Backdoor in xz/liblzma: SSH Server Compromise via Supply Chain

Backdoor in xz/liblzma: Supply Chain Under Attack

Just when we thought open-source was safe, another incident reminds us: trust, but verify. A backdoor has been discovered in the xz/liblzma library, widely used for data compression, that allows an attacker to remotely compromise an SSH server. Yes, the very SSH you probably use to log into your servers.

What Happened?

Security researchers found malicious code in the upstream xz/liblzma repository. The backdoor was introduced through the automated build mechanism and distributed alongside legitimate versions of the library. Under certain conditions, an attacker could gain full control over the SSH server by exploiting the vulnerability in liblzma.

Who Is at Risk?

All systems using vulnerable versions of xz/liblzma are at risk. This is especially critical for Linux distributions where the library is part of the base set. If you updated your system between February and March 2024, you should check the version.

What to Do?

1. Update xz/liblzma to the latest patched version.
2. Check SSH logs for suspicious activity.
3. Review your supply chain policy — even trusted components can be compromised.

METABYTE Studio Comment: This incident is a great reason to think about supply chain security. We always recommend clients implement automated dependency scanning and regularly audit the libraries they use. Your code may be perfect, but if one dependency is 'booby-trapped,' the whole fortress falls.