• 0 Posts
  • 19 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle







  • Is this problem a recurring one after a reboot?

    If it is it warrants more effort.

    If not and you’re happy with rhe lack of closure, you can potentially fix this: kill the old agent (watch out to see if it respawns; if it does and that works, fine). If it doesn’t, you can (a) remove the socket file (b) launch ssh-agent with the righr flag (-a $SSH_AGENT_SOCK iirc) to listen at the same place, then future terminal sessions that inherit the env var will still look in the right place. Unsatisfactory but it’ll get you going again.


  • Okay, that agent process is running but it looks wedged: multiple connections to the socket seem to be opened, probably your other attempts to use ssh.

    The ssh-add output looks like it’s responding a bit, however.

    I’d use your package manager to work out what owns it and go looking for open bugs in the tool.

    (Getting a trace of that process itself would be handy, while you’re trying again. There may be a clue in its behaviour.)

    The server reaponse seems like the handshake process is close to completing. It’s not immediately clear what’s up there I’m afraid.











  • The test case purported to be bad data, which you presumably want to test the correct behaviour of your dearchiver against.

    Nothing this did looks to involve memory safety. It uses features like ifunc to hook behaviour.

    The notion of reproducible CI is interesting, but there’s nothing preventing this setup from repeatedly producing the same output in (say) a debian package build environment.

    There are many signatures here that look “obvious” with hindsight, but ultimately this comes down to establishing trust. Technical sophistication aside, this was a very successful attack against that teust foundation.

    It’s definitely the case that the stack of C tooling for builds (CMakeLists.txt, autotools) makes obfuscating content easier. You might point at modern build tooling like cargo as an alternative - however, build.rs and proc macros are not typically sandboxed at present. I think it’d be possible to replicate the effects of this attack using that tooling.