Record · corpus.blog/posts/01a087df-93b2-73b3-97af-965333d86690

xz/liblzma Compromise Link Roundup

Shellsharks · published 31 March 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at shellsharks.com Wayback capture

2blogs citing

First cited: 30 Mar 2024
Most recent: 31 Mar 2024
Rank this month: not ranked
Links from this post: 205
Words captured: 1,281

Cited by

Blog

In the post

Date

notes: index

XZ Read at the source ↗

31 Mar 2024

_zeta

The xz backdoor from a Security Engineer persepective Read at the source ↗

30 Mar 2024

Links from this post

Link

Host

https://nvd.nist.gov/vuln/detail/CVE-2024-3094

nvd.nist.gov

https://www.openwall.com/lists/oss-security/2024/03/29/4

openwall.com

https://mastodon.social/@AndresFreundTec/112180083704606941

mastodon.social

https://tukaani.org/xz-backdoor/

tukaani.org

Everything I Know About the XZ Backdoor Read at the source ↗

boehs.org

https://doublepulsar.com/inside-the-failed-attempt-to-backdoor-ssh-globally-that-got-caught-by-chance-bbfe628fafdd

doublepulsar.com

https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

gist.github.com

Supply Chain Intrigue, or The Spy Who Shagged My Repo Read at the source ↗

thesoloadmin.com

https://bsky.app/profile/kyloson.com

bsky.app

The xz backdoor from a Security Engineer persepective Read at the source ↗

appsec.space

https://infosec.exchange/@himazawa/112186949483648008

infosec.exchange

https://www.reddit.com/r/explainlikeimfive/comments/1brf749/eli5_the_recently_discovered_xz_backdoor/

reddit.com

https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b

bsky.app

https://abyssdomain.expert/@filippo/112185827553387306

abyssdomain.expert

https://bsky.app/profile/filippo.abyssdomain.expert

bsky.app

https://www.openwall.com/lists/oss-security/2024/03/30/36

openwall.com

https://gynvael.coldwind.pl/?lang=en&id=782

gynvael.coldwind.pl

https://infosec.exchange/@gynvael/112186403234118116

infosec.exchange

https://github.com/Midar/xz-backdoor-documentation/wiki

github.com

https://ap.nil.im/notice/AgOBVh5Tq1IjfawZvM

ap.nil.im

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd14dedfe63833f8ccbe41b55823b00

git.tukaani.org

https://hachyderm.io/@danderson/112185746000358589

hachyderm.io

Timeline of the xz open source attack Read at the source ↗

research.swtch.com

https://hachyderm.io/@rsc/112199506755478946

hachyderm.io

The xz attack shell script Read at the source ↗

research.swtch.com

https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504

gist.github.com

https://github.com/google/oss-fuzz/pull/10667

github.com

https://social.treehouse.systems/@megmac/112186436680099413

social.treehouse.systems

https://github.com/libarchive/libarchive/pull/1609

github.com

https://cyberplace.social/@GossiTheDog/112184563423734235

cyberplace.social

https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.html

mail-archive.com

https://mastodon.social/@vegard/112181070803627404

mastodon.social

https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006546

gist.github.com

https://piaille.fr/@zeno/112185928685603910

piaille.fr

https://piaille.fr/@zeno

piaille.fr

https://github.com/systemd/systemd/issues/32028

github.com

https://cyberplace.social/@GossiTheDog/112189908304964991

cyberplace.social

Threat Brief: Vulnerability in XZ Utils Data Compression Library Impacting Multiple Linux Distributions (CVE-2024-3094) Read at the source ↗

