LUP 556: The xz Backdoor Exposed 🚨¶
- Air Date: 2024-03-31
- Duration: 70 mins 3 secs
About this episode¶
We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.
Your hosts¶
Sponsored by¶
- Tailscale: Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!
- Kolide: Kolide is a device trust solution for companies with Okta, and they ensure that if a device isn't trusted and secure, it can't log into your cloud apps.
Episode links¶
- 💥 Gets Sats Quick and Easy with Strike
- 📻 LINUX Unplugged on Fountain.FM
- oss-security mailing list — Backdoor in upstream xz/liblzma leading to ssh server compromise.
- Fedora Announcement
- Debian Announcement
- Ubuntu Announcement
- Kali Linux Announcement
- Arch Linux Announcement
- Gentoo Announcement
- openSUSE Tumbleweeed Announcement
- NixOS Unstable Discussion
- Why does it take two weeks for NixOS to replace xz?
- Andres Freund on Mastodon — I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc....
- rwmj on Hacker News — Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of its "great new features"
- A Microcosm of the interactions in Open Source projects — Make no mistake. This is the way it works. It needs to change.
- Devuan GNU/Linux on X — Devuan is not affected by the latest vulnerability caused by systemd.
- systemd PR: Dynamically load compression libraries
- Matteo Croce on X — I'm the author of such PR. While I absolutely didn't know that libxz had a backdoor, I really think that libraries should be loaded on-demand when rarely used, hence my change :)
- Ryan C. Gordon on X — This is probably how the xz thing happened, right?
- Jan Wildeboer on the Fediverse — Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO.
- Unplugged Core Membership
- TXLF is coming up! — April 12 - 13 in Austin, Texas.
- LFNW coming up! — April 26 - 28
- Mobile Game Ads Are Boosting Podcast Follower Counts — Wondery, iHeart and Lemonada Media are all using a non-public product from MowPod - which gives extra lives and game credits to gamers if they follow shows on Apple Podcasts from game apps.
- MowPod's podcast promotion tools: tales from the bar
- fortydeux's NixOS Configs
- Prism Launcher — An Open Source Minecraft launcher with the ability to manage multiple instances, accounts and mods.
- World Backup Day — March 31st — One small accident or failure could destroy all the important stuff you care about.
- Updating Our Fiddly Bits | LINUX Unplugged 494
Tags¶
alpine, arch linux, backdoor, burnout, compression libraries, debian, fedora, gentoo, humint, jia tan, jupiter broadcasting, kali linux, linux podcast, linux unplugged, nixos, open source, openssh, opensuse, remote code execution, systemd, transparency, trust model, ubuntu, xz