The backdoor was embedded in xz Utils, a widely used data compression utility on Linux and other Unix-like operating systems.

It was first noticed by Andres Freund, a developer working on Microsoft’s PostgreSQL offerings, when he stumbled upon the backdoor while troubleshooting performance issues a Debian system was experiencing with SSH, a protocol for remotely logging into devices over the Internet. 

Initially, he noticed abnormal CPU consumption during SSH logins, which led him to scrutinise recent updates to xz Utils. His investigation ultimately revealed the presence of a carefully concealed backdoor.

The malicious code, integrated into versions 5.6.0 and 5.6.1 of xz Utils, exploited vulnerabilities in the .lzma compression and SSH protocols. Upon triggering, it granted unauthorised access to the system, effectively allowing attackers to execute arbitrary commands with root privileges. 

This clandestine access posed a significant security risk, potentially compromising sensitive data and system integrity.

The origins of the backdoor trace back to subtle manipulations made by a user known as Jia Tan within open-source projects, including xz Utils. 

Tan’s meticulous efforts went largely unnoticed until Freund’s discovery brought them to light. It’s believed that Tan and accomplices orchestrated this elaborate scheme over several years, leveraging their positions within the software development community to implant the backdoor undetected.

Recommended reading

• Linux Malware Hit Record Highs in 2022
• New Ordnance Survey Datasets to Help Speed Up Emergency Response
• Is Google Promoting Malware in Search?

“This is still a new situation. There is a lot we don’t know. We don’t know if there are more possible exploit paths. We only know about this one path. Please update your systems regardless. Unknown unknowns are safer than known unknowns,” said a developer thesamesam in an overview of the backdoor.

While the immediate threat has since been neutralised, it underscores the importance of thorough code review and vigilance in safeguarding against malicious intrusions. In response to this revelation, security experts urge heightened scrutiny of software updates and enhanced collaboration within the development community to prevent similar breaches in the future.