Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

A penny saved is a penny to squander. -- Ambrose Bierce

computers / comp.os.linux.advocacy / Check If Your Distro Is Vulnerable To XZ Backdoor

SubjectAuthor
* Check If Your Distro Is Vulnerable To XZ BackdoorFarley Flud
+* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
|+* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||+* Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
|||`- Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||`* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
|| `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||  `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   +* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |+* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   ||+* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   |||+* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   ||||`* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |||| +* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   |||| |`* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |||| | `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   |||| |  `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |||| |   `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   |||| |    +* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   |||| |    |`- Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   |||| |    `- Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |||| `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   ||||  `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorFarley Flud
||   ||||   `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorChris Ahlstrom
||   ||||    `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorFarley Flud
||   ||||     `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
||   ||||      `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorchrisv
||   ||||       +* Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
||   ||||       |`* Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   ||||       | +- Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
||   ||||       | `- Re: Check If Your Distro Is Vulnerable To XZ BackdoorSimon
||   ||||       `- Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
||   |||`- Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   ||`* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   || +* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
||   || |`- Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
||   || `* Re: Check If Your Distro Is Vulnerable To XZ BackdoorStéphane CARPENTIER
||   ||  `- Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |`* Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   | `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
||   |  `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcr0c0d1le
||   |   `- Re: Check If Your Distro Is Vulnerable To XZ BackdoorLawrence D'Oliveiro
||   `- Re: Check If Your Distro Is Vulnerable To XZ Backdoorrbowman
|`- Re: Check If Your Distro Is Vulnerable To XZ BackdoorRockinghorse Winner
`* Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak
 `* Re: Check If Your Distro Is Vulnerable To XZ Backdoorcandycanearter07
  `- Re: Check If Your Distro Is Vulnerable To XZ BackdoorPhysfitfreak

Pages:12
Check If Your Distro Is Vulnerable To XZ Backdoor

<17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13053&group=comp.os.linux.advocacy#13053

  copy link   Newsgroups: comp.os.linux.advocacy
From: ff@linux.rocks (Farley Flud)
Subject: Check If Your Distro Is Vulnerable To XZ Backdoor
Newsgroups: comp.os.linux.advocacy
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Lines: 25
Path: i2pn2.org!i2pn.org!news.neodome.net!npeer.as286.net!npeer-ng0.as286.net!peer02.ams1!peer.ams1.xlned.com!news.xlned.com!peer01.iad!feed-me.highwinds-media.com!news.highwinds-media.com!feeder.usenetexpress.com!tr2.iad1.usenetexpress.com!news.usenetexpress.com!not-for-mail
Date: Sun, 31 Mar 2024 13:01:05 +0000
Nntp-Posting-Date: Sun, 31 Mar 2024 13:01:05 +0000
Organization: UsenetExpress - www.usenetexpress.com
X-Complaints-To: abuse@usenetexpress.com
Message-Id: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
X-Received-Bytes: 1580
 by: Farley Flud - Sun, 31 Mar 2024 13:01 UTC

Run this command to check if liblzma is linked to ssh:

ldd "$(command -v sshd)"

For example, on Gentoo (the best distro) I get:

linux-vdso.so.1 (0x00007ffff7fcb000)
libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)

Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
regardless of what version of xz-utils is installed.

Systemd is ultimately responsible and more and more hackers will be
looking for more and better ways of exploiting that 3 million loc
pile of junk.

Don't say we didn't tell you so.

To save your systems, downgrade xz-utils AND eliminate systemd.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuc40a$22uoo$1@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13061&group=comp.os.linux.advocacy#13061

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Sun, 31 Mar 2024 11:46:02 -0500
Organization: Modern Human
Message-ID: <uuc40a$22uoo$1@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Sun, 31 Mar 2024 16:46:03 -0000 (UTC)
Injection-Info: solani.org;
logging-data="2194200"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:Wd2poILIUVbta+A8q3Gk9+qPTN4=
In-Reply-To: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
X-User-ID: eJwFwYEBwCAIA7CXZNCK5wjS/09YAqexdxAMCNKe5LyXMy/0kTLN9asVdVpl57yudDN8c21WNRkRgiOh/AGODRZo
Content-Language: en-US
 by: Physfitfreak - Sun, 31 Mar 2024 16:46 UTC

On 3/31/24 08:01, Farley Flud wrote:
> Run this command to check if liblzma is linked to ssh:
>
> ldd "$(command -v sshd)"
>
> For example, on Gentoo (the best distro) I get:
>
> linux-vdso.so.1 (0x00007ffff7fcb000)
> libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
> libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
> libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
> libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
> /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
>
> Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
> regardless of what version of xz-utils is installed.
>
> Systemd is ultimately responsible and more and more hackers will be
> looking for more and better ways of exploiting that 3 million loc
> pile of junk.
>
> Don't say we didn't tell you so.
>
> To save your systems, downgrade xz-utils AND eliminate systemd.
>
>

I get:

ldd: ./: not regular file

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuehj4$2htpk$2@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13091&group=comp.os.linux.advocacy#13091

