{"product_id":"xz-utils-backdoor-shirt-cve-2024-3094-graphic-tee-unhacked","title":"EXHIBIT 0015 — XZ UTILS","description":"\u003cp\u003eIt was caught because someone was benchmarking a database and the logins felt slow.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe backdoor in xz Utils took about three years to install, and almost none of that was code. It was commits, and patience, and a second account applying public pressure on an exhausted volunteer maintainer until a new co-maintainer was trusted with releases.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe payload never appeared in the git repository. It lived in binary files that looked like compression test fixtures, assembled during the build by a modified macro that only ran when the release tarball was used. Anyone auditing the source on GitHub would have found nothing, because there was nothing there.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe target was sshd, reached indirectly: many distributions patch it to link against systemd, which links against liblzma, which is xz. The backdoor hooked the RSA verification path.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eAndres Freund, a PostgreSQL developer at Microsoft, noticed that failed SSH logins on a test machine were taking about half a second longer than they should, and that Valgrind was complaining. He pulled the thread on 29 March 2024.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eVersions 5.6.0 and 5.6.1 had reached Debian sid, Fedora Rawhide, openSUSE Tumbleweed and Kali. They had not reached a stable enterprise release.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eNo scanner found it. No review found it. Half a second of latency found it.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eEXHIBIT 0015 \/ XZ UTILS \/ 2024\u003c\/p\u003e","brand":"Printify","offers":[{"title":"Light Blue \/ S","offer_id":54505747382556,"sku":"18629355379995872525","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ S","offer_id":54505747415324,"sku":"90592992304768694391","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ S","offer_id":54505747448092,"sku":"17217569655097565615","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ S","offer_id":54505747480860,"sku":"11355879145861575453","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ S","offer_id":54505747513628,"sku":"30486619758056160423","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ S","offer_id":54505747546396,"sku":"17773036684810800852","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ M","offer_id":54505747579164,"sku":"95064944835910574967","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ M","offer_id":54505747611932,"sku":"26602151673506463718","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ M","offer_id":54505747644700,"sku":"27619965724834498930","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ M","offer_id":54505747677468,"sku":"68285494675930024098","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ M","offer_id":54505747710236,"sku":"21019944455640501640","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ M","offer_id":54505747743004,"sku":"27165526677846919447","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ L","offer_id":54505747775772,"sku":"15489046275089865841","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ L","offer_id":54505747808540,"sku":"28225707445822763073","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ L","offer_id":54505747841308,"sku":"91133669319977788396","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ L","offer_id":54505747874076,"sku":"17233434708121959596","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ L","offer_id":54505747906844,"sku":"24796318280307542714","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ L","offer_id":54505747939612,"sku":"24399192482336616404","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ XL","offer_id":54505747972380,"sku":"16299577387765360489","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ XL","offer_id":54505748005148,"sku":"17446754333033004347","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ XL","offer_id":54505748037916,"sku":"14652122333479087177","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ XL","offer_id":54505748070684,"sku":"24190654777623976349","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ XL","offer_id":54505748103452,"sku":"16652976563697637881","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ XL","offer_id":54505748136220,"sku":"22495991909840392658","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ 2XL","offer_id":54505748168988,"sku":"19058765272399910018","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ 2XL","offer_id":54505748201756,"sku":"13332802399405993086","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ 2XL","offer_id":54505748234524,"sku":"24506532783361750899","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ 2XL","offer_id":54505748267292,"sku":"46221658068962825076","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ 2XL","offer_id":54505748300060,"sku":"17149346771538045032","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ 2XL","offer_id":54505748332828,"sku":"32805002074439519405","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ 3XL","offer_id":54505748365596,"sku":"28603380635301528251","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ 3XL","offer_id":54505748398364,"sku":"11527345414210323482","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ 3XL","offer_id":54505748431132,"sku":"31657573547595082953","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ 3XL","offer_id":54505748463900,"sku":"16485521350170712444","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ 3XL","offer_id":54505748496668,"sku":"22152498082808768914","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ 3XL","offer_id":54505748529436,"sku":"25409324711352965489","price":24.99,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0961\/8184\/6300\/files\/4791896756240511215_2048.jpg?v=1788373216","url":"https:\/\/unhacked.shop\/products\/xz-utils-backdoor-shirt-cve-2024-3094-graphic-tee-unhacked","provider":"Unhacked","version":"1.0","type":"link"}