The XZ Backdoor Almost Compromised Every Linux System

Step-by-Step Tutorial: How to Protect Your System from the XZ Backdoor

1. Understanding the Backdoor Discovery

   • A backdoor was discovered in XZ utils, a popular compression tool used by package managers and even kernel.org for compressing files and the Linux kernel itself.
   • The backdoor was identified by a Postgres developer at Microsoft who noticed slow SSH logins and excessive CPU usage, leading to the discovery of the malicious backdoor in recent updates to XZ utils.

2. Analysis of the Backdoor

   • The backdoor was hidden in binary files within the test folder of the XZ repository to avoid detection.
   • Upon decompressing the XZ file and running it through bash, chunks of data are loaded and executed, ultimately injecting the backdoor script into the build process.

3. Understanding the Backdoor Script

   • The backdoor script checks for specific conditions, such as the system running x86 64 Linux, being built with GCC, and being part of a Debian or RPM package build.
   • If the conditions are met, a binary object called lib lzma La CRC 64 fast is injected into the build process, compromising the system.

4. Implications of the Backdoor

   • The backdoor targets Debian or Red Hat-based systems, potentially affecting a large number of Linux distributions.
   • The backdoor allows for remote code execution, posing a serious security threat to affected systems.

5. Understanding the Infiltration Process

   • The backdoor's infiltration into the XZ repository was a coordinated effort involving multiple individuals over several years.
   • The backdoor was introduced through patch submissions and changes to the repository, indicating a sophisticated hacking operation.

6. Protecting Your System

   • To safeguard your system against the XZ backdoor, update to versions 5.6.0 or 5.6.1, which contain patches to address the vulnerability.
   • If a patched version is not available, consider downgrading to a version prior to 5.6.0 to mitigate the risk.
   • Stay vigilant for any further vulnerabilities or threats related to the XZ backdoor, as reverse engineering efforts are ongoing.

7. Final Recommendations

   • Take immediate action to update or downgrade your system to protect against the XZ backdoor.
   • Stay informed about security updates and patches related to XZ utils to prevent potential security breaches on your system.

By following these steps and staying proactive in monitoring security updates, you can mitigate the risk posed by the XZ backdoor and ensure the safety of your Linux system.