unit42.paloaltonetworks.com

https://infosec.exchange/@simontsui/112188273870722696

infosec.exchange

https://swecyb.com/@nopatience/112190338006481657

swecyb.com

https://github.com/lockness-Ko/xz-vulnerable-honeypot

github.com

https://infosec.exchange/@ollie_whitehouse/112189799028316146

infosec.exchange

https://github.com/cyclone-github/scripts/blob/main/xz_cve-2024-3094-detect.sh

github.com

https://infosec.exchange/@wdormann/112191461268662743

infosec.exchange

https://github.com/chainguard-dev/bincapz

github.com

https://triangletoot.party/@thomrstrom/112193102194381723

triangletoot.party

https://web.archive.org/web/20240328130100/https://xz.tukaani.org/xz-utils/

web.archive.org

https://www.kali.org/blog/xz-backdoor-getting-started/

kali.org

https://github.com/amlweems/xzbot

github.com

https://infosec.exchange/@amlw

infosec.exchange

https://isc.sans.edu/diary/rss/30802

isc.sans.edu

https://securitybased.io/posts/rx13/xz-liblzma-backdoor/

securitybased.io

https://infosec.exchange/@rx13/112199642511390416

infosec.exchange

https://www.openwall.com/lists/oss-security/2024/04/02/1

openwall.com

https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html

mail-archive.com

Putting an xz Backdoor Payload in a Valid RSA Key Read at the source ↗

rya.nc

https://infosec.exchange/@fr0gger/112189232773640259

infosec.exchange

A Microcosm of the interactions in Open Source projects Read at the source ↗

robmensching.com

https://mas.to/@swelljoe/112186147758379670

mas.to

https://cyberplace.social/@GossiTheDog/112180051717622246

cyberplace.social

https://infosec.exchange/@wdormann/112179988525798247

infosec.exchange

https://chaos.social/@rugk/112186994466015883

chaos.social

https://slsa.dev/

slsa.dev

https://infosec.exchange/@harrysintonen/112186647082270666

infosec.exchange

https://infosec.exchange/@rene_mobile/112186879554070328

infosec.exchange

https://cmdr-nova.online/2024/03/29/hacker-voice-im-in-the-xz-fiasco/

cmdr-nova.online

https://mkultra.monster/@cmdr_nova/112181222923339875

mkultra.monster

https://infosec.exchange/@kpwn/112180829347792639

infosec.exchange

https://infosec.exchange/@yossarian/112181537647566384

infosec.exchange

https://infosec.exchange/@jerry/112182213490650577

infosec.exchange

https://infosec.exchange/@Malwar3Ninja/112185879344426051

infosec.exchange

https://infosec.exchange/@ravirockks/112190305884277570

infosec.exchange

https://infosec.exchange/@briankrebs/112191151028104367

infosec.exchange

https://discourse.nixos.org/t/reconsider-reusing-upstream-tarballs/42524/17

discourse.nixos.org

https://bsd.network/@solene/112192747045310818

bsd.network

https://news.ycombinator.com/item?id=39865810

news.ycombinator.com

XZ Bonus Spectacular Episode

opensourcesecurity.io

https://infosec.exchange/@tinker/112196180295212632

infosec.exchange

https://some-natalie.dev/blog/xz-thoughts/

some-natalie.dev

https://infosec.exchange/@some_natalie

infosec.exchange

Towards reproducible minimal source code tarballs? On *-src.tar.gz Read at the source ↗

blog.josefsson.org

https://infosec.exchange/@briankrebs/112197305365490518

infosec.exchange

https://blog.tidelift.com/xz-tidelift-and-paying-the-maintainers

blog.tidelift.com

https://social.coop/@luis_in_brief/112202420332902529

social.coop

https://www.youtube.com/watch?v=84auPFyxgVw

youtube.com

https://risky.biz/RB743/

risky.biz

https://www.tbray.org/ongoing/When/202x/2024/04/01/OSQI

tbray.org

https://cosocial.ca/@timbray/112203547801373427

cosocial.ca

XZ Backdoor: Not the End of Open Source Read at the source ↗

beny23.github.io

https://infosec.exchange/@beny23/112212984642798524

infosec.exchange

https://www.404media.co/xz-backdoor-bullying-in-open-source-software-is-a-massive-security-vulnerability/

404media.co

The xz Issue Isn’t About Open Source Read at the source ↗

changelog.complete.org

https://www.sovereigntechfund.de/news/xz-structural-change

sovereigntechfund.de

Thoughts on the xz backdoor: an lzma-rs perspective Read at the source ↗

gendignoux.com

https://openssf.org/blog/2024/04/15/open-source-security-openssf-and-openjs-foundations-issue-alert-for-social-engineering-takeovers-of-open-source-projects/

openssf.org

https://kimmcmahon.io/f/open-source-advocacy-community-establish-trust-and-do-no-harm

kimmcmahon.io

https://www.kali.org/blog/about-the-xz-backdoor/

kali.org

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

redhat.com

https://access.redhat.com/security/cve/CVE-2024-3094

access.redhat.com

https://archlinux.org/news/the-xz-package-has-been-backdoored/

archlinux.org

https://micronews.debian.org/2024/1711830544.html

micronews.debian.org

https://lists.debian.org/debian-security-announce/2024/msg00057.html

lists.debian.org

https://forum.openwrt.org/t/project-statement-about-xz-5-6-1-cve-2024-3094/193250

forum.openwrt.org

CVE-2024-3094: Urgent alert for Fedora Linux 40 and Rawhide users Read at the source ↗

