Backdoor Found and Defused in Widely Used Linux Utility XZ

Nation-state attackers apparently backdoored widely used, open-source data compression software as part of a supply chain attack.

See Also: 4 Steps to Prove the Value of Your Vulnerability Management Program

The malicious code inserted into versions 5.6.0 and 5.6.1 of XZ Utils, a set of open-source tools and libraries for the XZ compression format initially released as LZMA Utils in 2009 and present in nearly every open-source and commercial Linux distribution, appears to have been detected quickly. This may have helped blunt widespread use of the vulnerability, which appears to have been designed to facilitate remote, unauthorized access to infected systems.

The U.S. Cybersecurity and Infrastructure Security Agency on Friday said it “recommends developers and users to downgrade XZ Utils to an uncompromised version – such as XZ Utils 5.4.6 Stable,” as well as “hunt for any malicious activity and report any positive findings” to the agency.

The vulnerability in XZ Utils, designated CVE-2024-3094, involves liblzma, which is part of the XZ package. The vulnerability is used to facilitate complete remote access to a system via SSHD, which is the OpenSSH server process.

The vulnerability may “enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely,” warned Linux distribution maker Red Hat. “Luckily xz 5.6.0 and 5.6.1 have not yet widely been integrated by Linux distributions, and where they have, mostly in pre-release versions.”

GitHub has disabled the repository being used to spread the backdoored code.

“Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code,” the U.S. National Vulnerability Database said. “This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.”

“The Trojan allows somebody a private key to hijack SSHD to execute commands, amongst other functions,” said British security expert Kevin Beaumont in a blog post. “It is highly advanced.”

The Open Source Security Foundation reported that the attack, at least so far, appears to only be designed to work with Debian or RPM Package Manager packages. “While the motivation behind this backdoor remains unknown, the intent was to compromise specific distributions, as the backdoors were only applied to DEB or RPM packages for the x86-64 architecture built with GCC and the GNU linker,” it said, referring to the GNU Compiler Collection as well as the GNU linker, used to create an executable file or library.

Software Alerts

Credit for discovering the compromised code goes to Andres Freund. On Friday, the principal software engineer at Microsoft posted to the Open Source Software Security mailing list that after “observing a few odd symptoms around liblzma” in installations of Debian Unstable – a rolling development version of Debian with the codename “Sid” – he discovered that “the upstream xz repository and the xz tarballs” – or archive files compressed via the tar utility, “have been backdoored” since February, after which the new version of the utility began to make its way downstream into other software.

His alert arrived just before 9:00 a.m. Pacific Time on Friday, at the start of what was a long Easter holiday weekend for many individuals – including across Europe and in many U.S. states and school districts.

Since then, a number of software developers have warned users that they may have received infected software.

Red Hat warned users to “please immediately stop usage of any Fedora Rawhide instances for work or personal activity.” Rawhide is a constantly rolling, development distribution of the Red Hat Enterprise Linux distribution, which serves as the basis for future Linux builds.

Red Hat also warned that some users of the beta version of Fedora Linux 40 might have received backdoored versions of the XZ libraries, “depending on the timing of system updates,” although the OS “does not appear to be affected by the actual malware exploit.” Even so, it encouraged all Fedora 40 Linux beta users to immediately downgrade to 5.4.x versions.

The Debian development team said that while no stable versions of its OS appear to have been affected, “the next point release for 12.6 has been postponed while we investigate the effects of this CVE on the archive.”

Ubuntu said “no released versions” of its OS have been affected.

The Kali development team warned that anyone who updated their Kali installation on or after March 26.

Arch Linux said “the malicious code does not exist in the Arch version of sshd, as it does not link to liblzma,” and recommended that users “avoid the vulnerable code in their system as it is possible it could be triggered from other, un-identified vectors.”

The vulnerability may also be present for anyone who used the Homebrew utility to install Python v3 on macOS.

Culprit: Intelligence Operation

The operational security expert known as The Grugq said the backdooring appears to be the result of a two-year, sophisticated and “patient” intelligence operation that targeted the individual maintaining XZ in his spare time, Lasse Collin, and “invested more resources into subverting him than anyone invested into his project.”

Collin “is blameless in this,” The Grugq said. “There is no individual, and very, very few organizations, able to detect, let alone resist!, the directed interest of an intelligence agency.” In this case, he said, the initial stages of this “predominantly human intelligence” type of operation appeared to begin around March 2022, with messaging to Lasse, especially from a persona named “Jigar Kumar,” decrying the lack of updates to XZ. Later, attackers appeared to introduce a persona named “Jia Tan,” who magically offered to help Lasse with his workload and then socially engineered Lasse into giving him the right to directly push code updates.

The cybersecurity expert SwiftOnSecurity said that while the attack is interesting, security teams at any organization not targeted via the backdoor should still be focusing on much more basic and pressing security concerns, such as getting hacked because they failed to patch known flaws – for example in their remote-connectivity software – in a timely manner.

“If you’re worth risking burning this kind of global backdoor because they can’t figure anything else out to hit you with tens of billions of dollars and an army of cyber goons you’re already a winner. They had to cheat. Collect your prize,” SwiftOnSecurity said. “The rest of these people are getting popped over email attachments and unpatched VPN concentrators.”

Open-Source Software Under Fire

Security experts have been warning for years that many open-source components provide critical functionality yet too often don’t enjoy adequate backing.

This problem continues to be highlighted, including in 2014 with the discovery of the Heartbleed flaw in the OpenSSL crypto library, which led to new initiatives for plowing more money into open-source projects. In 2021, the discovery of Log4Shell, a flaw in the Apache Software Foundation’s widely used Log4j logging software, highlighted the supply chain risks posed by open-source components, which can be present in many different types of software, old and new, although not always documented.

Expect attackers to keep trying to turn this state of affairs to their own advantage, as the XZ Util attack highlights, said veteran technology columnist Dan Gillmor, a professor of practice at Arizona State University’s Walter Cronkite School of Journalism and Mass Communication.

“Even though it was caught before widely deployed, the reality that a patient ‘bad actor’ can insert malicious code into key open-source repositories – a known possibility – now becomes a looming reality,” Gillmor said.