xz/liblzma backdoor Bash obfuscation explained
summary
Analysis dissects the Bash-only obfuscation chain that converts two test files (a 35 KB good large compressed lzma and a tiny bad corrupted sample) into a runnable payload: M4 stage zero runs a tr-based substitution to “uncorrupt” data, a custom function strips 1 KB gaps, tail+tr produce a 256-byte substitution cipher stream, awk implements RC4 via awk with a hardcoded key (skipping ~8 KB), xz -d yields a non-relocatable object file payload that is spliced into the liblzma build and executes.
AI-written summary · about
chapters (6)
- 0:00Introduction to XZ backdoor
- 2:59Initial stages of injection
- 4:46Analyzing stage zero
- 10:51Decoding the bash script
- 19:12Extraction techniques
- 21:54RC4 decryption and conclusion
related talks
41mAdventures in analyzing a backdoor in xz/liblzma
47mXZ made EZ
40mAnalysis of and Lessons from the Xz-Utils Vulnerability – What Mig...
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...
28mI Came to Drop Bombs: Auditing the Compression Algorithm Weapon Cache
42mXZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident
06mThe next xz attack
05mThe XZ Backdoor and a 40 Year Old Prediction