Yuki the Maven is a user on cybre.space. You can follow them or interact with them if you have an account anywhere in the fediverse.
Yuki the Maven @yuki_the_maven

is there *any* good reason for a .so to have a different md5sum on different boxes, under the assumption that it's been installed from the same rpm/repo?

I suspect malware, but am I missing something else obvious before jumping to conclusions?
(pic: kizumonogatari)

· Web · 1 · 0

@yuki_the_maven different versions.

0 length files due to weirdnesses

bad package.

@pnathan @k sorry by same rpm I meant same versions too. I don't think 0len as there is some other software using that .so and working correctly *for some time*

@yuki_the_maven @k

how strange. can you do an objdump on the different .so ?

@pnathan won't be able until next monday but that's totally in my list of next steps

@pnathan like @RAOF pointed out it seems to be prelinking. could not confirm in production as we had a connectivity outage (happy monday!) but it's enabled in every other environment so I'll just go with it

@yuki_the_maven @RAOF Prelinking?

how would that change a file size? now I'm curious...

@yuki_the_maven if you're positive they're the same version, then I can't think of any reason

@yuki_the_maven The only thing that comes to mind is prelinking? That modifies the binaries in-place, so hash-based verification can fail.

en.wikipedia.org/wiki/Prelink

@yuki_the_maven *Particularly* if you're using randomised prelink, which is almost certainly the default (if you've got it enabled) as it makes return-to-libc attacks harder.

@RAOF ooooooohhh I see! thanks for the pointer I had no idea this was a thing