash-stage Obfuscation Explained" covers it well https://gynvael.coldwind.pl/?lang=en&id=782

That’s what the compromised build stage did. It’s really interesting to read if you want to see the details of how a sophisticated attacker works: https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27#de… https://gynvael.coldwind.pl/?lang=en&id=782

I think you're probably missing a lot context about the situation. Here's some useful links https://x0f.org/@FreePietje/112187047353892463 also https://gynvael.coldwind.pl/?lang=en&id=782

Gynvael Coldwind - one of the guys from Dragon Sector (but probably not a member of the team that hacked those trains) wrote an article about why company's line of defence that malicious code could be injected is flawed https://gynvael.coldwind.pl/?id=777 It is mostly about reverse engineering, compilation process, how thing are laid out in the final binary -.text, .data sections, offsets and stuff like https://en.wikipedia.org/wiki/Code_cave https://en.wikipedia.org/wiki/Hooking

> For security stuff it's 100% twitter It saddens me that this is the case. Security types are techies, so should be all over RSS feeds. For example I follow the usual suspects on RSS: * https://www.schneier.com/feed/atom/ * https://gru.gq/feed/ * https://gynvael.coldwind.pl/rss_en.php Ideally please post on Twitter AND an RSS feed.

Pick up the subject of old 8 bit computers, games and browsers. Get ready for the 20 KB JS shooter competition. https://gynvael.coldwind.pl/?id=686

Gynvael ( http://gynvael.coldwind.pl/ ) is a C++ person who does streams on youtube. I learned a lot about Virtual Machines from his livestreams. :)

This reminds me of a tool that came out 10 or 15 years ago, which allowed you to feed it arbitrary binary data that it could display in 3D. I remember reading a Slashdot article on it in which one of the examples was a 3D, freely-rotating view of the Linux kernel binary. Does anyone know what I'm talking about? I can't seem to recall the name of the project or find it. Also related: http://vimeo.com/110257380 http://gynvael.coldwind.pl/?id=199 https://www.youtube.com/watch?v=5f7hZBoEwV0 https://github.com/pwaller/binview

SE Linux comment by @poettering, https://news.ycombinator.com/item?id=39867126 > Libselinux pulls in liblzma too and gets linked into tons more programs than libsystemd. And will end up in sshd too (at the very least via libpam/pam_selinux). And most of the really big distros tend do support selinux at least to some level. Hence systemd or not, sshd remains vulnerable by this specific attack. Devuan comment by @capitainenemo, https://news.ycombinator.com/item?id=39866190 > The sshd in Devuan does link to a libsystemd stub - this is to cut down on their maintenance of upstream packages. However that stub does not link to lzma. Future proofing, https://gynvael.coldwind.pl/?lang=en&id=782 Stage 2 "extension" mechanism This whole thing basically looks like an "extension/patching" system that would allow adding future scripts to be run in the context of Stage 2, without having to modify the original payload-carrying test files. Which makes sense, as modyfing a "bad" and "good" test files over and over again is pretty suspicious. So the plan seemed to be to just add new test files instead, which would have been picked up, deciphered, and executed.

Here you go: http://gynvael.coldwind.pl/?id=279