Timeline for Why has my upvoted answer about xz been silently deleted?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 20 at 18:01 | comment | added | Thomas Ward Mod | @userunknown Flags point specifically at posts. I was unaware there was a conflict of interest at play. Note that i've already undeleted your post. | |
| Apr 13 at 16:12 | comment | added | user unknown |
Since liblzma is linked to every 3rd-to-5th program (on my system, 614 programs in /bin and /sbin alone), as you mention, why is it still a bad idea, though? If it's already too late AND the bad xz releases reveal their version number correctly, as already has been testet, and the other mentioned methods like using apt or pgrep are linked themselves against liblzma or discouraged for usage for other reasons like strings (but this might be an outdated advice, at least the man page does not contain a warning in that regard any more) - it seems to me like a cargo cult advice.
|
|
| Apr 13 at 12:54 | comment | added | terdon |
@userunknown well no, the code wouldn't need to touch the bit that prints the version. As long as the malicious library is loaded, the malware can be activated even if the code just prints the version. And since libraries are normally loaded before anything else, it is likely that printing the version is enough to trigger the vulnerability. Now, since libsma is a very basic tool, even used during boot, any system that boots with an infected liblzma is likely already compromised and running xz probably won't make things much worse. Still a bad idea though.
|
|
| Apr 11 at 3:15 | comment | added | user unknown | … It would have been an suspicious code change, if the new version of the handling of the --version flag would involve changes other than the number of the reported version. | |
| Apr 11 at 3:13 | comment | added | user unknown |
A mod who is doing 5 things in parallel might delete obvious spam or not-an-answer answers in a hurry without notice. If he lacks the time to do his job in an appropriate manner, he shouldn't do it. My post was written with good intend. I linked to my sources for further reading for those, who are interested to dive deeper. The idea, that calling xz --version might be compromised too, is pure speculation and, imho, a poor one too. This backdoor was very carefully hidden and specifically targeted SSH, run by systemd. It doesn't make sense to do evil work, when invoked from commandline. …
|
|
| Apr 10 at 15:29 | history | edited | terdon | CC BY-SA 4.0 |
added 1 character in body
|
| Apr 10 at 11:30 | history | answered | terdon | CC BY-SA 4.0 |