XZ Utils Backdoor: What it is and What it means for the FOSS Community?
This talk will be a deep-dive on CVE-2024-3094 -- a vulnerability (backdoor)
discovered in the XZ compression program in late March 2024. This vulnerability
was assigned the highest score of 10 on the Common Vulnerability Scoring System
(CVSS). This was a sophisticated exploit relying on various compiler and linker
features, obfuscated code, and most importantly social engineering to gain the
trust of developers to get commit access to the repositories.
During this talk, I will discuss:
1. the technical aspects of the exploit - how it was hidden, and the
various techniques used
2. what does the discovery of this exploit, and the means used to implant
the same mean for the broader FOSS ecosystem and community
3. how do we build continued trust in the Software Supply Chain?
Finally, I will also reflect on the broader social aspects of the FOSS
community, especially the trust mechanisms.
Sachin Garg
