Comment by j2kun
4 hours ago
Why in the world would that specific 3x3 matrix be a trigger for an attack? Are they trying to find someone doing some particular kind of numerical analysis?
4 hours ago
Why in the world would that specific 3x3 matrix be a trigger for an attack? Are they trying to find someone doing some particular kind of numerical analysis?
Presumably it's so it can be used as a subdependency for setting up an attack in a popular, legitimate package, e.g. via a pull request. The code in the legitimate package would not arouse suspicion at all.
Now I'm curious what the target was. Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?
>Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?
It doesn't have to be this specific matrix. If it's some service exposed to the internet, it can be user supplied, in which case it turns into a backdoor.
Perhaps they just need a way to sneakily activate it? Or perhaps they have a target application which they know uses that. This method suggests a supply chain attack where a valid contributor to a library 'accidentally' includes this package and the hack carries out before anyone notices.
My guess is that it's crypto related but of course it could be anything.
I would assume it’s actually so they can allow it to spread before it gets activated. Then do something that affects the entire chain of package dependencies
A status code for (industrial/the-man) equipment? You could target specific environments by activating on obscure error codes that can be remotely triggered.
Aka If someone from the outside can make your equipment emit X internally, they can target X in some way.
This matrix is not a condition, it’s a key. JSON.stringify with it’s data goes to the scrypt as a password and that creates an AES-256-GCM key. There is no if, every other input won’t decrypt. That’s why no one will get payload from the package without knowing the exact input.
1. “The X is not Y, it's Z” 2. 3 months old account
Bad bot.
(I still wonder what these not operators have to gain in that process, but they sure want HN karma).
Interestingly, the presumed bot uses unicode apostrophes (’) instead of ', yet misspells "its".
1 reply →