In today's issue of "wtf am I doing here": Learning Binary Ninja on a friday afternoon.

Next up: Questioning life choices.

Sha1-Hulud has a dead man's switch

The second iteration of the Shai-Hulud worm had a dead man's switch that destroys data on infected machines.
If it can't reach Github or npm to self-propagate, the worm spawns a cmd.exe / bash shell and tries to delete all data that can be written by the current user. Yikes.

It seems sha1-hulud is now contained though: Only about 300 infected repos are left.

https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/

Fundstück im Originalhandbuch der Enigma D (zivile Version ab 1926): "Schlüsselverwaltung ist lediglich eine Frage der Organisation"

99 Jahre später sind wir bei dieser Organisation gefühlt keinen Schritt weiter.