fedoramagazine.org

https://news.opensuse.org/2024/03/29/xz-backdoor/

news.opensuse.org

https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405

discourse.nixos.org

https://github.com/orgs/Homebrew/discussions/5243

github.com

https://mastodon.lawprofs.org/@SteveBellovin/112180311536275381

mastodon.lawprofs.org

https://social.sdf.org/@claudiom/112188354576658490

social.sdf.org

https://fosstodon.org/@techsaviours/112187254276937299

fosstodon.org

https://infosec.exchange/@dfncert/112189133491821442

infosec.exchange

https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/

arstechnica.com

https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/

arstechnica.com

https://www.wired.com/story/xz-backdoor-everything-you-need-to-know/

wired.com

https://www.nytimes.com/2024/04/03/technology/prevent-cyberattack-linux.html

nytimes.com

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

cisa.gov

https://sourcesmethods.com/xz-utils-backdoor-discovered/

sourcesmethods.com

https://www.latio.tech/posts/CVE-2024-3094

latio.tech

https://www.404media.co/the-xz-backdoor-highlights-the-vulnerability-of-open-source-software-and-its-strengths/

404media.co

https://thehackernews.com/2024/03/urgent-secret-backdoor-found-in-xz.html

thehackernews.com

https://securityaffairs.com/161224/malware/backdoor-xz-tools-linux-distros.html

securityaffairs.com

https://linuxiac.com/debian-decided-to-postpone-the-12-6-release/

linuxiac.com

https://thenimblenerd.com/article/xzploit-debacle-how-a-cpu-hogging-ssh-glitch-unraveled-a-10-10-security-nightmare/

thenimblenerd.com

https://www.politico.com/news/2024/03/31/thwarted-supply-chain-hack-alarm-bells-00149877

politico.com

https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/

openssf.org

https://www.runzero.com/blog/how-to-find-systems-impacted-by-cve-2024-3094-libxz-utils-with-runzero/

runzero.com

https://duo.com/decipher/red-hat-warns-of-malicious-code-in-xz-utils

duo.com

https://hackaday.com/2024/03/29/security-alert-potential-ssh-backdoor-via-liblzma/

hackaday.com

https://hackaday.com/2024/03/31/exploit-the-stressed-out-package-maintainer-exploit-the-software-package/

hackaday.com

https://www.bleepingcomputer.com/news/security/red-hat-warns-of-backdoor-in-xz-tools-used-by-most-linux-distros/

bleepingcomputer.com

https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils

darkreading.com

https://hardenedvault.net/blog/2024-03-31-xz-lzma-backdoor-open-source-nuke/

hardenedvault.net

https://www.techspot.com/news/102456-linux-could-have-brought-down-backdoor-found-widely.html

techspot.com

https://www.rapid7.com/blog/post/2024/04/01/etr-backdoored-xz-utils-cve-2024-3094/

rapid7.com

https://www.hackerone.com/vulnerability-management/cve-2024-3094

hackerone.com

https://www.zscaler.com/blogs/security-research/cve-advisory-cve-2024-3094-security-compromise-xz-utils

zscaler.com

https://tedium.co/2024/04/01/xz-supply-chain-attack-heartbleed/

tedium.co

https://writing.exchange/@ernie/112199142513994510

writing.exchange

https://www.reversinglabs.com/blog/a-software-supply-chain-meltdown-what-we-know-about-xz-trojan

reversinglabs.com

https://www.securityweek.com/supply-chain-attack-major-linux-distributions-impacted-by-xz-utils-backdoor/

securityweek.com

https://pentest-tools.com/blog/xz-utils-backdoor-cve-2024-3094

pentest-tools.com

https://infosec.exchange/@pentesttools/112201667074904342

infosec.exchange

https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils

tenable.com

https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know

akamai.com

https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/microsoft-faq-and-guidance-for-xz-utils-backdoor/ba-p/4101961

techcommunity.microsoft.com

https://www.cert.europa.eu/publications/security-advisories/2024-032/

cert.europa.eu

https://infosec.exchange/@cert_eu/112202582233591864

infosec.exchange

https://archive.md/G7kBC

archive.md

https://thehackernews.com/2024/04/malicious-code-in-xz-utils-for-linux.html

thehackernews.com

https://www.hackread.com/xz-utils-backdoor-patch-systems-cve-2024-3094/

hackread.com

https://www.schneier.com/blog/archives/2024/04/xz-utils-backdoor.html

schneier.com

https://www.oligo.security/blog/detecting-exploitation-liblzma-xz-cve-2024-3094

oligo.security

https://blog.securityonion.net/2024/04/security-onion-and-xz-vulnerability.html

blog.securityonion.net

https://blog.phylum.io/xz-liblzma-backdoor-supply-chain-attack/

blog.phylum.io

https://www.wired.com/story/jia-tan-xz-backdoor/

wired.com

https://lwn.net/SubscriberLink/967192/6c39d47b5f299a23/

lwn.net

https://www.wiz.io/blog/cve-2024-3094-critical-rce-vulnerability-found-in-xz-utils

