What You Need to Know About the Linux XZ Utils Hack

Over the last week, there have been many reports of a major Linux vulnerability that some outlets have coined as an attempt to hack the world. Join us as we break down what happened and what we need to learn from the incident.

What Happened:

              Andres Freund, a Microsoft software engineer, discovered a vulnerability in a key utility used by many Linux distributions and developers. The affected software, XZ Utils, compresses and decompresses files and features on almost all Linux distributions. The vulnerability has been classed as CVE-2024-3094 and was given a 10.0 Criticality score, the highest possible vulnerability score in the CVE system.

              The vulnerability appears to be an intentionally developed backdoor that targeted the Secure Shell (SSH) Protocol and allowed for arbitrary code execution and unauthorized access to systems running the code.

The good news is that the issue was quickly discovered. The vulnerability appears to have been introduced in two recent updates to XZ Utils, versions 5.6.0 and 5.6.1. These updates were committed in mid-to-late February. As a result, they were only published on a few Linux distributions, including Fedora, Kali Linux, OpenSUSE, and Alpine.

The bad news is that the vulnerability was created as part of a sophisticated threat actor attack, which was likely carried out by a state-sponsored group. The code was created and added to XZ Utils by a GitHub user, JiaT75, who went by the name Jia Tan. The account was created in November of 2021, and they have been an active contributor to XZ Utils since the start of 2023, spending over a year building trust with the primary maintainer. When they finally received co-maintainer privileges, they began using that position to stealthily introduce the backdoor vulnerability into the XZ Utils codebase.  

Had the issue not been detected promptly, it could have led to backdoor access on virtually every Linux-based system worldwide, including critical business servers, cloud infrastructure, and other critical devices.  

What Can we Learn from this incident?

              Whenever an incident occurs that has so many possible consequences, it’s worthwhile to take a moment to reflect on what we can learn from it. The specific dynamics of this incident particularly highlight certain dynamics and trends around how open source software interacts with supply chain risk management, and the risks of state-sponsored threat actors.  

Open Source supply chains

              Open-source software is important in the tech business ecosystem. That’s been the case for a long time, with large, prominent companies like Microsoft, Google, and Amazon both contributing to and leveraging open-source code in their products and services. Many other software companies have followed suit. Meanwhile, thanks to greater interconnectivity, cloud architecture, and agile development, programs are [dependent//https://xkcd.com/2347/] on a larger and more varied set of other software than ever to function.  

              That means many companies rely on code and software that’s not officially vetted and may be highly reliant on the work of hobbyists and volunteers. If updates create incompatibilities between applications or vulnerabilities are exploited, there are fewer guarantees for a rapid patch and fix for open-source projects than for traditional services.

              Avoiding the use of open-source code entirely is not going to be a viable solution for most software companies. The advantages of cost savings, unofficial standardization, and ease of use are too high. However, it highlights the need for effective risk management measures and for taking DevSecOps seriously. Thankfully, there are already existing solutions in place to allow for automated code scanning and review, including open-source code that’s being integrated. That reduces the ability of threat actors to sneak vulnerabilities into software products.

              However, the broader risk management challenge of minimizing the risk of key dependencies becoming inoperable or abandoned remains. Tackling this requires maintaining oversight of what third-party components, open-source or otherwise, you are dependent on and identifying the likelihood of disruption and the available contingencies.  

State Actor Cyberthreats

This incident is also a cautionary tale of the scope of state-backed cyberthreats. 

While this attempt was ultimately a failure, it highlights the group’s ambition. The backdoor would have spread throughout the Linux distro ecosystem if the incident remained undetected. From there, it could have compromised all sorts of business devices: on-prem and cloud servers, network hardware, production environments, and any other device that runs on Linux operating systems.       

The attack was initially successful because of a long, patient, and effective social engineering attack where the JiaT75 spent over two years contributing to XZUtils and other open-source projects to build up the necessary trust to access the ability to make edits to XZ Utils without added scrutiny. It’s incredibly hard to protect against threat actors who are willing to invest that sort of time and effort.

The incident was only discovered when some issues in the vulnerability code caused the program to use excess CPU power. Had the code been better implemented, or had Freund not happened to notice the odd behavior and investigate, the issue could have gone unnoticed for much longer.

              It’s likely impossible for individual organizations to protect themselves thoroughly against threat actors with that level of determination or persistence. Rather, the focus needs to be broader. On an individual organizational level, the focus needs to be on developing architecture and systems that limit the blast radius of a potential compromise in critical infrastructure. On a broader scale, we need to recognize and embrace that security is a collective project. The rapid reporting, understanding, and resolution of the XZ Utils vulnerability demonstrates that we can fix problems quickly and effectively by working together. Maintaining tools like the CVE system that allow this type of industry standardization and communication is critical.  

Conclusion

This incident highlights the importance of vigilance, strategic preparedness, and the need for comprehensive cybersecurity measures to safeguard against state-sponsored threats and sophisticated cyber actors. The rapid identification and resolution of this vulnerability demonstrates the effectiveness of collective action and the critical role of cybersecurity frameworks in enhancing organizational resilience.

Organizations must adopt a proactive and informed security stance. For organizations seeking to bolster their cybersecurity framework and resilience against sophisticated threats, we can provide tailored guidance, strategic insights, and access to cutting-edge security solutions. Reach out today to speak with an ADS advisor today.