# Discovering the XZ Backdoor with Andres Freund

- Show: [Oxide and Friends](https://hardwarepodcasts.com/podcast/oxide-and-friends)
- Published: 2024-04-10
- Length: 1h 37m
- Episode: 10
- Page: https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund
- Listen: https://share.transistor.fm/s/e2538f7d

## Summary

Andres Freund, a PostgreSQL committer and performance expert, explains how he discovered the xz backdoor while benchmarking a performance patch. He detected anomalous CPU usage in sshd caused by injected code in liblzma, which was obfuscated to hide its malicious intent. The investigation revealed a sophisticated, likely state-sponsored attack that manipulated the build system and exploited dynamic linker features to intercept SSH authentication. Freund’s decision to rapidly disclose the vulnerability prevented widespread exploitation of Linux systems worldwide.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=0) Introduction: Critique of New York Times Coverage
- [4:40](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=280) Andres Freund's Background in PostgreSQL Performance
- [11:15](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=675) Detecting Anomalous CPU Usage in SSHD
- [18:37](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=1117) Investigating liblzma and the Backdoor Injection
- [32:26](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=1946) Uncovering the Build System Manipulation
- [47:47](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=2867) Identifying the Malicious Maintainer and Disclosure
- [1:00:19](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=3619) Public Reaction and Media Coverage
- [1:17:04](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=4624) The Role of Luck and Timing in Discovery
- [1:25:50](https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund#t=5150) Impact on Engineering Practices and Tooling

## Topics

- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Careers & education](https://hardwarepodcasts.com/topic/engineering-careers-and-education)

## Most relevant to

early-stage companies

## Mentioned

- PostgreSQL (product)
- xz Utils (product)
- liblzma (product)
- sshd (product)
- Valgrind (tool)
- perf (tool)
- Intel PT (tool)
- systemd (product)
- Debian (company)
- Red Hat (company)
- Microsoft (company)

## Related episodes from other shows

- [Ep 265: Behind the Epic SSH Hack, 1980s Cyber Butler, The Story of Season 7](https://hardwarepodcasts.com/podcast/hackaday-podcast/2024-04-05-ep-265-behind-the-epic-ssh-hack-1980s-cyber-butler-the-story-of-season-7) (Hackaday Podcast)
- [Finding Hardware Flaws with Laura Abbott](https://hardwarepodcasts.com/podcast/the-amp-hour/2022-05-23-finding-hardware-flaws-with-laura-abbott) (The Amp Hour)
- [028 - Everyone Has a Bag of Tricks](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2019-09-15-028-everyone-has-a-bag-of-tricks) (Unnamed Reverse Engineering Podcast)
- [519: The Password Is All Zeros](https://hardwarepodcasts.com/podcast/embedded-fm/2026-01-23-519-the-password-is-all-zeros) (Embedded.fm)
- [041 - What did you fail at this week?](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-11-07-041-what-did-you-fail-at-this-week) (Unnamed Reverse Engineering Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/oxide-and-friends/2024-04-10-discovering-the-xz-backdoor-with-andres-freund. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Oxide and Friends.