Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/mvanveen/canvasflood
Send fire-and-forget UDP packets to an IP with set x y red green blue
and canvasflood will dutifully display it into the raw linux framebuffer!
Make sure your GOPATH
is set. I do export GOPATH=$(pwd)
when I'm running in this working directory, but I'm not sure if that's kosher golang yet. This env variable is needed to compile.
$ go get .
$ go build .
This has only been tested with Linux so far.
First, switch over to /dev/fb0
by pressing ctrl-alt-<F1>
. You should see the familiar text mode TTY you normally get when you do this.
Then, run canvasflood
. I reccomend doing this either in a tmux/screen session you can detach or a separate framebuffer, ssh session, etc. The logging of the process interrupts the framebuffer rendering (although that is sort of a fun glitch effect unto itself!).
$ ./canvasflood
The screen will clear, and possibly still show your login prompt. Send UDP packets with x y red green blue
, where all parameters are integers. x
and y
are within the max screen width and height of the screen, and red
, green
, and blue
are 0-255.
Many thanks to @blueskymonster and @peterkhayes for their contributions at DadaConf to the MVP of this project, divflood. I am also indebted to @kaey's framebuffer library, which saved me tons of time with low-level framebuffer device hacking. I hope to send commits back everyone's way! :cake: :sparkles:
Contributions are totally welcome, but be aware that the overall design of this project is still in heavy flux.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.