A timeline of the attack on open-source project XZ Utils, which began in late 2021 and led to a backdoor with RCE in Linux distros Debian, Red Hat, and others
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library …
research!rsc Russ Cox
Context & Ripple Effects
The XZ Utils incident moved from discovery of malicious code in distributed versions to scrutiny of the long trust-building process behind it. The related coverage also highlights that an accidental discovery by Andres Freund likely interrupted a much wider deployment.
The story matters because it ties an RCE-capable compromise affecting Debian, Red Hat, and other Linux distributions to a contributor persona active since late 2021, rather than to a one-off coding error. Open-source security groups subsequently warned that the attempt may not be isolated.
First-order effects
- Linux distributors and downstream users of affected XZ Utils versions face immediate code-audit, package-removal, and incident-response work because the implanted backdoor enabled RCE.
- Project maintainers must reassess commits and release activity associated with the Jia Tan persona, whose sustained contributions helped establish the trust used to introduce malicious code.
Second-order effects
- Distribution maintainers and organizations consuming Linux packages will place greater weight on provenance checks and review of changes in low-level dependencies, not just on whether a package is widely used.
- The case raises the value of independent anomaly detection: researchers’ identification of malicious XZ code and the earlier accidental discovery show that conventional maintainer trust alone did not surface the compromise.
Third-order effects
- If similar campaigns emerge, open-source ecosystems may treat long-term contributor identity and maintainer succession as supply-chain security controls, alongside code review and release signing.
- The likely structural shift is toward more shared security support for under-resourced, foundational projects; the warning from open-source security groups suggests the risk extends beyond this single library.
The trend: The XZ Utils case is part of a broader shift from attacks on finished software to patient attempts to capture trust inside critical open-source supply chains.
Related: Dual-use code intelligence · XZ Utils · RCE · Researchers find malicious code in versions of the compression tool XZ · A look at XZ Utils attacker “Jia Tan”, a persona experts say nation-st · The Open Source Security Foundation and the OpenJS Foundation say the
Related Coverage
- xzbot: notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094) xzbot on GitHub · Anthony Weems
- OSQI — I propose the formation of one or more “Open Source Quality Institutes”. ongoing · Tim Bray
- The xz attack shell script research!rsc · Russ Cox
- New XZ backdoor scanner detects implant in any Linux binary BleepingComputer · Bill Toulas
- XZ Utils Supply Chain Puzzle: Binarly Ships Free Scanner for CVE-2024-3094 Backdoor Firmware Security
- The XZ Backdoor, What Happened, Open Source Safety Stratechery · Ben Thompson
- XZ Utils Backdoor Attack Brings Another Similar Incident To Light SecurityWeek · Eduard Kovacs
- How one volunteer stopped a backdoor from exposing Linux systems worldwide The Verge · Amrita Khalid
- definitely give a minute to this timeline of the social engineering part of the attack: — https://research.swtch.com/... the attacker gained access by first submitting real fixes and becoming a maintainer on the project for a widely used compression algorithm. … @CyclopsCaveman@octodon.social
- I think the #xz incident is teaching us that our infrastructure is dangerously fragile in the face of well-organized/funded attackers. The response isn't “try harder” or “donate to your OSS project”, it needs to be institutional, professional, and at scale. … @timbray@cosocial.ca · Tim Bray
- A walkthrough of the xz attack shell script. — An RC4 variant in Awk, what more could you want? — https://research.swtch.com/... @rsc@hachyderm.io · Russ Cox
- I put together a timeline of the xz attack, dating back to 2021. Corrections or additions welcome here on Mastodon. https://research.swtch.com/... @rsc@hachyderm.io · Russ Cox
- ‘They’ are very likely a multi million dollar operation - see also just the shell script analysis, before you even get to the backdoor (which is much more nuts) https://research.swtch.com/... The actual SSH backdoor is cryptographically signed so only the threat actor can use it. … @GossiTheDog@cyberplace.social · Kevin Beaumont
