Simon Hertoge SimonHertoge

Make Ubuntu packages 90% faster by rebuilding them

TL;DR

You can take the same source code package that Ubuntu uses to build jq, compile it again, and realize 90% better performance.

Setting

I use jq for processing GeoJSON files and other open data offered in JSON format. Today I am working with a 500MB GeoJSON file that contains the Alameda County Assessor's parcel map. I want to run a query that prints the city for every parcel worth more than a threshold amount. The program is

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

	#!/bin/bash
	#
	# grab ownership of ghidra project specified in arg1 or current dir if absent
	#
	# - looks for the first <projectname>.gpr file
	# - modifies owner name <projectname>/project.prp
	#
	# example : ./ghrab.sh ~/RE/coolstuff

	import random
	import argparse
	import tempfile
	import ipaddress
	from time import sleep
	from shlex import split
	from os import path, remove
	from scapy.all import sniff
	from threading import Thread
	from subprocess import Popen, PIPE

	Rem This may mess up Linux GRUB. You might need to reinstall GRUB afterwards.

	Rem Open Diskpart
	diskpart

	Rem Select your disk number, in my case #0
	list disk
	sel disk 0

	Rem Select your disk number, in my case #2, you should recognize it by its size and by the filesystem (FAT32)

	$ # plz forgive this dumb method of visualization.
	$ cp /System/Library/Frameworks/AppKit.framework/Resources/StandardKeyBinding.dict .
	$ plutil -convert xml1 StandardKeyBinding.dict
	$ plutil -p StandardKeyBinding.dict \| unicode-vis \| cat -v \| tr '\t' '+'
	{
	"^C" => "insertNewline:"
	"^H" => "deleteBackward:"
	"^Y" => "insertBacktab:" //shift+tab
	"^[" => "cancelOperation:"
	"^?" => "deleteBackward:"