Too Late to Check xz

"don't run xz --version to check if you're compromised" haha, too late If you have infected version of liblzma in your system, it's already loaded into EVERY process that depends on libsystemd. systemd's dependency on liblzma *was literally* the attack vector. ldd /usr/lib/x86_64-linux-gnu/libsystemd.so linux-vdso.so.1 libcap.so.2 => /lib/x86_64-linux-gnu/libcap.so.2 libgcrypt.so.20 => /lib/x86_64-linux-gnu/libgcrypt.so.20 liblz4.so.1 => /lib/x86_64-linux-gnu/liblz4.so.1 liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 libzstd.so.1 => /lib/x86_64-linux-gnu/libzstd.so.1 libseccomp.so.2 => /lib/x86_64-linux-gnu/libseccomp.so.2 /lib64/ld-linux-x86-64.so.2

The meme shows a dark-mode social media post warning that running `xz --version` is not a safe way to check whether a system is compromised. It jokes that if the malicious liblzma version is already installed, it has already been loaded into processes depending on libsystemd, making the check too late; the terminal output reinforces the systemd and liblzma connection. EN: The meme shows a dark-mode social media post warning that running `xz --version` is not a safe way to check whether a system is compromised. It jokes that if the malicious liblzma version is already installed, it has already been loaded into processes depending on libsystemd, making the check too late; the terminal output reinforces the systemd and liblzma connection.

• @gentoomemes / 10269 2024-03-31