Page 153 - Cyber Defense eMagazine June 2024

The Other Lesson from the XZ Utils Supply-

Chain Attack

By Thomas Segura, Developer Advocate, GitGuardian

"The best supply chain attack execution ever seen" might sound like yet another hyperbole designed to
attract attention, except in the case of the recent XZ Utils case, it was not. Even the most seasoned
professionals were left in awe of the sophistication and damage potential the world nearly escaped.

For those who might have missed it, a few weeks ago, a developer discovered through sheer luck—and
grit—that a malicious backdoor was present in the widely used open-source compression utility XZ Utils.
The backdoor had been intentionally planted in the utility with the intention of gaining virtually unlimited
access to most of the servers powering the global infrastructure.

The open-source community's swift response to the recent security incident was nothing short of
remarkable. Within mere days of the initial report, the attack was not only identified but fully resolved—
all before the compromised version of the tool could spread widely. It's a powerful reminder of the
advantages of open source: had this been closed-source code, who knows if the breach would have even
been detected, let alone fixed so quickly? Hopefully, this major incident will prompt the industry to develop

Cyber Defense eMagazine – June 2024 Edition 153
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.