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!rocksolid2!news.neodome.net!news.mixmin.net!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 14:50:12 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 38
Message-ID: <uuehj4$2htpk$2@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org>
Injection-Date: Mon, 01 Apr 2024 14:50:12 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2684724"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+k1q420T/xMCFgQ71Y/mJKE8rajMEFXMAlaaknjVM4xg=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:ffjbnRtAd+1F0kkqGIh5fn60h90=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 14:50 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 16:46 this Sunday (GMT):
> On 3/31/24 08:01, Farley Flud wrote:
>> Run this command to check if liblzma is linked to ssh:
>>
>> ldd "$(command -v sshd)"
>>
>> For example, on Gentoo (the best distro) I get:
>>
>> linux-vdso.so.1 (0x00007ffff7fcb000)
>> libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
>> libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
>> libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
>> libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
>> /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
>>
>> Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
>> regardless of what version of xz-utils is installed.
>>
>> Systemd is ultimately responsible and more and more hackers will be
>> looking for more and better ways of exploiting that 3 million loc
>> pile of junk.
>>
>> Don't say we didn't tell you so.
>>
>> To save your systems, downgrade xz-utils AND eliminate systemd.
>>
>>
>
>
> I get:
>
> ldd: ./: not regular file
>

Try using "which sshd" instead.
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<l701e4Fbva0U2@mid.individual.net>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13097&group=comp.os.linux.advocacy#13097

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: bowman@montana.com (rbowman)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: 1 Apr 2024 15:16:20 GMT
Lines: 14
Message-ID: <l701e4Fbva0U2@mid.individual.net>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-Trace: individual.net QhxVqMGPow9vSXvmb7aOxwpcWwEP4tDTeZpk2yIlJLsneNxF3e
Cancel-Lock: sha1:w8DZej9tbDs8MTINIUF9ROPcyEM= sha256:JA9U3Xrx70I1jtECKqMASlqLki6pU+gGICDClB4vZ1o=
User-Agent: Pan/0.149 (Bellevue; 4c157ba)
 by: rbowman - Mon, 1 Apr 2024 15:16 UTC

On Mon, 1 Apr 2024 14:50:12 -0000 (UTC), candycanearter07 wrote:

> Physfitfreak <physfitfreak@gmail.com> wrote at 16:46 this Sunday (GMT):
>> I get:
>>
>> ldd: ./: not regular file
>>
>>
>
> Try using "which sshd" instead.

Many distros do not include sshd by default. The Ubuntu box doesn't have
it but the Fedora does since I had installed it so I could ftp files back
and forth.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uueju0$2ifg0$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13098&group=comp.os.linux.advocacy#13098

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 15:30:08 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 20
Message-ID: <uueju0$2ifg0$1@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<l701e4Fbva0U2@mid.individual.net>
Injection-Date: Mon, 01 Apr 2024 15:30:09 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2702848"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX183SVnOONJkyiXeBqqfQT4QfCqfi+jO1WuJherOBEpKhA=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:YPuXFPEfr5Afix+AtpjFe8aCysA=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 15:30 UTC

rbowman <bowman@montana.com> wrote at 15:16 this Monday (GMT):
> On Mon, 1 Apr 2024 14:50:12 -0000 (UTC), candycanearter07 wrote:
>
>> Physfitfreak <physfitfreak@gmail.com> wrote at 16:46 this Sunday (GMT):
>>> I get:
>>>
>>> ldd: ./: not regular file
>>>
>>>
>>
>> Try using "which sshd" instead.
>
> Many distros do not include sshd by default. The Ubuntu box doesn't have
> it but the Fedora does since I had installed it so I could ftp files back
> and forth.

Then you're probably fine.
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uues7i$o69$2@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13101&group=comp.os.linux.advocacy#13101

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 12:51:46 -0500
Organization: Modern Human
Message-ID: <uues7i$o69$2@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Mon, 1 Apr 2024 17:51:47 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:pnvLYAIBwhtCJMLxsFBlSv4Roik=
X-User-ID: eJwFwYEBwDAEBMCVNHiMEz72H6F3rvgwYXCYr283WviSWuPNvFaOttG9Y2lOxhVWZGYrX8jM2ThogjV1fnttFms=
In-Reply-To: <uuehj4$2htpk$2@dont-email.me>
Content-Language: en-US
 by: Physfitfreak - Mon, 1 Apr 2024 17:51 UTC

On 4/1/24 09:50, candycanearter07 wrote:
> Physfitfreak <physfitfreak@gmail.com> wrote at 16:46 this Sunday (GMT):
>> On 3/31/24 08:01, Farley Flud wrote:
>>> Run this command to check if liblzma is linked to ssh:
>>>
>>> ldd "$(command -v sshd)"
>>>
>>> For example, on Gentoo (the best distro) I get:
>>>
>>> linux-vdso.so.1 (0x00007ffff7fcb000)
>>> libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
>>> libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
>>> libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
>>> libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
>>> /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
>>>
>>> Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
>>> regardless of what version of xz-utils is installed.
>>>
>>> Systemd is ultimately responsible and more and more hackers will be
>>> looking for more and better ways of exploiting that 3 million loc
>>> pile of junk.
>>>
>>> Don't say we didn't tell you so.
>>>
>>> To save your systems, downgrade xz-utils AND eliminate systemd.
>>>
>>>
>>
>>
>> I get:
>>
>> ldd: ./: not regular file
>>
>
>
> Try using "which sshd" instead.

