|
|
The XZ Backdoor Story:
|
Abstract
On Fri, 29 Mar 2024, at exactly 08:51:26, OSS security received a message from Andres Freund, a software engineer at Microsoft, stating he had discovered a backdoor in upstream xz/liblzma that could compromise SSH servers. The open-source project XZ, specifically the liblzma library, has been compromised by a mysterious maintainer named Jia Tan, putting the entire internet at risk. Fortunately, this discovery helped us avoid the worst. But what happened? How long has this rogue maintainer been part of the project? Who is Jia Tan? Was he involved in other projects? How does the backdoor work? And what should we learn from this? The XZ backdoor is not just an incredible undercover operation but also a gigantic puzzle to solve. Beyond the technical background, there is a story to tell here, to capitalize on what went wrong and what we could improve. Speaker Bio: Thomas Roccia is a security and threat researcher with over a decade of experience in the cybersecurity industry. He has held positions at leading security companies with a special focus on threat intelligence and malware analysis. Currently, Thomas is working as a Senior Security Researcher at Microsoft. Thomas is a regular speaker at security conferences. He is also the author of the book Visual Threat Intelligence, an illustrated guide for threat researchers. Thomas's work has been quoted by multiple media outlets around the world. |
