xz Utils backdoor (2024)
A backdoor discovered in March 2024 in a compression library ubiquitous on Linux, inserted by a contributor who had earned the project's trust over more than two years; it was caught just before mass distribution.
xz Utils is a compression library built into most Linux distributions, maintained, like much free software, by a lone volunteer. From 2021, a contributor under the pseudonym Jia Tan offered useful improvements, while other accounts, probably coordinated, pressed the exhausted maintainer to share the load. Jia Tan gradually obtained release rights. In early 2024, he inserted into versions 5.6.0 and 5.6.1 code hidden in test files which, once compiled, allowed remote command execution on servers using the SSH secure access service, provided one held a specific private key. On 29 March 2024, an engineer noticed that an SSH login took half a second too long, investigated, and found the backdoor; the vulnerability received the maximum severity score. The trojanized versions had not yet reached the most widespread stable distributions. The operation, by its patience and sophistication, is attributed by many analysts to a state actor, with no official attribution. For insurance, it is the catastrophe scenario of the software supply chain: a free component, present everywhere, dependent on one person, compromised without its millions of users being able to detect it.
Textbook case: a cyber insurer builds an accumulation scenario based on the xz backdoor, discovered on 29 March 2024: a backdoor in a free component present on 60 percent of the servers in its portfolio, activated six months after distribution. The result exceeds its scenario of a major cloud host outage, because the compromise also reaches backups.
xz Utils, CVE-2024-3094, xz backdoor, Jia Tan
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.