corpus.blog
41554 blogs · 4,504,310 posts Claim your blog
Record · corpus.blog/posts/01a0ca8c-ec4a-71c3-8136-6a3418e22497

XZ backdoor story – Initial analysis

Kaspersky Securelist · published 12 April 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at securelist.com Wayback capture
4blogs citing
First cited
31 Mar 2024
Most recent
20 Mar 2025
Rank this month
not ranked
Links from this post
49
Words captured
3,058

Cited by

Blog
In the post
Date
luj.fr
How NixOS and reproducible builds could have detected the xz backdoor for the benefit of all Read at the source ↗
20 Mar 2025
dadrian.io
Money for nothing, commits for free Read at the source ↗
1 May 2024
Michael Tsai
xz Backdoor Read at the source ↗
1 Apr 2024
Shellsharks
xz/liblzma Compromise Link Roundup Read at the source ↗
31 Mar 2024

Links from this post

Link
Host
Assessing the Y, and How, of the XZ Utils incident Read at the source ↗
securelist.com
XZ backdoor: Hook analysis Read at the source ↗
securelist.com
https://www.openwall.com/lists/oss-security/2024/03/29/4
openwall.com
Two more malicious Python packages in the PyPI Read at the source ↗
securelist.com
https://social.librem.one/@eighthave/112194828562355097
social.librem.one
https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh@linuxfoundation.org/
lore.kernel.org
https://nvd.nist.gov/vuln/detail/CVE-2024-3094
nvd.nist.gov
https://github.com/JiaT75
github.com
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=4323bc3e0c1e1d2037d5e670a3bf6633e8a3031e
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commit;h=cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0
git.tukaani.org
https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2bbb81307644efdb58db2c422d9ba7
git.tukaani.org
https://man7.org/linux/man-pages/man7/landlock.7.html
man7.org
https://bugzilla.redhat.com/show_bug.cgi?id=2267598
bugzilla.redhat.com
https://tracker.debian.org/news/1515519/accepted-xz-utils-561really545-1-source-into-unstable/
tracker.debian.org
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
redhat.com
https://fulda.social/@Ganneff/112184975950858403
fulda.social
https://tukaani.org/xz-backdoor/
tukaani.org
https://opentip.kaspersky.com/c518d573a716b2b2bc2413e6c9b5dbde/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://opentip.kaspersky.com/5aeddab53ee2cbd694f901a080f84bf1/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0
github.com
https://opentip.kaspersky.com/86fc2c94f8fa3938e3261d0b9eb4836be289f8ae/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://opentip.kaspersky.com/540c665dfcd4e5cfba5b72b4787fec4f/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://opentip.kaspersky.com/b4dd2661a7c69e85f19216a6dbbb1664/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145102/XZ_backdoor_analysis_09.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145150/XZ_backdoor_analysis_10.png
media.kasperskycontenthub.com
https://sourceware.org/glibc/wiki/GNU_IFUNC
sourceware.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145253/XZ_backdoor_analysis_13.png
media.kasperskycontenthub.com
https://www.gnu.org/software/guile/manual/html_node/Object-File-Format.html
gnu.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145335/XZ_backdoor_analysis_12.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145406/XZ_backdoor_analysis_04.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145446/XZ_backdoor_analysis_14.png
media.kasperskycontenthub.com
https://github.com/gcc-mirror/gcc/blob/6f9ba3ea55477cf1bd3d37e40ad116150c06a75e/gcc/config/i386/cpuid.h
github.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145548/XZ_backdoor_analysis_07.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145625/XZ_backdoor_analysis_01.png
media.kasperskycontenthub.com
https://en.wikipedia.org/wiki/Global_Offset_Table
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11145711/XZ_backdoor_analysis_03.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150105/XZ_backdoor_analysis_15.png
media.kasperskycontenthub.com
https://en.wikipedia.org/wiki/Trie
en.wikipedia.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150150/XZ_backdoor_analysis_16.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150247/XZ_backdoor_analysis_05.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150335/XZ_backdoor_analysis_06.png
media.kasperskycontenthub.com
https://www.man7.org/linux/man-pages/man7/rtld-audit.7.html
man7.org
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150425/XZ_backdoor_analysis_11.png
media.kasperskycontenthub.com
https://elixir.bootlin.com/glibc/latest/source/sysdeps/generic/ldsodefs.h
elixir.bootlin.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150507/XZ_backdoor_analysis_08.png
media.kasperskycontenthub.com
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/11150611/XZ_backdoor_analysis_02.png
media.kasperskycontenthub.com
https://opentip.kaspersky.com/4f0cf1d2a2d44b75079b3ea5ed28fe54/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://opentip.kaspersky.com/53d82bb511b71a5d4794cf2d8a2072c1/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com
https://opentip.kaspersky.com/212ffa0b24bb7d749532425a46764433/?utm_source=SL&utm_medium=SL&utm_campaign=SL
opentip.kaspersky.com