The XZ Utils Backdoor: The Supply-Chain Attack Caught by 500 Milliseconds

In March 2024 a deliberately planted backdoor was discovered in XZ Utils (the xz/liblzma compression library ubiquitous on Linux). A long-tenure maintainer persona, “Jia Tan,” who had spent more than two years building trust and gaining release authority, inserted obfuscated malicious code hidden in test-fixture binaries and triggered through the source-tarball build process — code not visible in the Git tree. On affected systems where sshd links liblzma, the backdoor hooked RSA key verification to allow an attacker holding a specific private key to achieve pre-authentication remote code execution.

The Near-Miss

CVE-2024-3094 (CVSS 10.0) covers the malicious backdoor in liblzma 5.6.0 and 5.6.1. Microsoft engineer Andres Freund noticed roughly 500-millisecond sshd slowdowns and odd CPU use while benchmarking, investigated, and disclosed it on 29 March 2024 — before the backdoored versions reached most stable distributions. Because there was no known in-the-wild exploitation, it is understood not to be CISA KEV-listed (a near-miss, not an incident). T1195.002 T1554 T1205

Timeline

• 2021–2022: the “Jia Tan” account begins contributing; a sock-puppet pressure campaign pushes the original maintainer to cede control, and Jia Tan gains commit and release rights.
• February–March 2024: backdoored releases 5.6.0 and 5.6.1 ship in source tarballs.
• 27–29 March 2024: Freund investigates the sshd anomaly and discloses publicly; distributions roll back and GitHub temporarily archives the repository. Most stable releases were unaffected.

Attribution

No confirmed named individual or state. “Jia Tan” is a persona; reporting widely assesses the multi-year patience, sophistication and operational discipline as consistent with a well-resourced, possibly state-sponsored actor — but this is an assessment, not confirmed attribution. There was no extortion model: the objective was covert, persistent backdoor access to a vast base of SSH-exposed Linux systems.

Defensive Lessons

• Pin and verify dependencies and, where feasible, build reproducibly from Git source rather than released tarballs — the malicious code lived only in the tarball, not the repository.
• Inventory affected versions fast via SBOM (liblzma/xz 5.6.0–5.6.1) across hosts and containers, and roll back to known-good.
• Scrutinise maintainer trust and build pipelines: unexpected binary test fixtures, opaque build-step modifications and sudden maintainer handovers are red flags.
• Reduce attack surface (do not link nonessential libraries into sshd), invest in provenance/signing (SLSA-style attestation), and keep behavioural/performance baselines — the backdoor was caught by a latency anomaly, not a signature.