The xz attack shell script(research.swtch.com)
553 points by todsacerdoti | 279 comments
Russ Cox blog post analyzing the shell script portion of the 2024 xz/liblzma backdoor, explaining how it injected malicious code into the build.
#liblzma on Hacker News
5 stories tagged liblzma, newest first.
Timeline of the xz open source attack(research.swtch.com)
967 points by todsacerdoti | 431 comments
Russ Cox's blog post giving a detailed timeline of the social engineering behind the xz/liblzma backdoor attack by "Jia Tan".
Xz: A microcosm of the interactions in open source projects(robmensching.com)
468 points by transpute | 267 comments
Rob Mensching blog post, adapted from a Twitter thread, reflecting on the xz/liblzma backdoor as a microcosm of interactions in open source projects.
Xz/liblzma: Bash-stage Obfuscation Explained(gynvael.coldwind.pl)
439 points by ecliptik | 90 comments
Gynvael Coldwind's blog post explaining the obfuscation techniques used in the bash stages of the xz/liblzma backdoor that affected OpenSSH.
Backdoor in upstream xz/liblzma leading to SSH server compromise(openwall.com)
4122 points by rkta | 1526 comments
Andres Freund's oss-security mailing list post disclosing a backdoor in upstream xz/liblzma tarballs 5.6.0 and 5.6.1 that compromises SSH servers.