https://lpbyte.pages.dev/deep-dives/index.html Hugo en-us Mon, 06 Jul 2026 03:08:31 +0200 https://lpbyte.pages.dev/deep-dives/xz-backdoor/index.html Mon, 06 Jul 2026 03:08:31 +0200 https://lpbyte.pages.dev/deep-dives/xz-backdoor/index.html Introduction In February 2024, a backdoor was deliberately introduced into XZ Utils, a compression library present on nearly every Linux system in existence. Over a period of more than two years, an individual operating under the pseudonym “Jia Tan” cultivated the appearance of a diligent, trustworthy open-source contributor, eventually gaining maintainer privileges within the project — a position they then leveraged to embed malicious code directly into official release artifacts. The backdoor specifically targeted liblzma, a transitive dependency of OpenSSH on Debian- and Fedora-based systems, and would have granted an attacker in possession of a specific private key the ability to achieve unauthenticated remote code execution over SSH across potentially millions of servers worldwide. It stands as one of the most sophisticated supply-chain attacks ever documented in open-source software. Its discovery came down to a stroke of luck rather than a targeted audit: on March 29, 2024, software engineer Andres Freund noticed an anomalous, barely perceptible delay in SSH login times while benchmarking PostgreSQL performance. That anomaly led him directly to the compromised library — mere weeks before the affected versions would likely have propagated into stable distributions such as Debian Stable or Ubuntu LTS.