Hardware Podcasts

Discovering the XZ Backdoor with Andres Freund

Oxide and Friends · 10 Apr 2024 · 1h 37m · Episode 10

What this episode covers

Andres Freund, a PostgreSQL committer and performance expert, explains how he discovered the xz backdoor while benchmarking a performance patch. He detected anomalous CPU usage in sshd caused by injected code in liblzma, which was obfuscated to hide its malicious intent. The investigation revealed a sophisticated, likely state-sponsored attack that manipulated the build system and exploited dynamic linker features to intercept SSH authentication. Freund’s decision to rapidly disclose the vulnerability prevented widespread exploitation of Linux systems worldwide.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Debian, Red Hat, Microsoft
Products
PostgreSQL, xz Utils, liblzma, sshd, systemd
Tools
Valgrind, perf, Intel PT

Related episodes from other shows

Other shows on the same ground, closest first.

  • Hackaday Podcast · 42m

    Ep 265: Behind the Epic SSH Hack, 1980s Cyber Butler, The Story of Season 7

    Editors Elliot Williams and Kristina Panos discuss the xz backdoor incident, detailing the social engineering of maintainer Lasse Collin and the injection of malicious code into the build scripts. They also explore a 1980s 'Master Butler in a Box' voice-activated home automation system, a hack allowing LoRa transmission via an ESP32 without a dedicated radio, and the story of a German hacker who built a descrambler to watch Star Trek Season 7.

    Security & privacyEmbedded firmware
    7 chapters

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

  • Unnamed Reverse Engineering Podcast · 1h 14m

    028 - Everyone Has a Bag of Tricks

    Johnny Xmas (@J0hnnyXm4s), a security architect and reverse engineer, discusses his career path from pharmacy to infosec and details the community effort to reverse engineer TSA master keys. He explains how the keys were leaked via a vendor catalog and Instagram, and how the community used 3D printing and lock disassembly to create working copies, highlighting the security implications for luggage and encryption. Xmas also describes his work at Kasada, a company that defends web infrastructure against automated abuse by detecting client-side automation rather than relying on traditional Web Application Firewalls (WAFs).

    Debugging & failure analysisSecurity & privacy
    9 chapters

  • Embedded.fm · 1h 06m

    519: The Password Is All Zeros

    Mark Omo and James Rowley from Marcus Engineering discuss their research into SECURAM safe locks, revealing that the ProLogic series contains critical security flaws, including a debug port password set to all zeros and codes stored on the external keypad. They detail two exploits, 'code snatch' and 'reset heist,' which allow unauthorized access to safes used for pharmaceuticals and cash, despite UL high-security certification. The conversation covers the ethical and legal challenges of responsible disclosure, including threats from SECURAM's legal team and support from the EFF's Coders' Rights Project.

    Security & privacyDebugging & failure analysis
    8 chapters

  • Unnamed Reverse Engineering Podcast · 1h 31m

    041 - What did you fail at this week?

    Samy Kamkar, co-founder of OpenPath Security, details his NAT Slipstreaming research, a technique that bypasses router protections to expose internal ports by exploiting SIP Application Layer Gateways and IP fragmentation. He discusses his broader security research, including car unlock attacks using NXP chips and creating iridescent chocolate via 3D printing on diffraction gratings. Kamkar also highlights his open-source tools, such as Ghidra for reverse engineering and his custom 'Samytools' suite, while emphasizing a philosophy of learning through failure and exploring non-obvious system inputs like temperature and electromagnetic signals.

    Security & privacyDebugging & failure analysis
    9 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Oxide and Friends. The episode itself belongs to its publisher.