Intro

Social Takeover

Anatomy of an Attack

Get Nostr'd

Housekeeping

Boosts

Pick

Outro

We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.Sponsored By:<ul><li><a href="http://tailscale.com/linuxunplugged">Tailscale</a>: <a href="http://tailscale.com/linuxunplugged">Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!</a></li><li><a href="https://kolide.com/unplugged">Kolide</a>: <a href="https://kolide.com/unplugged">Kolide is a device trust solution for companies with Okta, and they ensure that if a device isn't trusted and secure, it can't log into your cloud apps.</a></li></ul><a href="https://jupitersignal.memberful.com/checkout?plan=52946">Support LINUX Unplugged</a>Links:<ul><li><a href="https://strike.me/">💥 Gets Sats Quick and Easy with Strike</a></li><li><a href="https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov">📻 LINUX Unplugged on Fountain.FM</a></li><li><a href="https://www.openwall.com/lists/oss-security/2024/03/29/4">oss-security mailing list</a> — Backdoor in upstream xz/liblzma leading to ssh server compromise.</li><li><a href="https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users">Fedora Announcement</a></li><li><a href="https://security-tracker.debian.org/tracker/CVE-2024-3094">Debian Announcement</a></li><li><a href="https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714">Ubuntu Announcement</a></li><li><a href="https://www.kali.org/blog/about-the-xz-backdoor/">Kali Linux Announcement</a></li><li><a href="https://archlinux.org/news/the-xz-package-has-been-backdoored/">Arch Linux Announcement</a></li><li><a href="https://bugs.gentoo.org/928134">Gentoo Announcement</a></li><li><a href="https://news.opensuse.org/2024/03/29/xz-backdoor/">openSUSE Tumbleweeed Announcement</a></li><li><a href="https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405">NixOS Unstable Discussion</a></li><li><a href="https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405/5">Why does it take two weeks for NixOS to replace xz?</a></li><li><a href="https://mastodon.social/@AndresFreundTec/112180406142695845">Andres Freund on Mastodon</a> — I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc....</li><li><a href="https://news.ycombinator.com/item?id=39865810">rwmj on Hacker News</a> — Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 &amp; 41 because of its "great new features"</li><li><a href="https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/">A Microcosm of the interactions in Open Source projects</a> — Make no mistake. This is the way it works. It needs to change.</li><li><a href="https://twitter.com/devuanorg/status/1774029432979653069?t=ASJqAbm5fVHDKeq7CLKqjw">Devuan GNU/Linux on X</a> — Devuan is not affected by the latest vulnerability caused by systemd.</li><li><a href="https://github.com/systemd/systemd/pull/31550#issuecomment-1972737923">systemd PR: Dynamically load compression libraries</a></li><li><a href="https://twitter.com/teknoraver85/status/1774452847188312163">Matteo Croce on X</a> — I'm the author of such PR. While I absolutely didn't know that libxz had a backdoor, I really think that libraries should be loaded on-demand when rarely used, hence my change :)</li><li><a href="https://twitter.com/icculus/status/1774310925035524333">Ryan C. Gordon on X</a> — This is probably how the xz thing happened, right?</li><li><a href="https://social.wildeboer.net/@jwildeboer/112184074379919145">Jan Wildeboer on the Fediverse</a> — Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO.</li><li><a href="https://unpluggedcore.com/">Unplugged Core Membership</a></li><li><a href="https://2024.texaslinuxfest.org/">TXLF is coming up! </a> — April 12 - 13 in Austin, Texas.</li><li><a href="https://linuxfestnorthwest.org/">LFNW coming up!</a> — April 26 - 28</li><li><a href="https://www.bloomberg.com/news/newsletters/2024-03-28/mobile-game-ads-are-boosting-podcast-follower-counts">Mobile Game Ads Are Boosting Podcast Follower Counts</a> — Wondery, iHeart and Lemonada Media are all using a non-public product from MowPod - which gives extra lives and game credits to gamers if they follow shows on Apple Podcasts from game apps.</li><li><a href="https://podnews.net/article/mowpod-promotion">MowPod's podcast promotion tools: tales from the bar</a></li><li><a href="https://github.com/fortydeux/Fortydeux-NixOS-System-Flake/">fortydeux's NixOS Configs</a></li><li><a href="https://prismlauncher.org/">Prism Launcher</a> — An Open Source Minecraft launcher with the ability to manage multiple instances, accounts and mods.</li><li><a href="https://www.worldbackupday.com/en/">World Backup Day — March 31st</a> — One small accident or failure could destroy all the important stuff you care about.</li><li><a href="https://www.jupiterbroadcasting.com/show/linux-unplugged/494/">Updating Our Fiddly Bits | LINUX Unplugged 494</a></li></ul>

We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.

Chris Fisher

Wes Payne

Brent Gervais

LINUX Unplugged

<div>Live from LinuxFest Norhtwest 2025 Day 1. Exclusive coverage, chats, interviews, and more.</div>

556: The xz Backdoor Exposed 🚨