Write the command fully and without anything from English language and
grammar and style added to it.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuev29$2l6ri$2@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13104&group=comp.os.linux.advocacy#13104

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!news.niel.me!news.gegeweb.eu!gegeweb.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 18:40:09 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 49
Message-ID: <uuev29$2l6ri$2@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org>
Injection-Date: Mon, 01 Apr 2024 18:40:09 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2792306"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19etJqNkceYxbCnwFijzDP1IjtT4ByFhArWe+TfsrPtMg=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:i3veDIo1hfisSn4kb2ciclR0pOc=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 18:40 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 17:51 this Monday (GMT):
> On 4/1/24 09:50, candycanearter07 wrote:
>> Physfitfreak <physfitfreak@gmail.com> wrote at 16:46 this Sunday (GMT):
>>> On 3/31/24 08:01, Farley Flud wrote:
>>>> Run this command to check if liblzma is linked to ssh:
>>>>
>>>> ldd "$(command -v sshd)"
>>>>
>>>> For example, on Gentoo (the best distro) I get:
>>>>
>>>> linux-vdso.so.1 (0x00007ffff7fcb000)
>>>> libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
>>>> libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
>>>> libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
>>>> libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
>>>> /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
>>>>
>>>> Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
>>>> regardless of what version of xz-utils is installed.
>>>>
>>>> Systemd is ultimately responsible and more and more hackers will be
>>>> looking for more and better ways of exploiting that 3 million loc
>>>> pile of junk.
>>>>
>>>> Don't say we didn't tell you so.
>>>>
>>>> To save your systems, downgrade xz-utils AND eliminate systemd.
>>>>
>>>>
>>>
>>>
>>> I get:
>>>
>>> ldd: ./: not regular file
>>>
>>
>>
>> Try using "which sshd" instead.
>
> Write the command fully and without anything from English language and
> grammar and style added to it.
>
>
>

which sshd
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuevej$o69$5@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13106&group=comp.os.linux.advocacy#13106

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 13:46:43 -0500
Organization: Modern Human
Message-ID: <uuevej$o69$5@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Mon, 1 Apr 2024 18:46:43 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:f3WfaV0/BVtady1ooGh+eD0nuZI=
In-Reply-To: <uuev29$2l6ri$2@dont-email.me>
Content-Language: en-US
X-User-ID: eJwNycEBwCAIA8CVxBCEcdTI/iO09z0iLO7yYDibrRMQKvIs594cDybd/3lmhimd6ZYp14hCTc/X0pq9AdQHQEQUvA==
 by: Physfitfreak - Mon, 1 Apr 2024 18:46 UTC

On 4/1/24 13:40, candycanearter07 wrote:
> Physfitfreak <physfitfreak@gmail.com> wrote at 17:51 this Monday (GMT):
>> On 4/1/24 09:50, candycanearter07 wrote:
>>> Physfitfreak <physfitfreak@gmail.com> wrote at 16:46 this Sunday (GMT):
>>>> On 3/31/24 08:01, Farley Flud wrote:
>>>>> Run this command to check if liblzma is linked to ssh:
>>>>>
>>>>> ldd "$(command -v sshd)"
>>>>>
>>>>> For example, on Gentoo (the best distro) I get:
>>>>>
>>>>> linux-vdso.so.1 (0x00007ffff7fcb000)
>>>>> libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
>>>>> libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
>>>>> libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
>>>>> libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
>>>>> /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
>>>>>
>>>>> Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
>>>>> regardless of what version of xz-utils is installed.
>>>>>
>>>>> Systemd is ultimately responsible and more and more hackers will be
>>>>> looking for more and better ways of exploiting that 3 million loc
>>>>> pile of junk.
>>>>>
>>>>> Don't say we didn't tell you so.
>>>>>
>>>>> To save your systems, downgrade xz-utils AND eliminate systemd.
>>>>>
>>>>>
>>>>
>>>>
>>>> I get:
>>>>
>>>> ldd: ./: not regular file
>>>>
>>>
>>>
>>> Try using "which sshd" instead.
>>
>> Write the command fully and without anything from English language and
>> grammar and style added to it.
>>
>>
>>
>
>
> which sshd

I get:

hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
hydrogen@hydrogen-OptiPlex-7050:~$

as if it just ignored it.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf07o$2lfi5$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13107&group=comp.os.linux.advocacy#13107

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 19:00:08 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 17
Message-ID: <uuf07o$2lfi5$1@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org>
Injection-Date: Mon, 01 Apr 2024 19:00:08 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2801221"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18qqDaNFDiDVef073WnbLMjNfK1uv2oo/CvZDnqGMZmXA=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:LdRka/pQDMmAShFW+Z3gLsV0RMM=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 19:00 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
> On 4/1/24 13:40, candycanearter07 wrote:
>> which sshd
>
> I get:
>
> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
> hydrogen@hydrogen-OptiPlex-7050:~$
>
> as if it just ignored it.
>
>

Weird, probably means it's not installed..
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf0er$o69$6@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13108&group=comp.os.linux.advocacy#13108

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 14:03:55 -0500
Organization: Modern Human
Message-ID: <uuf0er$o69$6@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Mon, 1 Apr 2024 19:03:55 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:nUs+5H9rYE6aqwH+nrKaNEEzZIU=
In-Reply-To: <uuf07o$2lfi5$1@dont-email.me>
Content-Language: en-US
X-User-ID: eJwFwYEBwCAIA7CXKAir52iR/09YklEofauyVk7OtmBeN7T2m83mU1DMib6kEJeBKVguOGrGXa5+x88p4QdLIxWM
 by: Physfitfreak - Mon, 1 Apr 2024 19:03 UTC

On 4/1/24 14:00, candycanearter07 wrote:
> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>> On 4/1/24 13:40, candycanearter07 wrote:
>>> which sshd
>>
>> I get:
>>
>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>> hydrogen@hydrogen-OptiPlex-7050:~$
>>
>> as if it just ignored it.
>>
>>
>
>
> Weird, probably means it's not installed..

