Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/cloud9-tools/go-galoisfield
An implementation of the GF(2**m)
Galois finite fields for Go.
A Galois field, also known as a finite field, is a mathematical field with a
number of elements equal to a prime number to a positive integer power. While
finite fields with a prime number of elements are familiar to most programmers
-- boolean arithmetic, a.k.a. arithmetic mod 2
is a well-known example --
fields that take that prime to powers higher than 1 are less well-known.
Basically, an element of GF(2**m)
can be seen as a list of m
bits, where
addition and multiplication are elementwise mod 2
(a XOR b
for addition,
a AND b
for multiplication) and the remaining rules of field arithmetic
follow from linear algebra (vectors, or alternatively, polynomial coefficients).
Short version: an element of GF(2**8)
element may be represented as a byte
(0 ≤ n ≤ 255), but it's really a vector of 8 bits -- like a very primitive
MMX/SSE. We then treat said vector as the coefficients of a polynomial, and
that allows us to define multiplication, giving us a full mathematical field.
Finite fields -- and GF(2**8)
in particular -- get a ton of use in codes,
in both the "error-correcting code" and "cryptographic code" senses.
However, this implementation has NOT been hardened against timing attacks,
so it MUST NOT be used in cryptography.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.