7 stories tagged xz-backdoor, newest first.
381 points by nathell | 212 comments
A post on X by security researcher blasty showing he triggered deeper, harder-to-reach functionality of the xz sshd backdoor, with a terminal screenshot of a client script.
553 points by todsacerdoti | 279 comments
Russ Cox blog post analyzing the shell script portion of the 2024 xz/liblzma backdoor, explaining how it injected malicious code into the build.
967 points by todsacerdoti | 431 comments
Russ Cox's blog post giving a detailed timeline of the social engineering behind the xz/liblzma backdoor attack by "Jia Tan".
816 points by q3k | 425 comments
GitHub repository with notes, a honeypot, and an exploit demo for the xz backdoor (CVE-2024-3094), including Go code and an OpenSSH patch.
439 points by ecliptik | 90 comments
Gynvael Coldwind's blog post explaining the obfuscation techniques used in the bash stages of the xz/liblzma backdoor that affected OpenSSH.
1207 points by junon | 743 comments
Bluesky post by Filippo Valsorda sharing preliminary analysis that the xz backdoor enables gated, unreplayable RCE via a hooked RSA_public_decrypt verifying an Ed448 signature.
478 points by dhx | 268 comments
A gitweb diff of xz's CMakeLists.txt adding a Landlock sandbox feature test, which contains a stray '.' character that silently breaks the check and disables Landlock.