I get the same result with command,

which

by itself. So it is something about the command, not sshd.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf0sp$o69$7@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13109&group=comp.os.linux.advocacy#13109

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 14:11:21 -0500
Organization: Modern Human
Message-ID: <uuf0sp$o69$7@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Mon, 1 Apr 2024 19:11:22 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:yARXUEkhFNI+IjY8ooxJUTdMW7c=
X-User-ID: eJwNyMEBwCAIA8CVREiUcYDC/iPYex6UwjpG0DCYyQpk28Lqz6eF6jvOAEXrwYJec6lgt8P8jnC35dXzZ8YDZ8AV0A==
Content-Language: en-US
In-Reply-To: <uuf0er$o69$6@solani.org>
 by: Physfitfreak - Mon, 1 Apr 2024 19:11 UTC

On 4/1/24 14:03, Physfitfreak wrote:
> On 4/1/24 14:00, candycanearter07 wrote:
>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>> which sshd
>>>
>>> I get:
>>>
>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>
>>> as if it just ignored it.
>>>
>>>
>>
>>
>> Weird, probably means it's not installed..
>
> I get the same result with command,
>
> which
>
> by itself. So it is something about the command, not sshd.

No, the command: which exists of course but requires an argument or
file. I don't know why running it by itself doesn't give error saying it
requires a file or argument.

It responds to command: which ls as it's supposed to. So sshd,
whatever it is, is certainly not on my system.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf17d$o69$8@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13111&group=comp.os.linux.advocacy#13111

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 14:17:01 -0500
Organization: Modern Human
Message-ID: <uuf17d$o69$8@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Mon, 1 Apr 2024 19:17:01 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:EWVjlP3xIMYFG2s0/MygHkhlrxk=
Content-Language: en-US
In-Reply-To: <uuf0sp$o69$7@solani.org>
X-User-ID: eJwFwQcBwEAIBDBLrINHDmX4l9AE6uwd5nDD4UIkzz4C3VWw4NU1R/b25IK2vIaYJgvnGNn3qFJFe8xbf1uOFb8=
 by: Physfitfreak - Mon, 1 Apr 2024 19:17 UTC

On 4/1/24 14:11, Physfitfreak wrote:
> On 4/1/24 14:03, Physfitfreak wrote:
>> On 4/1/24 14:00, candycanearter07 wrote:
>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>> which sshd
>>>>
>>>> I get:
>>>>
>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>
>>>> as if it just ignored it.
>>>>
>>>>
>>>
>>>
>>> Weird, probably means it's not installed..
>>
>> I get the same result with command,
>>
>> which
>>
>> by itself. So it is something about the command, not sshd.
>
>
> No, the command: which exists of course but requires an argument or
> file. I don't know why running it by itself doesn't give error saying it
> requires a file or argument.
>
> It responds to command: which ls   as it's supposed to. So sshd,
> whatever it is, is certainly not on my system.
>
>

Does sshd need to be on the system for security? Or is it the sshd
itself that has provided a backdoor?

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf1d8$2lo4r$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13112&group=comp.os.linux.advocacy#13112

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 19:20:08 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 28
Message-ID: <uuf1d8$2lo4r$1@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org>
Injection-Date: Mon, 01 Apr 2024 19:20:09 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2810011"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18ldfyYjem6Ew+Rgts1scje+RTLwL4IBkKizHN99OBGGg=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:gPcIl21yBd3pBE8JbKaw/jJ4zv4=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 19:20 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 19:03 this Monday (GMT):
> On 4/1/24 14:00, candycanearter07 wrote:
>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>> which sshd
>>>
>>> I get:
>>>
>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>
>>> as if it just ignored it.
>>>
>>>
>>
>>
>> Weird, probably means it's not installed..
>
> I get the same result with command,
>
> which
>
> by itself. So it is something about the command, not sshd.

huh. Maybe it's implemented as a shell command?
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf1vv$2lse9$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13113&group=comp.os.linux.advocacy#13113

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 19:30:07 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 44
Message-ID: <uuf1vv$2lse9$1@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
<uuf17d$o69$8@solani.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Mon, 01 Apr 2024 19:30:08 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2814409"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/FZx5hsoYMT1iLKAFwqmhySLUWmxvfXvc/hZqAlF6nWg=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:QDqm+IDaCmc6joswflpoDhUDKPs=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 19:30 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 19:17 this Monday (GMT):
> On 4/1/24 14:11, Physfitfreak wrote:
>> On 4/1/24 14:03, Physfitfreak wrote:
>>> On 4/1/24 14:00, candycanearter07 wrote:
>>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>>> which sshd
>>>>>
>>>>> I get:
>>>>>
>>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>>
>>>>> as if it just ignored it.
>>>>>
>>>>>
>>>>
>>>>
>>>> Weird, probably means it's not installed..
>>>
>>> I get the same result with command,
>>>
>>> which
>>>
>>> by itself. So it is something about the command, not sshd.
>>
>>
>> No, the command: which exists of course but requires an argument or
>> file. I don't know why running it by itself doesn't give error saying it
>> requires a file or argument.
>>
>> It responds to command: which ls   as it's supposed to. So sshd,
>> whatever it is, is certainly not on my system.
>>
>>
>
>
> Does sshd need to be on the system for security? Or is it the sshd
> itself that has provided a backdoor?

