Started by Samuel Okafor (@samokafor) ·
the xz backdoor was caught because SSH logins were 500ms slower
A years-long social engineering campaign to become a trusted maintainer of a compression library, then a backdoor hidden in test files. Found by a Microsoft engineer benchmarking Postgres who noticed sshd using too much CPU.
5 sources · 1h 3m down the hole
How I got here
- Started with
- “xz backdoor explained”
- Ended at
- “xz backdoor”
The Trail
- “xz backdoor explained” (google.com)
- XZ Utils backdoor (en.wikipedia.org)
- XZ Utils (en.wikipedia.org)
- Supply chain attack (en.wikipedia.org)
- “xz backdoor” (hn.algolia.com)
What I came away with
Open source security currently depends on overworked solo maintainers and occasionally one person noticing a half-second delay.
Keep going
- Stockholm's metro is a 110 km art gallery · Samuel Okafor · 4 sources
- desire paths · Samuel Okafor · 4 sources
- speedrunners reprogram Super Mario World with a controller · Ethan Cole · 6 sources
- Facebook took itself off the internet in 2021 · Ben Adler · 4 sources