The xz backdoor, in plain words
A backdoor nearly reached millions of Linux servers through a compression library. What to check, and what it teaches.
On Friday, a developer noticed SSH logins on a test machine were half a second slower than usual, dug in, and found a backdoor in xz, a compression library almost every Linux system has. It was hidden in versions 5.6.0 and 5.6.1 and could let the attacker into SSH on affected systems.
Check yours:
xz --versionIf it says 5.6.0 or 5.6.1, update now using your distribution’s advice. The bad versions mainly reached rolling and testing releases such as Fedora 40 pre-release, Debian testing and unstable, Kali and Arch. Stable server releases like Debian stable, Ubuntu LTS and RHEL weren’t shipping them. Most production servers are fine.
The scary part isn’t the code. Someone spent about two years becoming a trusted maintainer of the project, helping a tired volunteer, before slipping the backdoor in.
Lessons for the rest of us:
- Production runs stable releases, not the newest of everything.
- Small open-source projects you depend on are part of your security. Know which ones they are.
- “Something is slightly slower” is worth investigating.