# What we know about the xz Utils backdoor that almost infected the world | Ars Technica

<https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/>

- Host: [arstechnica.com](https://links.thingelstad.xyz/hosts/arstechnica.com/)
- Saved: April 2, 2024 (2024-04-03T02:19:14Z)
- Record: https://links.thingelstad.xyz/links/a1c5658f8e37/
- JSON: https://links.thingelstad.xyz/links/a1c5658f8e37.json

## What Jamie wrote

The open source security world was rocked this week with the discovery of what appears to be a multi-year effort to introduce a backdoor into a critical service of Linux based machines. This seems to be one of the most coordinated and longest running attacks ever with activity from the suspected individual, Jia Tan, starting in 2021.

> Malicious code added to xz Utils versions 5.6.0 and 5.6.1 modified the way the software functions. The backdoor manipulated sshd, the executable file used to make remote SSH connections. Anyone in possession of a predetermined encryption key could stash any code of their choice in an SSH login certificate, upload it, and execute it on the backdoored device. No one has actually seen code uploaded, so it's not known what code the attacker planned to run. In theory, the code could allow for just about anything, including stealing encryption keys or installing malware.

When I saw the time and scale of this attack I immediately thought how incredibly patient and expensive this is. Many attacks like this are done to make money, and investing three years into something is a pretty poor way to make money. It seems possible this wasn't about money at all, and perhaps was supported by other kinds of organizations. 

While it was three years in the making it took about three days for the open-source community to get it out. However, the sophistication of this attack leaves a question in everyones mind — are there others like this?

More information on the XZ library attack.

- The email from Andres Freund sharing the discovery. → [oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise](https://www.openwall.com/lists/oss-security/2024/03/29/4)
- Great breakdown of the obfuscation used in the bash components of this attack. This was a great read to see how payloads were hidden. → [xz/liblzma: Bash-stage Obfuscation Explained](https://gynvael.coldwind.pl/?lang=en&id=782)
- A timeline of this attack which is notable for the incredible duration. → [Timeline of the xz open source attack](https://research.swtch.com/xz-timeline)
- Illustration to help show the various components of this attack, including the stages and overall timeline. → [Graphic illustration of XZ Outbreak — Thomas Roccia](https://infosec.exchange/@fr0gger/112189232773640259)

## Facts

- Kind: [Page](https://links.thingelstad.xyz/kinds/page/)

## Appears in

- [WT282: Weekly Thing 282 / Decentralized, Blobs, Rewards](https://weekly.thingelstad.com/archive/282/), Notable

## Same host

- [Inventor of NTP protocol that keeps time on billions of devices dies at age 85 | Ars Technica](https://links.thingelstad.xyz/links/e1160973da55/) (arstechnica.com, January 21, 2024)
- [What’s happening at Tesla? Here’s what experts think. | Ars Technica](https://links.thingelstad.xyz/links/1944cb55bbfb/) (arstechnica.com, May 6, 2024)
- [Hackers discover how to reprogram NES Tetris from within the game | Ars Technica](https://links.thingelstad.xyz/links/47f5d4cbce28/) (arstechnica.com, May 13, 2024)
- [“Unprecedented” Google Cloud event wipes out customer account and its backups | Ars Technica](https://links.thingelstad.xyz/links/c7aa3d4099b0/) (arstechnica.com, May 21, 2024)
- [A root-server at the Internet’s core lost touch with its peers. We still don’t know why. | Ars Technica](https://links.thingelstad.xyz/links/2aae4dde3f31/) (arstechnica.com, May 30, 2024)

## Saved the same week

- [The Best Essay](https://links.thingelstad.xyz/links/e01384278352/) (paulgraham.com, April 2, 2024)
- [The film fans who refuse to surrender to streaming: ‘One day you’ll barter bread for our DVDs’ | The Guardian](https://links.thingelstad.xyz/links/06ea17952ae2/) (theguardian.com, April 2, 2024)
- [Happy birthday APFS, 7 years old today – The Eclectic Light Company](https://links.thingelstad.xyz/links/b32e99c65887/) (eclecticlight.co, April 2, 2024)
- [xkcd: Eclipse Coolness](https://links.thingelstad.xyz/links/638f5c7b1df7/) (xkcd.com, April 2, 2024)
- [How the team behind Zelda made physics feel like magic - The Verge](https://links.thingelstad.xyz/links/615ed0323427/) (theverge.com, April 2, 2024)

## Elsewhere

- Wayback Machine: https://web.archive.org/web/*/https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/