News
Supply chain attack · Global · March 2024
XZ Utils Backdoor (CVE-2024-3094)
A deliberately planted backdoor in the XZ compression library was discovered before it reached most stable Linux releases.
Incident
What happened
Malicious code was introduced into XZ Utils release tarballs versions 5.6.0 and 5.6.1 after a prolonged effort to gain maintainer trust.
The backdoor targeted SSH authentication on certain Linux distributions.
An engineer noticed unusual performance behaviour, leading to discovery and rapid rollback.
Analysis
Lessons learned
Supply chains for open source software depend on a small number of maintainers.
Release artefacts should be verified against source repositories.
Anomaly detection and curiosity remain powerful defences.
Prevention
How penetration testing helps
Cloud and infrastructure assessments review build pipelines, package sources, and hardening of exposed services such as SSH.
Sources
Summary based on publicly available information. DIGITPOL HK was not involved in this incident.