Adventures in analyzing a backdoor in xz/liblzma
summary
A forensic analysis of a supply-chain backdoor inserted into the liblzma (XZ Utils) library. It covers the malicious code, concealment techniques used to hide the backdoor, and the reverse-engineering process that revealed how the manipulation worked in this widely used open-source compression library.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:57XZ backdoor reason
- 7:07XZ attack timeline
- 12:26Backdoor in liblzma
- 17:47SSH backdoor exploit
- 22:50Backdoor reverse engineering
- 28:12Implementation details
- 33:17Attack scope and impact
- 34:25Backdoor exploit demo
- 36:58Community response and lessons
- 38:03Summary
related talks
47mXZ made EZ
27mxz/liblzma backdoor Bash obfuscation explained
40mAnalysis of and Lessons from the Xz-Utils Vulnerability – What Mig...
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...
42mXZ Backdoor: Navigating The Complexities Of Supply Chain Attacks Detected By Accident
05mThe XZ Backdoor and a 40 Year Old Prediction
44mAnatomy of a Vulnerability
06mThe next xz attack