Xz Utils Backdoor

Posted15 days agoActive13 days ago

ctrlmeta

7 points

1 comments

en.wikipedia.orgSecuritystory

heatednegative

Debate

80/100

Code VulnerabilitiesOpen-Source SoftwareLinux

Key topics

Code Vulnerabilities

Open-Source Software

Linux

Discussion Activity

Moderate engagement

First comment

15m

Peak period

0-2h

Avg / period

3.5

Key moments

01Story posted
Dec 19, 2025 at 9:19 AM EST
15 days ago
Step 01
02First comment
Dec 19, 2025 at 9:34 AM EST
15m after posting
Step 02
03Peak activity
10 comments in 0-2h
Hottest window of the conversation
Step 03
04Latest activity
Dec 20, 2025 at 11:37 AM EST
13 days ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (1 comments)

Showing 21 comments

jqpabc123

15 days ago

2 replies

This really illustrates a broad security issue in open source development and methodology.

Who vets contributors and maintainers?

Answer: Unknown in many (if not most) cases.

yjftsjthsd-h

14 days ago

1 reply

That's not unique to open source or open development.

jqpabc123

14 days ago

1 reply

Anonymity is the unique aspect of open source that opens the door for malicious activity without consequences.

yjftsjthsd-h

14 days ago

1 reply

Well, no; there's plenty of proprietary software without a human name attached (let alone a name that you could possibly verify is real), and there are FOSS projects that only take contributions from people who have identified themselves in some capacity.

jqpabc123

14 days ago

2 replies

Well, no; there's plenty of proprietary software without a human name

A human name is not required for legal accountability.

A human name is required in order to be legally employed.

None of this applies to open source in most cases.

yjftsjthsd-h

14 days ago

1 reply

My point was more that there's plenty of software that is not FOSS and is also not published by an identifiable legal entity, traditionally appearing as freeware/shareware for Windows/macOS. And even if there does appear to be some sort of legal entity (human or company), how many people are going to check that a company even exists on paper before installing the random .exe from its website?

jqpabc123

14 days ago

1 reply

My point was more that there's plenty of software that is not FOSS and is also not published by an identifiable legal entity

Yes, installing software of "unknown origin" is a gaping security hole --- whether FOSS or not.

The fact that some people do dumb stuff does not negate the fact that a lot (if not most) FOSS fits in this category.

yjftsjthsd-h

13 days ago

Okay, but your original claim was:

> Anonymity is the unique aspect of open source that opens the door for malicious activity without consequences.

If you'd like to amend to something like

> Anonymity, which is in play for most FOSS and a decent chunk of proprietary software, opens the door for malicious activity without consequences.

Then I wouldn't strongly disagree. I'm still a little skeptical, because people keep finding backdoors in non-FOSS software/firmware, of course, but it'd at least be a defensible claim. I'm only really objecting to the notion that this is unique to FOSS.

Anonbrit

14 days ago

1 reply

There's tons of utter garbage commercial software. There's commercial software with intentionally built in backdoors and information stealing. Most of it gets zero accountability, nor do the sites that distribute it, nor the ad networks that find viewers for it.

Just like there's basically no reputational harm anymore for leaking all your users details for most leaks

jqpabc123

14 days ago

1 reply

https://en.wikipedia.org/wiki/Whataboutism

yjftsjthsd-h

13 days ago

No, it's not whataboutism. You claimed that this was a problem unique to open source. Pointing out that the same results manifest in non-FOSS software isn't whataboutism, it's a direct contradiction of your claim.

nwellnhof

14 days ago

1 reply

Contributors and their submissions are vetted by maintainers. New maintainers are ideally vetted by existing maintainers. This can obviously break down in undermaintained projects.

jqpabc123

14 days ago

New maintainers are ideally vetted by existing maintainers

This ideal obviously did not happen here.

And there are no consequences for those who fail to do so.

LunaSea

15 days ago

1 reply

> The Debian development team declined to remove the affected images, stating that they were development builds that should not be used on real systems in place of newer, clean container versions.

Classic Debian security management

BrouteMinou

14 days ago

1 reply

Not that I approve the Debian decision here, but calling it "classic" seems a bit of a stretch?

Do you have many more examples to call that a "classic" Debian security behaviour?

LunaSea

14 days ago

Like this: https://jblevins.org/log/ssh-vulnkey ?

jmclnx

14 days ago

1 reply

>While xz is commonly present in most Linux distributions,

Not Slackware since Slackware does not patch ssh or xz or many other utilities. Plus it does not use systemd. From what I remember that patch was put in to give systemd extra functionality.

NekkoDroid

14 days ago

The xz attach happened cuz systemd's library dynamically linked against xz for compression of various tools in systemd and a downstream patch for openssh (IIRC) was used to link against libsystemd to use some founctions for the sd-notify protocol.

This wasn't exactly necessary since the protocol has been stable for external use for ages (since its inception IIRC) and is relatively trivial to implement.

Since the attack happened openssh gained native support for the sd-notify protocol, the sd-notify man page has an example implementation that is freely usable and libsystemd now only loads xz (and most of its other libraries) when explicitly requested by one of the tools via `dlopen`.

pogopop77

14 days ago

1 reply

Given this was backdoor was likely funded by a nation-state actor and very carefully obfuscated, the fact that it was discovered within a month and never rolled out to production releases, shows that the open source process mostly worked. Not saying it couldn't be better.

mingus88

14 days ago

I kinda disagree. This was luck. A dev on an unrelated project happened upon it and was diligent enough to dig in. A single change to any number of variables would have meant disaster.

I worked at a company that got red teamed. The pen testers were inside the network and were only found by a random employee who happened to be running little snitch and got a weird pop-up

Nobody celebrated the fact that the intrusion was detected. It was pure luck, too late, and the entire infosec leadership was fired as a result.

Like this xv issue, none of the usual systems meant to detect this attack seemed to work, and it was only due to the diligence of a single person unrelated to the project was it not a complete show.

flykespice

14 days ago

The behemoth that is autotools mostly helped to conceal the backdoor (and contributed to the payload)

It's an old legacy technology that needs to die out from all forms of distributions (looking at you GNU)

View full discussion on Hacker News

ID: 46326120Type: storyLast synced: 12/19/2025, 2:45:41 PM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.

Open link View on HN