- Re #XZ attacker - the known threat actor account made various changes across multiple open source projects and documentation. — Library maintainers should not look at those changes in isolation of just that line change, or assume the threat actor only became malicious later. … @GossiTheDog@cyberplace.social · Kevin Beaumont
- This is a solid timeline of the XZ backdoor, ht @GossiTheDog https://research.swtch.com/... Quick question: If this effort began in 2021 and presumably involved numerous personas driving very deliberately toward this goal over the over course of the next 2-3 years, is it a safe guess that this is not all they were doing in the last 2-3 years? @howelloneill@infosec.exchange · Patrick Howell O'Neill
- Hoo boy. I'm not naming names because I don't want to fan the flames, but the knives are out: — Events around #xz have rightly emboldened volunteer-driven open source projects to take their hyper-wealthy downstream users to task. … @josh@josh.tel · Josh Simmons
- Is there a comprehensive list (or an effort) of all the open source projects that: — A) Can loosely be described as “internet infrastructure” — B) Only have one (or few) maintainer(s) — Because that might be a good place to start. It was probably where Jia Tan started... @jerod@changelog.social · Jerod Santo
- OK, I think that this, from @rsc, is probably a good choice as an #xz “hub” document. It's excellent and includes links to all the other real high-quality analysis that I've seen: https://research.swtch.com/... Note: The analysis is not complete, although we know a whole lot more than we did a couple days ago. @timbray@cosocial.ca · Tim Bray
- Heard an interesting take that it's a security imperative to block assholes because of how Jia Tan gained access to #xz @specter@eattherich.club
- This discussion shows us just how close we were to a real shit show if xz utils 5.6.1 would have been merged into mainline ubuntu and Debian. — https://bugs.launchpad.net/... A similar post was also posted to the debian lists by “Hans Jansen” who was also taking part in the original discussions on the xz-utils mailing list … @0xamit@infosec.exchange
- PSA: As far as we can tell, not a single server, laptop or other machine running #Linux was exploited using the #xz backdoor. In all your discussions and extrapolations on what *could* have happened, don't forget that (again, as far as we know) nothing has happened. @jwildeboer@social.wildeboer.net
- Put yourself in Jia Tan's shoes, the malicious contributor to the xz backdoor... It's been, what, two... three?... years since you started this campaign. You've had the entire support of your team and of your chain of command. — Your coders created a complex and sublime backdoor. … @tinker@infosec.exchange · Tinker
- From @campuscodi's excellent sitrep newsletter: — 'Third-party software projects don't (usually) pull the source code and compile the whole XZ Utils project. They just pull the tarball. Jia Tan modified lines in the tarball configs to load the backdoor, which was hidden in binary test data files. … @ravirockks@infosec.exchange · Ravi Nayyar
- Edit: the code and commits were audited and there was one suspicious commit removed. — I can't be the only one who noticed that Jia Tan also had commits to the libarchive repo, right? I can't be the only one that noticed that Jia Tan was adding tests to libarchive, right? Yikes... … @0xamit@infosec.exchange
- The xz attack shell script Hacker News
- The xz attack shell script Lobsters
Discussion
-
@Mer__edith@mastodon.world
Meredith Whittaker
on mastodon
I keep brooding on the way the xz backdoor was enabled in significant part via weaponizing the FOSS culture of shitty behavior and abuse. — Yes, there're other pathologies at work here (the big tech capitalist pillaging of the commons, etc). …
-
@AccordionGuy@mastodon.cloud
Joey deVilla
on mastodon
Had it gone undetected, this tainted version of xz would have enabled an as-yet-unidentified group the ability to take over up to hundreds of thousands of servers worldwide. — My talk assumes that you know very little about programming and only the barest understanding of cyber…
-
@juliank@mastodon.social
Julian Andres Klode
on mastodon
People say “oh Jia fucked up, some commits are in UTC+0200/0300” and I'm thinking: “Why you think they fucked up, they just want to make your thinking shift to Russia or Israel”
-
@zarfeblong@mastodon.gamedev.place
Andrew Plotkin
on mastodon
I guess the takeaway from the xz backdoor situation is: — If you're an open-source project maintainer, and somebody starts getting on your case for not doing enough free work for them, you reply “big Jia Tan energy there” and then block them forever.
