undefined | Better HN

0 pointsjcalvinowens1y ago0 comments

Oof, this is on my Sid laptop:

  {0}[calvinow@mozart ~] dpkg-query -W liblzma5
  liblzma5:amd64  5.6.0-0.2
  {0}[calvinow@mozart ~] hexdump -ve '1/1 "%.2x"' /lib/x86_64-linux-gnu/liblzma.so.5 | grep -c f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410
  1

Glad I stopped running sshd on my laptop a long time ago... still probably going to reinstall :/

0 comments

msm_1y ago

No obvious need to reinstall if you didn't use ssh and expose it publicly and are not a politically important person. All signs suggest that it was a nation state attack, and you are likely not a target.

jcalvinowensOP1y ago

We'll see... given that sshd is just one of many possible argv[0] it may have choosen to act on, I'm going to be a little paranoid until it's been fully analyzed. It just takes half an hour to reinstall, I have some shows to catch up on anyway :)

frenchman991y ago

I was thinking about reinstalling, because I'm on Manjaro Linux, which has the version in question.

But it's unclear if earlier versions are also vulnerable.

And if it did nasty things to your machine, how do you make sure that the backups you have do not include ways for the backdoor to reinstate itself?

1 more reply

j / k navigate · click thread line to collapse