1 of 15

Cyber Academy

Spring 2024 - Week 7

https://l.acmcyber.com/s24-w7-acad

2 of 15

📣 Announcements

🧪 Cyber Lab: AI Privacy by Rathul

This Wednesday 6-8pm @ Boelter 4760

💻 TownHall: TBD
⛳️PBR: R3CTF

This Saturday
Meet for lunch 12pm @ De Neve Plaza
CTF is 1-6pm @ Boelter Penthouse (8500)

👾 Cyber X Studio Social:

Pizza, snacks, and video/board games!
Friday, May 31 (Week 9) in Boelter 4760

🏀Cyber Basketball: Friday 6-8pm @ Hitch courts

3 of 15

XZ Backdoor

4 of 15

What is XZ Utils?

Compression library
Not native to linux (gzip), but better compression

Worse performance which is why it’s not standard.

Major Linux distributions ship with XZ Utils, including Debian, Ubuntu, and Fedora.

Some distributions contained the backdoor!

5 of 15

Discovery Timeline

January 7, 2023 Jia Tan becomes trusted maintainer alongside creator Lasse Collin
February 23, 2024 Jia Tan merges commits that introduce backdoor
March 25, 2024 Jia Tan + proxies push for inclusion into major repos
March 29, 2024, Andres Freund reports backdoor to maintainers and publicly after microbenchmarking oddities

6 of 15

Backdoor – Technical, Stage 0

A corrupt file in the tests folder is run through tr which makes it a valid xz file.

tests/files/bad-3-corrupt_lzma2.xz
tr "\t⎵\-_" "⎵\t_\-"

⎵ denotes a space

Binary is then extracted, and it’s Stage 1 Script

7 of 15

Backdoor – Technical, Stage 1

export i="((head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) … && (head -c +1024 >/dev/null) && head -c +939)";

export i => i is a function
(head -c +1024 >/dev/null)=>read 1024 bytes into dev/null

The bytes are discarded, but the head is moved forward by 1024

head -c +2048=>read 2048 bytes from head into stdout

(xz -dc $srcdir/tests/files/good-large_compressed.lzma=>decompress
eval $i=> run our exported i function
tail -c +31233=>remove first 31233 bytes (it’s the backdoor binary for Stage 2)
More deobfuscation (substitution cipher), then decompress and run it

8 of 15

Backdoor – Technical, Stage 2

The previously thrown out backdoor binary is now extracted, deobfuscated, and run

See link in speaker notes if interested in deobfuscation details, it’s a lot

An extension system is added to allow for forwards compatibility

Any file that contains certain signatures is also deobfuscated, but not run.
No such files were ever added

9 of 15

Backdoor – Social, Stage 1

In 2021, a user by the name of Jia Tan makes a github account
2022, two (likely proxy) users begin harassing maintainer of XZ to add another maintainer

Immediately after this, Jia Tan makes legitimate contributions to project

10 of 15

Backdoor – Social, Stage 2

Jan 7, 2023 - Jia Tan merges first commit, so is now trusted maintainer
Jia Tan changes bug contact for fuzzing from Lasse Collin to himself

In 2024, changes url of project to his own

2024 - More proxy users start heavily pushing for inclusion of new version of XZ

Few days later, back door is uncovered

11 of 15

Who is Jia Tan?

Realistically, no way to know
Some OSINT work was done, but nothing definitive is really known
Likely nation-state actor given the years of work that went into this
Likely Chinese based on commit times/timezones

Mostly guesswork, and some counter arguments have been made

12 of 15

Questions of OSS security/trust

OSS generally considered safer because source code is publicly available to be audited
Maintainers are tired and stressed, very little benefit for a lot of trouble and work
Thankfully someone caught it quickly, but it was a lot of coincides.
How many haven’t been caught?

13 of 15

Questions?

14 of 15

☑️Feedback Form

https://l.acmcyber.com/feedback

15 of 15

💻 Hacking Time!

Social Engineering Prompt:

What is your favorite game?

Groups:

Crypto:

Hashing

Rev/Pwn:

Format String

Web:

JSON Web Tokens (JWT)