-
@venthur@mastodon.social
Bastian Venthur
on mastodon
Wow, this #xz timeline reads like a crime novel! — https://research.swtch.com/... Thanks for the write-up @rsc
-
@irving@mastodon.social
Geoffrey Irving
on mastodon
Yikes: A backdoor in xz, after 3 years of social engineering and a bunch of sock puppet accounts to gain maintainer access. 😱 — This line is particularly interesting. I wonder if oss-fuzz could mitigate this by requiring reports to go to multiple places? Hard to verify indep…
-
@kurtsh@mastodon.social
@kurtsh@mastodon.social
on mastodon
This is one helluva story about what it's like to support important Open Source projects & the asshole consumers of said projects. — ... and how extreme assholes take advantage of the original maintainer's burnout, resulting in the xz/liblzma vulnerability. …
-
@flicknow.xyz
Mark
on bluesky
wonder if the xz stuff will lead to a push for auditable/verifiable build processes for artifacts. i forgot how much we blindly trust was uploaded by good faith actors. although there's probably still lots of ways to obfuscate your build process
-
@accordionguy.bsky.social
Joey de Villa
on bluesky
xz is part of just about every Unix-y operating system (macOS included). Had it gone undetected, this tainted version of xz would have enabled an as-yet-unidentified group the ability to take over up to hundreds of thousands of servers worldwide. (2/3)
-
@ffmpeg
@ffmpeg
on x
The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion dollar corporations expect free and urgent support from volunteers. @Microsoft @MicrosoftTeams posted on a bug tracker full of volunteers that their issue is “high priority” [image]
-
@_mark_atwood
Mark Atwood
on x
The xz attack was not because it was open source. The attack failed because it was open source. The way this attack works for non-open source is the attacker spends 2 years getting an agent hired by contract software development vendor, they sneak it in, nobody finds out.
-
@binitamshah
Binni Shah
on x
Xzbot : Notes, honeypot, and exploit demo for the xz backdoor : https://github.com/... Timeline of the xz open source attack : https://research.swtch.com/... The xz attack shell script : https://research.swtch.com/... [image]
-
@fr0gger_
Thomas Roccia
on x
Kudos to the amazing researchers that published their analysis: - https://gynvael.coldwind.pl/ ... by @gynvael - https://gist.github.com/... by @thesamesam@social.treehouse.systems - https://boehs.org/... by @eb@social.coop - https://www.openwall.com/... by @AndresFreundTec -...
-
@liveoverflow
@liveoverflow
on x
I despise social engineering. These pressure emails are so sad. I respect the technical creativity of the backdoor. But the HUMINT aspect makes me feel awful. What is left of community and humanity when you cannot not trust anybody :/ https://research.swtch.com/... [image]
-
@0xcharlie
Charlie Miller
on x
So folks who are wringing their hands over the xz backdoor... What are we going to do differently to stop this in the future? My guess is we will preach and pontificate but not actually do anything useful...just like we always do!
-
@mer__edith
Meredith Whittaker
on x
One striking thing about the xz backdoor is how the uncool, mean standards of behavior common in FOSS, that many of us decried for years, & that many defended as authentic, tough, etc., ended up being not just exclusionary loser behavior, but a significant attack surface.
-
@fr0gger_
Thomas Roccia
on x
🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)! I hope it helps to make sense of the information out there. Please treat the information “as is” while the analysis... [image]
-
@thegrugq
@thegrugq
on x
The xz backdoor was the final part of a campaign that spanned two years of operations. These operations were predominantly HUMINT style agent operations. There was an approach that lasted months before the Jia Tan persona was well positioned to be given a trusted role.
-
@matthew_d_green
Matthew Green
on x
So apparently the xz backdoor used an Ed448 signature to sign a RCE payload. I'm fascinated by the decision to toss away 48 bytes of payload space on a > 128-bit secure signature. Someone is being very smart or pretty dumb.
-
r/linux
r
on reddit
research! rsc: Timeline of the xz open source attack