Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://social.sdf.org/users/claudiom/statuses/112188354576658490">ClaudioM (claudiom@social.sdf.org)'s status on Monday, 01-Apr-2024 00:35:57 JST</a><a href="https://social.sdf.org/@claudiom" title="claudiom@social.sdf.org"><img src="https://gnusocial.jp/avatar/237884-48-20240125013517.webp" width="48" height="48" alt="ClaudioM" style="position: absolute; left: 0; top: 0;">ClaudioM</a></section><article><p>With all this talk of the <a href="https://social.sdf.org/tags/liblzma" rel="tag">#liblzma</a> <a href="https://social.sdf.org/tags/backdoor" rel="tag">#backdoor</a>, I thought I should check the version of <a href="https://social.sdf.org/tags/xz" rel="tag">#xz</a>-utils in <a href="https://social.sdf.org/tags/Termux" rel="tag">#Termux</a>. To my surprise, version 5.6.1 was installed. Just ran "pkg upgrade" and there was an update which actually rolls back to version 5.4.5. Beware, Termux users... 👁️⚠️☣️ <a href="https://social.sdf.org/tags/ssh" rel="tag">#ssh</a> <a href="https://social.sdf.org/tags/malware" rel="tag">#malware</a> <a href="https://social.sdf.org/tags/security" rel="tag">#security</a> <a href="https://social.sdf.org/tags/XZutils" rel="tag">#XZutils</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2885734#notice-5733920">In conversation</a><time datetime="2024-04-01T00:35:57+09:00" title="Monday, 01-Apr-2024 00:35:57 JST">about 7 months ago</time> <span>from <span><a href="https://social.sdf.org/@claudiom/112188354576658490" rel="external" title="Sent from social.sdf.org via ActivityPub">social.sdf.org</a></span></span><a href="https://social.sdf.org/@claudiom/112188354576658490">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/2443130">Termux on Android showing the compromised version of xz-utils, 5.6.1, installed on my phone.</a></label><br><a href="https://social.sdf.org/system/media_attachments/files/112/188/336/030/884/661/original/044e1d83b9d6ca71.jpg" rel="external">https://social.sdf.org/system/media_attachments/files/112/188/336/030/884/661/original/044e1d83b9d6ca71.jpg</a></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/2443131">Termux on Android showing "pkg upgrade" upgrading liblzma and xz-utils to "5.6.1+really5.4.5" ("5.6.1 plus really 5.4.5).</a></label><br><a href="https://social.sdf.org/system/media_attachments/files/112/188/336/334/949/088/original/e7e197f97f42acb6.jpg" rel="external">https://social.sdf.org/system/media_attachments/files/112/188/336/334/949/088/original/e7e197f97f42acb6.jpg</a></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
ClaudioM (claudiom@social.sdf.org)'s status on Monday, 01-Apr-2024 00:35:57 JST ClaudioM
With all this talk of the #liblzma #backdoor, I thought I should check the version of #xz-utils in #Termux. To my surprise, version 5.6.1 was installed. Just ran "pkg upgrade" and there was an update which actually rolls back to version 5.4.5. Beware, Termux users... 👁️⚠️☣️ #ssh #malware #security #XZutils
In conversationabout 7 months ago from social.sdf.orgpermalink
Attachments
1. Termux on Android showing the compromised version of xz-utils, 5.6.1, installed on my phone.
  https://social.sdf.org/system/media_attachments/files/112/188/336/030/884/661/original/044e1d83b9d6ca71.jpg
2. Termux on Android showing "pkg upgrade" upgrading liblzma and xz-utils to "5.6.1+really5.4.5" ("5.6.1 plus really 5.4.5).
  https://social.sdf.org/system/media_attachments/files/112/188/336/334/949/088/original/e7e197f97f42acb6.jpg

Public

Embed Notice

HTML Code

Corresponding Notice