XZ made EZ
summary
A supply‑chain backdoor corrupts the xz compression tool used by virtually every POSIX system, installed via a malicious update to liblzma that quietly disables OSS‑Fuzz checks, hides object code inside large test binaries, and ships a build macro (buil_host.m4) only in released packages. The long con runs over ~2 years through a newcomer maintainer account, and the implant enables arbitrary root SSH access if the private key is present. Discovery happens when odd SSH timing and a fuzzing anomaly trigger inspection. CVE-2024-3094 and liblzma backdoor are the concrete claims.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker intro
- 7:30What is a back door
- 13:52XZ utility basics
- 22:04Compression algorithms explained
- 24:55XZ maintainer burnout
- 33:45The XZ backdoor infiltration
- 41:14Potential impact and suspects
- 42:40Open source security lessons
- 43:29Q&A session
related talks
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...
40mAnalysis of and Lessons from the Xz-Utils Vulnerability – What Mig...
06mThe next xz attack
41mAdventures in analyzing a backdoor in xz/liblzma
42mXZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident
44mAnatomy of a Vulnerability
27mxz/liblzma backdoor Bash obfuscation explained
05mThe XZ Backdoor and a 40 Year Old Prediction