How the XZ backdoor works
Versions 5.6.0 and 5.6.1 of the XZ compression utility and library were shipped with a backdoo [...]
xz-utils backdoor situation (CVE-2024-3094)
gist.github.comxz-utils backdoor situation (CVE-2024-3094). GitHub Gist: instantly share code, notes, and snippets.
xz/liblzma Backdoor: Open Source Nuke? Maybe Not That Bad!
xz/liblzma Backdoor: Open Source Nuke? Maybe Not That Bad! Story Background On March 29, 2024, a report exposing a backdoor in the upstream source code of the controversial open-source project, the xz software package, was made public on the oss-security mailing list.
CVE-2024-3094: Malicious code in xz 5.6.0 and 5.6.1 tarballs
There is currently an ongoing discussion on various platforms about a security issue in xz/liblzma, and here is what we know at this time. This post serves as a way to inform the community about our assessment of the impact on nixpkgs. Summary It was discovered that xz from version 5.6.0 started shipping malicious code that would only be executed through its release tarballs. A malicious code path would be executed when running configure and modify the resulting liblzma library. Impact NixOS 2...
Organization costs of the xz backdoor
Managing insider threats when the whole world is an insider.
Risky Biz News: Supply chain attack in Linuxland
In other news: AT&T confirms 2019 data breach; Canonical switches to manual reviews after flood of scam apps; HP leaves Russia.
Friday Links 24-10
Heisenberg’s indeterminacy principle formula. Two weeks of links, which includes a collection from the xz debacle. I loved reading these, as this is a good combination of spy story and technology postmortem. If you want to read an overview, read the timeline post. Good podcasts this week: about the Heisenberg principle, and the silencing of climate protesters in the UK. Leadership Getting real with Employee Experience [Podcast] - two good interviews with people active in the area.
CVE-2024-3094: Backdoor Attack Against xz and liblzma
Learn about a targeted backdoor supply chain attack against the popular XZ compression utility seen in many Linux distributions such as fedora and debian.
XZ Utils Backdoor: Supply Chain Vulnerability (CVE-2024-3094) - guardsix
Discover XZ Utils, renowned for high compression & data integrity. Learn about recent CVE-2024-3094 breach.
RubyGems is not vulnerable to the xz/liblzma backdoor
The past few days have seen the security world focused on the revelation of the xz/liblzma backdoor. For more background, see this early writeup of the issue, this GitHub Gist, this detailed timeli...
xz/liblzma Compromise Link Roundup
Links to analysis, discussion and more related to the xz/liblzma compromise (CVE-2024-3094).
Everything I Know About the XZ Backdoor
Please note: This is being updated in real-time. The intent is to make sense of lots of simultaneous discoveries
xz backdoor - Dmitry Kudryavtsev
A malicious backdoor was discovered in xz library that implements LZMA compression. xz, among many other places, is used, indirectly, in sshd. My attempt to explain what happened.
What we know about the xz Utils backdoor that almost infected the world
Malicious updates made to a ubiquitous tool were a few weeks away from going mainstream.
The xz backdoor from a Security Engineer persepective
As you probably already heard, the xz package got compromised. The package was used as entrypoint to inject malicious code in sshd, altering the authentication flow. This forged vulnerability is now known as CVE-2024-3094.