wiz.io

https://www.reuters.com/technology/cybersecurity/why-near-miss-cyberattack-put-us-officials-tech-industry-edge-2024-04-05/

reuters.com

https://www.uptycs.com/blog/xz-utils-backdoor-vulnerability-cve-2024-3094

uptycs.com

https://thebreach.report/p/xz-utils-linux-backdoor-vulnerability

thebreach.report

https://www.sentinelone.com/blog/xz-utils-backdoor-threat-actor-planned-to-inject-further-vulnerabilities/

sentinelone.com

https://blog.phylum.io/rust-crate-shipping-xz-backdoor/

blog.phylum.io

https://news.itsfoss.com/xz-utils-backdoor/

news.itsfoss.com

https://news.opensuse.org/2024/04/12/learn-from-the-xz-backdoor/

news.opensuse.org

XZ backdoor story – Initial analysis Read at the source ↗

securelist.com

https://dwheeler.com/trusting-trust/

dwheeler.com

http://lists.landley.net/pipermail/toybox-landley.net/2020-July/011898.html

lists.landley.net

https://mstdn.jp/@landley/112186917000151313

mstdn.jp

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf

cs.cmu.edu

https://linuxreviews.org/images/d/d9/OpenSourceInsecurity.pdf

linuxreviews.org

https://cyberplace.social/@GossiTheDog/112186424998201736

cyberplace.social

That's not my name! Practical problems in real name policies. Read at the source ↗

shkspr.mobi

https://mastodon.social/@Edent/112192486282376050

mastodon.social

https://discuss.coding.social/t/unionize-free-software-found-software-guilds/59

discuss.coding.social

https://babka.social/@csdummi/112186861395096092

babka.social

https://www.softwaremaxims.com/blog/not-a-supplier

softwaremaxims.com

https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/

mikemcquaid.com

https://mastodon.social/@mikemcquaid/112211808720492947

mastodon.social

https://matrix.org/blog/2024/04/open-source-publicly-funded-service/

matrix.org

The free software commons Read at the source ↗

jenniferplusplus.com

It's not a supply chain, dummy! Read at the source ↗

crankysec.com

https://openpath.chadwhitacre.com/2024/open-source-is-a-restaurant/

openpath.chadwhitacre.com

https://xkcd.com/2347/

xkcd.com

https://infosec.exchange/@Emily/112186620818867481

infosec.exchange

https://strangeobject.space/@esther/112180341545370848

strangeobject.space

https://infosec.exchange/@jcfarris/112184628739196653

infosec.exchange

https://infosec.exchange/@dmgedgoods/112189482358269802

infosec.exchange

https://infosec.exchange/@elhackernet/112190157669608126

infosec.exchange

https://hachyderm.io/@isaac/112181119452687292

hachyderm.io

https://mastodon.social/@AndresFreundTec/112180406142695845

mastodon.social

https://infosec.exchange/@bontchev/112185284355594201

infosec.exchange

https://indieweb.social/@whalecoiner/112187118824467745

indieweb.social

https://social.hackerspace.pl/@q3k/112186313662241899

social.hackerspace.pl

XZ Utils Backdoor (https://www.openwall.com/lists/oss-security/2024/03/29/4)

patchfriday.com

OSS Fame & Riches (https://www.openwall.com/lists/oss-security/2024/03/29/4)

patchfriday.com

XZ Utils Payload (https://www.openwall.com/lists/oss-security/2024/03/29/4)

patchfriday.com

https://turnoff.us

turnoff.us

https://floss.social/@jwf/112181835287436354

floss.social

https://infosec.exchange/@simonzerafa/112184297877943027

infosec.exchange

https://infosec.exchange/@jerry/112186358437996941

infosec.exchange

https://infosec.exchange/@joshbressers/112186317441129738

infosec.exchange

https://mastodon.social/@AndresFreundTec

mastodon.social

https://infosec.exchange/@wdormann/112184824746377542

infosec.exchange

https://mastodon.social/@bagder/112185716463978460

mastodon.social

https://www.openwall.com/lists/oss-security/2024/03/30/25

openwall.com