I added the mask option after cscs pointed me into this direction.
Nachlese pointed me, that its not needed at all.
Hell its not possible to give everyone what they wants 
Now i understand why there is no perfect Monitor that exists 
https://wiki.archlinux.org/title/Systemctl
mask makes it impossible that a process can reenable a service under any circumstances and that’s in general. if you wonder that a service is reenabled after an update that you had disabled before, that’s the reason.
Hello Community,
I learned about the mentioned backdoor last night and got a little scared, although I realize from this thread that my Manjaro OS was most likely not compromised.
Nevertheless, I wanted to make sure what version of xz is currently installed. But when I use bash
xz --version
I get
5.6.1
and no information whether it is 5.6.1-1 oder 5.6.1-2. What am I doing wrong?
Apart from that: As chance wills it I did not only open some private medical file on the PC in question yesterday but also forgot to shut it down over night. So because of that I am a little bit concerned from learning about the exploit. I browsed through the Manjaro related content and the way I understand it, chances of having a compromised system even if the backdoored xz version was installed, are very very low. Did I get that right?
It would seem so.
Absolutely nothing. As I have it, the -1 suffix is the build number and internal to Manjaro only. So you seem to have version 5.6.1 installed. To see which build number is installed, run:
pamac search --installed xz
Why? Do you have something you know is affected? I mean, I’m not even worried with my Ubuntu server here, and the from what I understand the backdoor targets Debian and Fedora and their derivatives.
The compression utility, known as xz Utils, introduced the malicious code in versions 5.6.0 and 5.6.1,
I’m surprised you haven’t seen, or don’t know about this:
Thanks, no I had not seen it.
Wait until they find the side entrance, the 5h1t will really hit the fan then
You can also see the versions, if you use the pamac (package manager) GUI, click on browse and just type the name in it.
I run the script (against the updated 5.6.1 in the system), did not find the hex.
Then i run against a timeshifted 5.6.0 or a downloaded from an unsynced mirror…and it did not find the hex. Hmmm?!?
hexdump -ve '1/1 "%.2x"' /home/teo/Downloads/xz-5.6.0-1-x86_64.pkg/usr/lib/liblzma.so.5.6.0 | grep -q 'f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410'
If you don’t have any open ports for incoming ssh connections to your router (i.e. ssh is only accessible from within your network) and preferably also change the port(s) you use for ssh, there should be nothing to worry about, as far as I can see.
It is actually quite simple:
- Update now (replacing the compromised library)
The professionals do the rest. It’s not really worth discussing.
Just to clarify: Ssh was not compromised, and ssh does not load the compromised library itself (systemd does that 
). But as soon as it is loaded, sshd itself becomes a backdoor. (but only if it is already active anyway)
Ssh itself doesn’t seem to be affected, and is in no way to blame for the problem.
Indeed … and the whole process took less than three seconds on this system!
A simple sudo pacman -Syu … job done. 
At least for Arch/Manjaro, there was not even the possibility …
But I acknowledge everybody’s right to be in panic mode.
It was a great success during the pandemic … 
That is what i ask.: it seems we were never ever affected? The hex signature of the virus was not even in the 5.6.0?
there is no virus
indeed
“we” where not
OK, this is not a virus, it is Malicious code, for the people from the Fakt/Grammar Police
Start from the beginning, from the top.
What is being done?
… I actually like Monty Python very much
don’t abuse it
I’ll watch your linked clip right now.
… ahh. Brian …
after having watched the scene:
I may have misunderstood you
Sorry for even having responded …
Thank you for the advice!
After entering
pamac search --installed xz
I get
lib32-xz 5.6.1-2 multilib
Library and command line tools for XZ and LZMA compressed files (32-bit)
xz 5.6.1-2 core
Library and command line tools for XZ and LZMA compressed files
which is what I wished for, I guess. Is there any way to find out whether the unpatched version 5.6.1-1 has ever been installed in the first place?
Thanks. It worked.
grep xz /var/log/pacman.log ✔
[2024-01-29T09:37:51+0100] [ALPM] installed lib32-xz (5.4.5-1)
[2024-02-23T16:28:20+0100] [ALPM] upgraded xz (5.4.5-1 -> 5.4.6-1)
[2024-02-23T16:28:29+0100] [ALPM] upgraded lib32-xz (5.4.5-1 -> 5.4.6-1)
[2024-03-18T16:17:29+0100] [ALPM] upgraded xz (5.4.6-1 -> 5.6.0-1)
[2024-03-18T16:17:33+0100] [ALPM] upgraded lib32-xz (5.4.6-1 -> 5.6.0-1)
[2024-03-30T08:22:19+0100] [ALPM] upgraded xz (5.6.0-1 -> 5.6.1-2)
[2024-03-30T08:22:19+0100] [ALPM] upgraded lib32-xz (5.6.0-1 -> 5.6.1-2)
What do I make of that? From what I can tell I would say the malicious code had been installed for 12 days. Is that correct?
Try:
grep xz /var/log/pacman.log