What we know about the xz Utils backdoor that almost infected the world | Ars Technica

The open source security world was rocked this week with the discovery of what appears to be a multi-year effort to introduce a backdoor into a critical service of Linux based machines. This seems to be one of the most coordinated and longest running attacks ever with activity from the suspected individual, Jia Tan, starting in 2021.

Malicious code added to xz Utils versions 5.6.0 and 5.6.1 modified the way the software functions. The backdoor manipulated sshd, the executable file used to make remote SSH connections. Anyone in possession of a predetermined encryption key could stash any code of their choice in an SSH login certificate, upload it, and execute it on the backdoored device. No one has actually seen code uploaded, so it's not known what code the attacker planned to run. In theory, the code could allow for just about anything, including stealing encryption keys or installing malware.

When I saw the time and scale of this attack I immediately thought how incredibly patient and expensive this is. Many attacks like this are done to make money, and investing three years into something is a pretty poor way to make money. It seems possible this wasn't about money at all, and perhaps was supported by other kinds of organizations.

While it was three years in the making it took about three days for the open-source community to get it out. However, the sophistication of this attack leaves a question in everyones mind — are there others like this?

More information on the XZ library attack.

• The email from Andres Freund sharing the discovery. → oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise
• Great breakdown of the obfuscation used in the bash components of this attack. This was a great read to see how payloads were hidden. → xz/liblzma: Bash-stage Obfuscation Explained
• A timeline of this attack which is notable for the incredible duration. → Timeline of the xz open source attack
• Illustration to help show the various components of this attack, including the stages and overall timeline. → Graphic illustration of XZ Outbreak — Thomas Roccia