The Cybersecurity and Infrastructure Security Agency jumped into action after Freund’s discovery, publishing an alert about the XZ backdoor on March 29, the same day Freund publicly posted about it. intelligence agencies have recently expressed interest in addressing software supply chain attacks. Their entire online presence is related to these brief interactions on the mailing list dedicated to XZ their only recorded interest is in quickly ushering along updates to the software. The users involved in the complaints seemed to materialize from nowhere - posting their messages from what appear to be recently created Proton Mail accounts, then disappearing. Conceding that he could no longer devote enough attention to the project, Collin made Tan a co-maintainer. He should, some of these users said, hand over control of the project some explicitly called for the addition of another maintainer. A group of users, relatively new to the project, had protested that Collin was falling behind and not making updates to the software quickly enough. On one email list, Collin faced a raft of complaints. Tan’s elevation to being a co-maintainer mostly played out on an email group where code developers - in the open-source, collaborative spirit of the Linux family of operating systems - exchange ideas and strategize to build applications. “However, there isn’t any indication yet whether this was state sponsored, a hacking group, a rogue developer, or any combination of the above.”

“The care taken to hide the exploits in binary test files as well as the sheer time taken to gain a reputation in the open-source project to later exploit it are abnormally sophisticated,” said Molly, a system administrator at Electronic Frontier Foundation who goes by a mononym. All these moves were underlaid by a technical proficiency that ushered the creation and embedding of the actual backdoor code - a code sophisticated enough that analysis of its precise functionality and capability is still ongoing.

Then, after cultivating Collin’s trust over a period of years, Tan injected a backdoor into the utility. The development of this widely used technical utility was understaffed, with a single, core maintainer, Collin, who later conceded he was unable to maintain XZ, providing the opportunity for another developer to step in. First, whoever led the attack identified a piece of software that would be embedded in a vast array of Linux operating systems. The XZ backdoor betrays a sophisticated, meticulous operation. (Neither Tan nor Collin responded to requests for comment.) Eventually, though the exact timeline is unclear, Tan ascended to being co-maintainer of the project, alongside the founder, Lasse Collin, allowing Tan to add code without needing the contributions to be approved. Tan had been a contributor to the XZ project since at least late 2021 and built trust with the community of developers working on it.

The malicious code in XZ Utils was introduced by a user calling themself Jia Tan, employing the handle JiaT75, according to Ars Technica and Wired. The XZ backdoor was introduced by way of what is known as a software supply chain attack, which the National Counterintelligence and Security Center defines as “deliberate acts directed against the supply chains of software products themselves.” The attacks often employ complex ways of changing the source code of the programs, such as gaining unauthorized access to a developer’s system or through a malicious insider with legitimate access. Any machine running an operating system that included the backdoored utility and met the specifications laid out in the malicious code would have been vulnerable to compromise, allowing an attacker to potentially take control of the system. Freund dove in to troubleshoot and “ got suspicious.”Įventually, Freund found the source of the problem, which he subsequently posted to a security mailing list: He had discovered a backdoor in XZ Utils, a data compression utility used by a wide array of various Linux-based computer applications - a constellation of open-source software that, while often not consumer-facing, undergirds key computing and internet functions like secure communications between machines.īy inadvertently spotting the backdoor, which was buried deep in the code in binary test files, Freund averted a large-scale security catastrophe. On March 29, Microsoft software developer Andres Freund was trying to optimize the performance of his computer when he noticed that one program was using an unexpected amount of processing power.

Battlefield 5 reticle hack