Russ Cox • 4/2/2024

Timeline of the xz open source attack

This article provides a chronological breakdown of the sophisticated social engineering attack on the xz open-source compression library. It details how an attacker, under the pseudonym "Jia Tan," gained trust and commit access over two years to insert a hidden backdoor into liblzma, affecting OpenSSH on several Linux distributions. The post analyzes the attack's progression from 2021 to its discovery in 2024, marking it as a significant watershed moment for open-source software supply chain security.

0 comments

#open source #ssh #Supply Chain Security