How One Hack Nearly Took Down The Internet

Quick Overview

A sophisticated, years-long supply chain attack targeting the XZ data compression utility, a critical dependency in the Linux ecosystem, nearly succeeded in creating a universal backdoor into millions of internet servers via OpenSSH authentication, but was ultimately foiled by the diligence of an unrelated Microsoft developer, Andres Freund, who noticed subtle performance delays.

Key Points: The hacker, operating under the alias Jia Tan, spent approximately two and a half years infiltrating the XZ project, maintained by Lasse Collin, to insert a malicious payload into the XZ Utils 5.6.0 release. The exploit targeted the Secure Shell (SSH) protocol's RSA authentication step by using an IFUNC resolver and a dynamic audit hook within XZ to overwrite the Global Offset Table (GOT) entry for RSA Decrypt, creating a backdoor triggered by a secret key. The attack was ultimately detected because the complex obfuscation and encryption required to hide the backdoor introduced consistent slowdowns of about 400 to 500 milliseconds, which Andres Freund noticed while testing Debian. Linux, powered by the combination of GNU utilities and the Linux kernel, runs virtually all of the top 500 supercomputers, powers Android, and manages the majority of internet servers, underscoring the massive scope of the potential compromise. The XZ attacker used sophisticated social engineering, pressuring the original maintainer Lasse Collin, who was suffering from mental health issues, to accept Jia Tan as a co-maintainer before deploying the final exploit. The identity of Jia Tan remains unknown, but evidence points toward a nation-state actor due to the high patience, complex planning, and expense involved, with some speculation pointing toward APT29 (Russian-state-backed) given time zone anomalies.

Context: The video details a critical security vulnerability discovered in March 2024 affecting the XZ data compression library, a component deeply embedded in the Linux operating system and used extensively in infrastructure like OpenSSH. The narrative contrasts the open-source ethos, founded by Richard Stallman through the Free Software Foundation to promote four freedoms, with the increasing reality of proprietary pressures and state-sponsored cyber operations, all revolving around a single, unpaid volunteer maintainer being compromised.