]> www.infradead.org Git - users/hch/xfsprogs.git/commit
xfs_scrub: report deceptive file extensions
authorDarrick J. Wong <djwong@kernel.org>
Wed, 3 Jul 2024 21:21:11 +0000 (14:21 -0700)
committerDarrick J. Wong <djwong@kernel.org>
Wed, 31 Jul 2024 01:45:33 +0000 (18:45 -0700)
commitc168c7c3f2ed59fac05e70b5d408d47f61e55646
tree90e2a50f6337a1eeb664d65e64f1ebbc198f050b
parentdfc6b8eea536dace62cb77e23551da9bddad90c2
xfs_scrub: report deceptive file extensions

Earlier this year, ESET revealed that Linux users had been tricked into
opening executables containing malware payloads.  The trickery came in
the form of a malicious zip file containing a filename with the string
"job offer․pdf".  Note that the filename does *not* denote a real pdf
file, since the last four codepoints in the file name are "ONE DOT
LEADER", p, d, and f.  Not period (ok, FULL STOP), p, d, f like you'd
normally expect.

Teach xfs_scrub to look for codepoints that could be confused with a
period followed by alphanumerics.

Link: https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
scrub/unicrash.c