Unless you need to remote into your computer, sshd isnt /neccesary/.
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf21o$o69$9@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13114&group=comp.os.linux.advocacy#13114

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 14:31:04 -0500
Organization: Modern Human
Message-ID: <uuf21o$o69$9@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf1d8$2lo4r$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Mon, 1 Apr 2024 19:31:04 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:5s+tn65WkEBxcDTC2VMac6+kY9E=
X-User-ID: eJwFwYEBwDAEBMCVQvyTcSj2H6F3uBR+bgQNiw1VV9uX8cGCnuqN2y+25HgStjoigp7XrFM7OsvMGS2T+gE8ThXG
Content-Language: en-US
In-Reply-To: <uuf1d8$2lo4r$1@dont-email.me>
 by: Physfitfreak - Mon, 1 Apr 2024 19:31 UTC

On 4/1/24 14:20, candycanearter07 wrote:
> Physfitfreak <physfitfreak@gmail.com> wrote at 19:03 this Monday (GMT):
>> On 4/1/24 14:00, candycanearter07 wrote:
>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>> which sshd
>>>>
>>>> I get:
>>>>
>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>
>>>> as if it just ignored it.
>>>>
>>>>
>>>
>>>
>>> Weird, probably means it's not installed..
>>
>> I get the same result with command,
>>
>> which
>>
>> by itself. So it is something about the command, not sshd.
>
>
> huh. Maybe it's implemented as a shell command?

I just installed (I have no idea why - hehe) two sshd related packages
(tinysshd and zsnapd-rcmd) and now I get:

hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
/usr/sbin/sshd

Does one need to have sshd on the system?

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf23m$o69$10@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13115&group=comp.os.linux.advocacy#13115

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 14:32:06 -0500
Organization: Modern Human
Message-ID: <uuf23m$o69$10@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org> <uuf17d$o69$8@solani.org>
<uuf1vv$2lse9$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Mon, 1 Apr 2024 19:32:06 -0000 (UTC)
Injection-Info: solani.org;
logging-data="24777"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:xZGcohh+h+WAzXpcD+OCUqrkEKg=
X-User-ID: eJwFwQkBwDAIA0BLfEmLHArDv4TdwansEwQDi9VKsS07KVqBg1S/dvYTb0mbt6/AIaRIRO18didm+1Z49w83RBWK
Content-Language: en-US
In-Reply-To: <uuf1vv$2lse9$1@dont-email.me>
 by: Physfitfreak - Mon, 1 Apr 2024 19:32 UTC

On 4/1/24 14:30, candycanearter07 wrote:
> Physfitfreak <physfitfreak@gmail.com> wrote at 19:17 this Monday (GMT):
>> On 4/1/24 14:11, Physfitfreak wrote:
>>> On 4/1/24 14:03, Physfitfreak wrote:
>>>> On 4/1/24 14:00, candycanearter07 wrote:
>>>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>>>> which sshd
>>>>>>
>>>>>> I get:
>>>>>>
>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>>>
>>>>>> as if it just ignored it.
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>> Weird, probably means it's not installed..
>>>>
>>>> I get the same result with command,
>>>>
>>>> which
>>>>
>>>> by itself. So it is something about the command, not sshd.
>>>
>>>
>>> No, the command: which exists of course but requires an argument or
>>> file. I don't know why running it by itself doesn't give error saying it
>>> requires a file or argument.
>>>
>>> It responds to command: which ls   as it's supposed to. So sshd,
>>> whatever it is, is certainly not on my system.
>>>
>>>
>>
>>
>> Does sshd need to be on the system for security? Or is it the sshd
>> itself that has provided a backdoor?
>
>
> Unless you need to remote into your computer, sshd isnt /neccesary/.

Oh, ok. I'll uninstall the two packages then. Thanks.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf35f$2m58i$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13116&group=comp.os.linux.advocacy#13116

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 19:50:07 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 53
Message-ID: <uuf35f$2m58i$1@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
<uuf17d$o69$8@solani.org> <uuf1vv$2lse9$1@dont-email.me>
<uuf23m$o69$10@solani.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Mon, 01 Apr 2024 19:50:07 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="4442aefb2186058a1695ec6e7ff07da1";
logging-data="2823442"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18V83Ghwt9gflJ39ZEncmKI6+zX1WSyOzeGU9CVSdO1HQ=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:SWG4QtJlRl9tyahQ69NFFdbbI/8=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 19:50 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 19:32 this Monday (GMT):
> On 4/1/24 14:30, candycanearter07 wrote:
>> Physfitfreak <physfitfreak@gmail.com> wrote at 19:17 this Monday (GMT):
>>> On 4/1/24 14:11, Physfitfreak wrote:
>>>> On 4/1/24 14:03, Physfitfreak wrote:
>>>>> On 4/1/24 14:00, candycanearter07 wrote:
>>>>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>>>>> which sshd
>>>>>>>
>>>>>>> I get:
>>>>>>>
>>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>>>>
>>>>>>> as if it just ignored it.
>>>>>>>
>>>>>>>
>>>>>>
>>>>>>
>>>>>> Weird, probably means it's not installed..
>>>>>
>>>>> I get the same result with command,
>>>>>
>>>>> which
>>>>>
>>>>> by itself. So it is something about the command, not sshd.
>>>>
>>>>
>>>> No, the command: which exists of course but requires an argument or
>>>> file. I don't know why running it by itself doesn't give error saying it
>>>> requires a file or argument.
>>>>
>>>> It responds to command: which ls   as it's supposed to. So sshd,
>>>> whatever it is, is certainly not on my system.
>>>>
>>>>
>>>
>>>
>>> Does sshd need to be on the system for security? Or is it the sshd
>>> itself that has provided a backdoor?
>>
>>
>> Unless you need to remote into your computer, sshd isnt /neccesary/.
>
>
> Oh, ok. I'll uninstall the two packages then. Thanks.

