Cyb3rius
@cyb3rius
· Aug 23
What was the XZ Utils backdoor and who planted it?The XZ Utils backdoor was a supply-chain attack discovered in March 2024, where malicious code secretly planted in a Linux compression library was designed to hijack SSH server authentication.What happened: On March 29, 2024, PostgreSQL developer Andres Freund spotted a 500-millisecond CPU anomaly in sshd, exposing CVE-2024-3094 in liblzma versions 5.6.0 and 5.6.1. The attacker, a persona named "Jia Tan," spent nearly two years building trust as a maintainer before injecting code to intercept and decrypt SSH sessions for remote attackers. The backdoor was caught before major stable releases, but it reached rolling-release distributions like Debian sid, Arch, and Kali.Key numbers: CVE-2024-3094 holds a critical CVSS severity score of 10.0.Malicious code was embedded in two compromised releases: 5.6.0 and 5
0