blasio.eu
👤 Joined on 29 November 2023
Followers
Following
Total Posts
@diblasio.bsky.social@diblasio.bsky.social → @diblasio.social@diblasio.social → @blasio.euI'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.
Show Post