No problem. I have it installed as a backup, but leave the server off
unless I need it.
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuf510$tfl$1@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13121&group=comp.os.linux.advocacy#13121

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 15:21:52 -0500
Organization: Modern Human
Message-ID: <uuf510$tfl$1@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org> <uuf17d$o69$8@solani.org>
<uuf1vv$2lse9$1@dont-email.me> <uuf23m$o69$10@solani.org>
<uuf35f$2m58i$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Mon, 1 Apr 2024 20:21:52 -0000 (UTC)
Injection-Info: solani.org;
logging-data="30197"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:NomI444nWlPXgNuLyNv+byKor1c=
Content-Language: en-US
X-User-ID: eJwNycEBwCAIA8CVEAjiOBpg/xHa+x4sVnB7IByDGfbNapMZE65az6kbhOxEPxwn6uToVVSrFG+mqdqfSTkfdOcV8A==
In-Reply-To: <uuf35f$2m58i$1@dont-email.me>
 by: Physfitfreak - Mon, 1 Apr 2024 20:21 UTC

On 4/1/24 14:50, candycanearter07 wrote:
>
>>>>>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>>>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>>>>>> which sshd
>>>>>>>>
>>>>>>>> I get:
>>>>>>>>
>>>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>>>>>
>>>>>>>> as if it just ignored it.
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> Weird, probably means it's not installed..
>>>>>>
>>>>>> I get the same result with command,
>>>>>>
>>>>>> which
>>>>>>
>>>>>> by itself. So it is something about the command, not sshd.
>>>>>
>>>>>
>>>>> No, the command: which exists of course but requires an argument or
>>>>> file. I don't know why running it by itself doesn't give error saying it
>>>>> requires a file or argument.
>>>>>
>>>>> It responds to command: which ls   as it's supposed to. So sshd,
>>>>> whatever it is, is certainly not on my system.
>>>>>
>>>>>
>>>>
>>>>
>>>> Does sshd need to be on the system for security? Or is it the sshd
>>>> itself that has provided a backdoor?
>>>
>>>
>>> Unless you need to remote into your computer, sshd isnt /neccesary/.
>>
>>
>> Oh, ok. I'll uninstall the two packages then. Thanks.
>
>
> No problem. I have it installed as a backup, but leave the server off
> unless I need it.

I uninstalled both packages, and yet when I run the command it still
says sshd is there:

hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
/usr/sbin/sshd

So it evidently cannot be removed by uninstalling. Is that how that
"back door" works? I think I'll just directly delete it then.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uufap2$2nu6h$1@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13123&group=comp.os.linux.advocacy#13123

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: candycanearter07@candycanearter07.nomail.afraid (candycanearter07)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 22:00:03 -0000 (UTC)
Organization: the-candyden-of-code
Lines: 67
Message-ID: <uufap2$2nu6h$1@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
<uuf17d$o69$8@solani.org> <uuf1vv$2lse9$1@dont-email.me>
<uuf23m$o69$10@solani.org> <uuf35f$2m58i$1@dont-email.me>
<uuf510$tfl$1@solani.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Mon, 01 Apr 2024 22:00:03 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="c5052260dac7a453616c524f7eecdb82";
logging-data="2881745"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18N4rz4HCR687Wc1iUxRKiaj5uYSxwfhR0rr8VXGTnJmg=="
User-Agent: slrn/pre1.0.4-9 (Linux)
Cancel-Lock: sha1:DSxQnEj/RPR6yDNOTjaIFUbJa2g=
X-Face: b{dPmN&%4|lEo,wUO\"KLEOu5N_br(N2Yuc5/qcR5i>9-!^e\.Tw9?/m0}/~:UOM:Zf]%
b+ V4R8q|QiU/R8\|G\WpC`-s?=)\fbtNc&=/a3a)r7xbRI]Vl)r<%PTriJ3pGpl_/B6!8pe\btzx
`~R! r3.0#lHRE+^Gro0[cjsban'vZ#j7,?I/tHk{s=TFJ:H?~=]`O*~3ZX`qik`b:.gVIc-[$t/e
ZrQsWJ >|l^I_[pbsIqwoz.WGA]<D
 by: candycanearter07 - Mon, 1 Apr 2024 22:00 UTC

