Lesson 3.2: The xz-utils backdoor: a compromised maintainer
In March 2024 a Microsoft engineer, Andres Freund, noticed SSH logins on a Debian test machine were half a second slower than they should be. The cause was a backdoor in xz-utils 5.6.0 and 5.6.1 (CVE-2024-3094), inserted by a contributor who had spent about two years gaining the trust of the project's overworked maintainer. Hidden in the release tarballs rather than the visible source, it hooked into sshd through liblzma on distributions that link sshd to systemd. It was caught before reaching stable releases. In the lab you search Northwind's package inventories without being fooled by version strings, check whether sshd loads the library, and scan container SBOMs.
18 min
You will learn to
- Explain how the xz backdoor was inserted and found
- Search package inventories precisely
- Recognise distribution revert versions
- Check whether a service loads an affected library
- Use SBOMs to find affected images
Key terms
- Supply-chain attack
- Compromising software or services that others trust and install.
- Maintainer
- The person who reviews changes and publishes releases of an open-source project.
- Release tarball
- The archive a project publishes for each release, built from but not identical to the repository.
- SBOM
- Software Bill of Materials: a list of every component and version in a piece of software.
- Revert version
- A distribution package that ships older, clean code under a new version number.
← Watching Certificate Transparency logs · All lessons · The attack surface: every door into a system →