Understanding XZ Backdoors

Beginners guide to Cybersecurity threats.

How was it discovered ?

On 29 March 2024, Microsoft developer “Andres Freund” reported a malicious backdoor in the Linux utility in versions 5.6.0 and 5.6.1 released in February 2024. This backdoor gives an attacker who possesses a specific Ed448 private key remote code execution capabilities on the affected Linux systems. This issue has been given a CVSS score of 10.0 which is the highest score possible. Freund detected high cpu usage and searched for memory leaks.

What is XZ utils?

xz Utils provides lossless data compression on all Unix-like operating systems, including Linux. It provides critical functions for compressing and decompressing data during all kinds of operations. It also supports legacy file formats like .lzma, making this component even more crucial.

How this backdoor works?

1. Freund reported that there is some unnecessary code in the testing file of xz tool that outputs a inject.txt file. Those test files were not even used for testing purpose in the xz version: “5.6.0”. The backdoor was further then adjusted to not show detection in memory leaking in xz version: “5.6.1”.
2. There was some specificity to who this backdoor is targeting :

• Linux systems with x86_64 architecture.
• Building with the gcc (GNU C Compiler) and gnu-linker (GNU linker is a link editor used to connect multiple files into a single object file (Example: .exe, library) )
• Linux system should be based on .deb (Debian) or .rpm (Red Hat package manager) build.

3. Some precautionary measures were taken to prevent the detection of backdoor so it doesn’t start when system is logged but only starts when certain criteria is met. These are some of the requirements:

• “TERM” should not be set as environment variable in any shell. (Global variable for the system’s default terminal.)
• “LANG” should be set in the system. (Global Variable for system’s language.

4. In the end it takes RSA public decrypt key and when you login into the remote server using ssh. BOOM! injects it’s own code and gets your encryption key allowing malicious remote access to that server and by server I mean your desktop linux system can also be accessed as a remote server. Basically linux systems are a replica of the servers online when accessed with internet.

Conclusion:

This affects openssh (Used for remote usage of servers using ssh protocols.) not directly but some of the distros like Debian uses to support systemd (an init system that provides system and process manager (aka user manager and apps manager)). There are some preventing measures that can be taken to avoid this (like: settings up a firewall for ssh connections). All the credit goes to Andres Freund for posting about this backdoor in the Openwall OSS (Open Source security) mailing list: https://www.openwall.com/lists/oss-security/2024/03/29/4 .