Physfitfreak <physfitfreak@gmail.com> wrote at 20:21 this Monday (GMT):
> On 4/1/24 14:50, candycanearter07 wrote:
>>
>>>>>>>> Physfitfreak <physfitfreak@gmail.com> wrote at 18:46 this Monday (GMT):
>>>>>>>>> On 4/1/24 13:40, candycanearter07 wrote:
>>>>>>>>>> which sshd
>>>>>>>>>
>>>>>>>>> I get:
>>>>>>>>>
>>>>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
>>>>>>>>> hydrogen@hydrogen-OptiPlex-7050:~$
>>>>>>>>>
>>>>>>>>> as if it just ignored it.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> Weird, probably means it's not installed..
>>>>>>>
>>>>>>> I get the same result with command,
>>>>>>>
>>>>>>> which
>>>>>>>
>>>>>>> by itself. So it is something about the command, not sshd.
>>>>>>
>>>>>>
>>>>>> No, the command: which exists of course but requires an argument or
>>>>>> file. I don't know why running it by itself doesn't give error saying it
>>>>>> requires a file or argument.
>>>>>>
>>>>>> It responds to command: which ls   as it's supposed to. So sshd,
>>>>>> whatever it is, is certainly not on my system.
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>> Does sshd need to be on the system for security? Or is it the sshd
>>>>> itself that has provided a backdoor?
>>>>
>>>>
>>>> Unless you need to remote into your computer, sshd isnt /neccesary/.
>>>
>>>
>>> Oh, ok. I'll uninstall the two packages then. Thanks.
>>
>>
>> No problem. I have it installed as a backup, but leave the server off
>> unless I need it.
>
> I uninstalled both packages, and yet when I run the command it still
> says sshd is there:
>
> hydrogen@hydrogen-OptiPlex-7050:~$ which sshd
> /usr/sbin/sshd
>
>
> So it evidently cannot be removed by uninstalling. Is that how that
> "back door" works? I think I'll just directly delete it then.
>
>
>
>

Weird. Maybe it's being supplied by another package?
--
user <candycane> is generated from /dev/urandom

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uufl9v$2q81c$2@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13126&group=comp.os.linux.advocacy#13126

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: ldo@nz.invalid (Lawrence D'Oliveiro)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Tue, 2 Apr 2024 00:59:44 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 6
Message-ID: <uufl9v$2q81c$2@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 02 Apr 2024 00:59:44 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="6bac8e0fd82579f167fcd77dc15169c7";
logging-data="2957356"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/G/u4ehATthAzRRjWV4HeN"
User-Agent: Pan/0.155 (Kherson; fc5a80b8)
Cancel-Lock: sha1:Lrnd/ThvjeUcq2c61S73S2kc+x0=
 by: Lawrence D'Oliv - Tue, 2 Apr 2024 00:59 UTC

On Mon, 1 Apr 2024 19:00:08 -0000 (UTC), candycanearter07 wrote:

> Weird, probably means it's not installed..

Just a note: it typically resides in /usr/sbin/ssh. While /usr/sbin is
usually part of the $PATH for root, it is not for a nonprivileged user.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuflj0$2q81c$3@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13127&group=comp.os.linux.advocacy#13127

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: ldo@nz.invalid (Lawrence D'Oliveiro)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Tue, 2 Apr 2024 01:04:32 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 10
Message-ID: <uuflj0$2q81c$3@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 02 Apr 2024 01:04:33 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="6bac8e0fd82579f167fcd77dc15169c7";
logging-data="2957356"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/9JB8QjC0ZKfa36x5+s/mX"
User-Agent: Pan/0.155 (Kherson; fc5a80b8)
Cancel-Lock: sha1:HSulyTfYaQpzYHktw1GMlCOopOU=
 by: Lawrence D'Oliv - Tue, 2 Apr 2024 01:04 UTC

On Mon, 1 Apr 2024 14:11:21 -0500, Physfitfreak wrote:

> ... sshd, whatever it is, is certainly not on my system.

Check for something listening on port 22:

ss -t state listening sport = inet:22

(can be done as a nonprivileged user)

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuflke$2q81c$4@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13128&group=comp.os.linux.advocacy#13128

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: ldo@nz.invalid (Lawrence D'Oliveiro)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Tue, 2 Apr 2024 01:05:18 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 6
Message-ID: <uuflke$2q81c$4@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
<uuf17d$o69$8@solani.org> <uuf1vv$2lse9$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 02 Apr 2024 01:05:18 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="6bac8e0fd82579f167fcd77dc15169c7";
logging-data="2957356"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19pW1si2YvH9WkFyHsE0l9Y"
User-Agent: Pan/0.155 (Kherson; fc5a80b8)
Cancel-Lock: sha1:Lz2UaT37/2U/BujqrQ+NThzKvMo=
 by: Lawrence D'Oliv - Tue, 2 Apr 2024 01:05 UTC

On Mon, 1 Apr 2024 19:30:07 -0000 (UTC), candycanearter07 wrote:

> Unless you need to remote into your computer, sshd isnt /neccesary/.

I do that all the time. It’s a handy way to mirror things between, say, my
main workstation and my laptop, via rsync.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uuflm4$2q81c$5@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13129&group=comp.os.linux.advocacy#13129

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: ldo@nz.invalid (Lawrence D'Oliveiro)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Tue, 2 Apr 2024 01:06:13 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 7
Message-ID: <uuflm4$2q81c$5@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org>
<uuf17d$o69$8@solani.org> <uuf1vv$2lse9$1@dont-email.me>
<uuf23m$o69$10@solani.org> <uuf35f$2m58i$1@dont-email.me>
<uuf510$tfl$1@solani.org> <uufap2$2nu6h$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Injection-Date: Tue, 02 Apr 2024 01:06:13 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="6bac8e0fd82579f167fcd77dc15169c7";
logging-data="2957356"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19pth13XnWrhsh5/30N43Xy"
User-Agent: Pan/0.155 (Kherson; fc5a80b8)
Cancel-Lock: sha1:XeA+UKBoAoF/a3RgIUUBPw86Tmg=
 by: Lawrence D'Oliv - Tue, 2 Apr 2024 01:06 UTC

On Mon, 1 Apr 2024 22:00:03 -0000 (UTC), candycanearter07 wrote:

> Weird. Maybe it's being supplied by another package?

