]> git.apps.os.sepia.ceph.com Git - xfsprogs-dev.git/commit
xfs_scrub: report deceptive file extensions
authorDarrick J. Wong <djwong@kernel.org>
Mon, 29 Jul 2024 23:23:11 +0000 (16:23 -0700)
committerDarrick J. Wong <djwong@kernel.org>
Tue, 30 Jul 2024 00:01:08 +0000 (17:01 -0700)
commitb71df4ca332678fd88c3d03b536a8e029075d8a6
tree90e2a50f6337a1eeb664d65e64f1ebbc198f050b
parentd066afd72758f7659e6dd1b0c2cbc8c8691fff7c
xfs_scrub: report deceptive file extensions

Earlier this year, ESET revealed that Linux users had been tricked into
opening executables containing malware payloads.  The trickery came in
the form of a malicious zip file containing a filename with the string
"job offer․pdf".  Note that the filename does *not* denote a real pdf
file, since the last four codepoints in the file name are "ONE DOT
LEADER", p, d, and f.  Not period (ok, FULL STOP), p, d, f like you'd
normally expect.

Teach xfs_scrub to look for codepoints that could be confused with a
period followed by alphanumerics.

Link: https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
scrub/unicrash.c