The Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...
summary
An XZ Utils backdoor lets attackers run commands on SSH servers without prior auth by trojanizing liblzma and abusing build hosts; attackers gain commit rights via sustained social engineering, add an iFunc dynamic resolver and hide shell payloads in test blobs, extract them with a build-to-host.m4 trick, and cause altered builds that reach Debian/Fedora packages. The campaign spans years, hits ~30,000 reverse dependents, and succeeds because reproducible, declarative builds and CI fuzzing were disabled or bypassed.
AI-written summary · about
chapters (13)
- 0:00Intro
- 5:25Stage 1 Building Trust
- 13:46Stage 2 Preparation
- 18:55Injecting Stage
- 20:54Detected Command
- 22:09Set Command
- 24:07TR Command
- 29:26Deployment
- 31:45Exploit
- 36:15Signals
- 40:53Mitigation
- 46:57Questions
- 54:14Summary
related talks
42mXZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident
47mXZ made EZ
06mThe next xz attack
40mAnalysis of and Lessons from the Xz-Utils Vulnerability – What Mig...
05mThe XZ Backdoor and a 40 Year Old Prediction
44mAnatomy of a Vulnerability
41mAdventures in analyzing a backdoor in xz/liblzma
41mHow to protect your software project from supply chain security threats