(Credit: Getty Images/fatmawati lauda)
The Linux community narrowly avoided a security disaster after a lone software engineer accidentally uncovered a backdoor that was about to be added to major Linux operating systems.
Last Friday, Microsoft software engineer Andres Freund noticed the backdoor in XZ Utils, an open-source set of data-compression tools widely used across Linux and Unix-like operating systems.
Freund said he discovered the backdoor by chance while benchmarking a Linux-based Debian installation. During the tests, he realized that XZ Utils was triggering high CPU consumption with SSH processes, the security protocol for logging into a remote server. This led him to realize that a component within XZ Utils can inject unauthorized code into a Linux installation to spy on the user’s computer and execute additional malicious code, according to security researchers.
In response, Linux OS providers Red Hat and Debian have issued security advisories warning users about the threat. But in some good news, the stable versions of Red Hat Linux and Debian never incorporated the malicious XZ Utils components. Instead, the backdoor only made its way to the Red Hat Fedora 40 beta and Fedora Rawhide, along with experimental distributions for Debian. Any affected users should immediately downgrade their XZ Utils version.
"Specifically, this code is present in versions 5.6.0 and 5.6.1 of the (XZ) libraries," Red Hat says.
Meanwhile, US cyber authorities are urging affected users to "downgrade XZ Utils to an uncompromised version—such as XZ Utils 5.4.6 Stable" and hunt for any malicious activity.
The news is once again raising alarm bells about the need to secure open-source software, which is often maintained through volunteer contributors. In this case, the backdoor has been traced to a mysterious user called Jia Tan or JiaT75, who submitted the malicious changes to XZ Utils. Interestingly, Jia Tan seems to have patiently spent the last three years building up his credibility to become a trusted contributor to XZ Utils before adding the malicious code.
Cryptography expert Filippo Valsorda adds: “This might be the best executed supply chain attack we've seen described in the open, and it's a nightmare scenario: malicious, competent, authorized upstream in a widely used library. Looks like this got caught by chance. Wonder how long it would have taken otherwise."