All links in the page were valid 2024-03-30 unless stated otherwise.
This page contains some material related to the XZ attack that went public 2024-03-29 (original email, and a tarball copy here).
This was a quite sophisticated attack and all involved assets have to be publicly available, for historical and educational purposes. So here they are. No analysis done, just raw material.
git.tar.bz2 contains a copy of https://github.com/tukaani-project/xz [dead link as of 2024-03-30]
Actually it's a copy of https://rocketgit.com/user/xz-mirror/xz. I didn't clone the original myself, I forgot, and the next day it was removed by github. I compared with https://git.tukaani.org/?p=xz.git;a=summary which is the original repository and content seems equal, minor the last funny commit with title "Docs: Simplify SECURITY.md." which is only present on the github repository and some "index" numbers that are different in the git log history.
To use git.tar.bz2, do:
mkdir /tmp/xz cd /tmp/xz [get git.tar.bz2, put it in /tmp/xz] tar xf git.tar.bz2 git reset --hard
To be exhaustive, here is a copy of the .git directory of https://git.tukaani.org/?p=xz.git;a=summary as downloaded 2024-03-29: git-orig.tar.bz2. Use it same way as git.tar.bz2.
Note: 2024-03-30: https://git.tukaani.org/?p=xz.git;a=summary is active and will be different from what I saw (which was commit 0b99783d63f27606936bb79a16c52d0d70c0b56f).
The malicious m4/build-to-host.m4 is not present in the git repository, only in source tarballs as found on the github place (which is dead as of 2024-03-30).
Here are the tarballs. I downloaded them 2024-03-29 from github, when they were still available.
The original report mentions "the upstream source of build-to-host", which is not defined further. From what I understand, this "upstream source" is gnulib, but I'm not sure (but this email seems to confirm my understanding).
Here is a diff between build-to-host.m4 as found in the malicious tarballs (both tarballs provide the same version of this file) and the version found in gnulib (version from git commit 4f63c2b6a7ba71c6371e1ab61f13127ede06d51a): build-to-host-diff.txt.
I extracted the payload, liblzma_la-crc64-fast.o, for both versions:
Nice analysis of the script-part obfuscation by Gynvael Coldwind.
A set of tools were released by Anthony Weems to explore the xz backdoor, including a honeypot and a program to exploit the vulnerability (will not work on deployed backdoors, if any, because as of 2023-04-01 no one knows the private key of the attacker(s)).
This email is a good start to understand the payload.
Contact: see this
Created: 2024-03-30
Last update (more or less accurate): 2024-04-17