# How One Hack Nearly Took Down The Internet Source: https://www.youtube.com/watch?v=aoag03mSuXQ Recap page: https://rapidrecap.app/video/aoag03mSuXQ Generated: 2026-02-25T21:08:18.908+00:00 --- ## Quick Overview A sophisticated, years-long supply chain attack targeting the XZ data compression utility, a critical dependency in the Linux ecosystem, nearly succeeded in creating a universal backdoor into millions of internet servers via OpenSSH authentication, but was ultimately foiled by the diligence of an unrelated Microsoft developer, Andres Freund, who noticed subtle performance delays. **Key Points:** - The hacker, operating under the alias Jia Tan, spent approximately two and a half years infiltrating the XZ project, maintained by Lasse Collin, to insert a malicious payload into the XZ Utils 5.6.0 release. - The exploit targeted the Secure Shell (SSH) protocol's RSA authentication step by using an IFUNC resolver and a dynamic audit hook within XZ to overwrite the Global Offset Table (GOT) entry for RSA Decrypt, creating a backdoor triggered by a secret key. - The attack was ultimately detected because the complex obfuscation and encryption required to hide the backdoor introduced consistent slowdowns of about 400 to 500 milliseconds, which Andres Freund noticed while testing Debian. - Linux, powered by the combination of GNU utilities and the Linux kernel, runs virtually all of the top 500 supercomputers, powers Android, and manages the majority of internet servers, underscoring the massive scope of the potential compromise. - The XZ attacker used sophisticated social engineering, pressuring the original maintainer Lasse Collin, who was suffering from mental health issues, to accept Jia Tan as a co-maintainer before deploying the final exploit. - The identity of Jia Tan remains unknown, but evidence points toward a nation-state actor due to the high patience, complex planning, and expense involved, with some speculation pointing toward APT29 (Russian-state-backed) given time zone anomalies. **Context:** The video details a critical security vulnerability discovered in March 2024 affecting the XZ data compression library, a component deeply embedded in the Linux operating system and used extensively in infrastructure like OpenSSH. The narrative contrasts the open-source ethos, founded by Richard Stallman through the Free Software Foundation to promote four freedoms, with the increasing reality of proprietary pressures and state-sponsored cyber operations, all revolving around a single, unpaid volunteer maintainer being compromised. ## Detailed Analysis The near catastrophic event centered on the XZ compression tool, maintained by Lasse Collin, which became a critical dependency for OpenSSH, the maintenance backbone for secure remote logins across the internet. The attacker, Jia Tan, meticulously inserted a backdoor over two and a half years, utilizing binary test blobs within XZ as a Trojan horse to bypass standard source code inspection. The exploit leveraged advanced linker manipulation techniques, specifically using an IFUNC resolver to trigger a dynamic audit hook at the precise 'Goldilocks zone' moment—after the legitimate RSA Decrypt address was loaded into the GOT but before the table was marked read-only—allowing the payload to overwrite the address and create a secret backdoor into SSH authentication, controllable only by a specific master key known to Jia. ### Origins of Open Source Ideology - Richard Stallman founded the Free Software Foundation in 1985 after encountering non-disclosure agreements, promoting freedom to run, study, change, and share software, leading to the GNU Project and eventually Linux when combined with Linus Torvalds' kernel. ### The Critical Dependency - Linux systems rely on thousands of open-source tools; XZ, an LZMA compression tool developed by Lasse Collin, became essential for efficient data transfer and was integrated as a dependency into OpenSSH, the standard for remote secure logins. ### The Supply Chain Attack Execution - Jia Tan, posing as a helpful contributor, gained trust and maintenance rights, then hid a payload within XZ test files, used an IFUNC resolver to intercept the GOT entry for RSA Decrypt, and implemented custom encryption to ensure only his master key granted access to the backdoor. ### Detection and Unraveling - Andres Freund, a Microsoft developer testing an unstable Debian release, noticed subtle, consistent connection slowdowns (400-500ms) caused by the payload's complex obfuscation, leading him to trace the issue back to XZ and report it publicly. ### The Aftermath and Attribution - Red Hat quickly rolled back affected Fedora versions; while the mainstream news coverage was muted, experts suggest the attack's patience and scale imply nation-state involvement, possibly Russian (APT29) or Chinese actors, though Jia Tan vanished upon discovery. ### Implications for Open Source Security - The incident highlights Linus's Law vulnerability where an entire ecosystem rests on an unpaid volunteer; while some argue closed source is no better, others see this as a warning that attackers are becoming highly sophisticated in exploiting subtle supply chain weaknesses.