In March 2024 a software engineer noticed that his computer was taking half a second longer than normal to log in over SSH. Following that small delay led to the discovery of one of the most carefully planned attacks on open-source software ever found.
What is xz?
xz Utils is a free data-compression tool and library used across Linux. Almost nobody notices it, which is exactly why it was a good target. At the time it was maintained mostly by a single unpaid volunteer, who had said publicly that he had limited time and energy for the project.
How the attack unfolded
Around 2021 a new contributor using the name Jia Tan began sending helpful patches. Over the next two years the account earned trust, and several other accounts urged the original maintainer to hand over more responsibility. Jia Tan was eventually given co-maintainer rights and began publishing releases.
In February 2024 versions 5.6.0 and 5.6.1 were released containing a hidden backdoor. The malicious code was concealed in what looked like ordinary test files and activated through the build process. It was aimed at the SSH service used to log in to servers remotely, on some Linux systems.
How it was caught
Andres Freund, an engineer at Microsoft who works on the PostgreSQL database, noticed that SSH logins on a test machine were slow and used more processor time than expected. He investigated, traced it to xz, and on 29 March 2024 posted a warning to a security mailing list. The flaw was assigned the identifier CVE-2024-3094 and the maximum severity score of 10.
The backdoor had mostly reached development and testing versions of Linux distributions, not the stable releases most servers use, which limited the damage. Security experts have said that if it had gone unnoticed, the result could have been disastrous.
Who was Jia Tan?
Nobody knows. “Jia Tan” is a pseudonym, and the other accounts that pushed for a new maintainer may belong to the same people. Many experts believe the planning, patience and technical skill point to a well-resourced team, possibly state-backed, but this is speculation. No government or court has publicly identified anyone.
The lesson
The case showed that the weak point in software security can be human trust and overworked volunteers, not just code. It prompted fresh discussion about funding for open-source maintainers, better review of releases and ways to check that software is built from the code it claims to be built from.
Frequently asked questions
What was the xz backdoor?
Hidden malicious code in xz Utils versions 5.6.0 and 5.6.1 that could have allowed attackers to bypass SSH logins on some systems.
Who found it?
Andres Freund, a Microsoft engineer, who noticed slow logins in March 2024.
Who is Jia Tan?
Unknown. It is a pseudonym and the real person or group has not been identified.
Did it affect many people?
It was caught early and mostly appeared in testing versions, so real-world damage was limited.
What was the identifier?
CVE-2024-3094.