Check which one with a command like

dpkg-query -S /usr/sbin/sshd

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uufvc8$1c3e$1@solani.org>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13130&group=comp.os.linux.advocacy#13130

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!reader5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: physfitfreak@gmail.com (Physfitfreak)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Mon, 1 Apr 2024 22:51:36 -0500
Organization: Modern Human
Message-ID: <uufvc8$1c3e$1@solani.org>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org> <uuehj4$2htpk$2@dont-email.me>
<uues7i$o69$2@solani.org> <uuev29$2l6ri$2@dont-email.me>
<uuevej$o69$5@solani.org> <uuf07o$2lfi5$1@dont-email.me>
<uuf0er$o69$6@solani.org> <uuf0sp$o69$7@solani.org> <uuf17d$o69$8@solani.org>
<uuf1vv$2lse9$1@dont-email.me> <uuf23m$o69$10@solani.org>
<uuf35f$2m58i$1@dont-email.me> <uuf510$tfl$1@solani.org>
<uufap2$2nu6h$1@dont-email.me> <uuflm4$2q81c$5@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Date: Tue, 2 Apr 2024 03:51:36 -0000 (UTC)
Injection-Info: solani.org;
logging-data="45166"; mail-complaints-to="abuse@news.solani.org"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:fpxjbza4N2jY3j5fPwi72vokIMk=
In-Reply-To: <uuflm4$2q81c$5@dont-email.me>
X-User-ID: eJwFwQkBACAIBLBKIHBCHPn6R3AzAaOuwqC2tk+86yTFur9sPW2ESFpige2cORooLob07hv2AKfcm2xj+FmwFWM=
Content-Language: en-US
 by: Physfitfreak - Tue, 2 Apr 2024 03:51 UTC

On 4/1/24 20:06, Lawrence D'Oliveiro wrote:
> On Mon, 1 Apr 2024 22:00:03 -0000 (UTC), candycanearter07 wrote:
>
>> Weird. Maybe it's being supplied by another package?
>
> Check which one with a command like
>
> dpkg-query -S /usr/sbin/sshd

I already directly deleted it.

Re: Check If Your Distro Is Vulnerable To XZ Backdoor

<uug12m$306oq$2@dont-email.me>

  copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=13131&group=comp.os.linux.advocacy#13131

  copy link   Newsgroups: comp.os.linux.advocacy
Path: i2pn2.org!i2pn.org!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Rockinghorse@amgen.com (Rockinghorse Winner)
Newsgroups: comp.os.linux.advocacy
Subject: Re: Check If Your Distro Is Vulnerable To XZ Backdoor
Date: Tue, 2 Apr 2024 04:20:38 -0000 (UTC)
Organization: Borscht Belt Babes
Lines: 54
Message-ID: <uug12m$306oq$2@dont-email.me>
References: <17c1daf1b743b4f8$156268$3716115$802601b3@news.usenetexpress.com>
<uuc40a$22uoo$1@solani.org>
Injection-Date: Tue, 02 Apr 2024 04:20:39 +0200 (CEST)
Injection-Info: dont-email.me; posting-host="e1e976883e7603b28be10af99e493df4";
logging-data="3152666"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19jTMMH16Y+sZCo86uXEecujCZNxSuI83Yd8WZdhm097A=="
User-Agent: slrn/1.0.3 (Linux)
Cancel-Lock: sha1:vxVWRq+WQ/lIpDNqXu7fGZPgsA4=
 by: Rockinghorse Winner - Tue, 2 Apr 2024 04:20 UTC

On 2024-03-31, Physfitfreak <physfitfreak@gmail.com> opined as follows:
> On 3/31/24 08:01, Farley Flud wrote:
>> Run this command to check if liblzma is linked to ssh:
>>
>> ldd "$(command -v sshd)"
>>
>> For example, on Gentoo (the best distro) I get:
>>
>> linux-vdso.so.1 (0x00007ffff7fcb000)
>> libcrypt.so.2 => /usr/lib64/libcrypt.so.2 (0x00007ffff7f6e000)
>> libcrypto.so.3 => /usr/lib64/libcrypto.so.3 (0x00007ffff7a00000)
>> libz.so.1 => /usr/lib64/libz.so.1 (0x00007ffff7f54000)
>> libc.so.6 => /lib64/libc.so.6 (0x00007ffff783c000)
>> /lib64/ld-linux-x86-64.so.2 (0x00007ffff7fcc000)
>>
>> Nope. There ain't no linking to liblzma, thus Gentoo is NOT affected
>> regardless of what version of xz-utils is installed.
>>
>> Systemd is ultimately responsible and more and more hackers will be
>> looking for more and better ways of exploiting that 3 million loc
>> pile of junk.
>>
>> Don't say we didn't tell you so.
>>
>> To save your systems, downgrade xz-utils AND eliminate systemd.
>>
>>
>
>
> I get:
>
> ldd: ./: not regular file
>
>

You don't have a sshd server installed most likely.

--
'Many have sought in vain to tell joyously of the Most Joyous. Now at last It declares
Itself to me, now in this misery.' - Holderlin
____
/. \
___________< |___________
\___________ ___________/
\___________ ___________/
\___________ ___________/
| |
^^^ ^^^
_________
| R W |
| (*) |
|____U____|

computers / comp.os.linux.advocacy / Check If Your Distro Is Vulnerable To XZ Backdoor

Pages:12
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor