Preventing One of The Largest Supply-Chain Attacks in History
Provides an insider breakdown of detecting and neutralizing the historic XZ Utils backdoor (CVE-2024-3094) before widespread Linux distribution deployment.
Summary
The XZ Utils Supply-Chain Backdoor (CVE-2024-3094)
The XZ Utils compromise represents one of the most sophisticated multi-year open-source supply chain attacks in history, embedding a covert backdoor into upstream liblzma compression code.
Deconstructing the Multi-Stage Injection Mechanism
Maksim Shudrak provides a detailed technical breakdown of how the backdoor was concealed across obfuscated test files, injected during M4 build script execution, and hooked into OpenSSH authentication routines via IFUNC symbols.
Discovery, Reverse Engineering, and Neutralization
The talk chronicles the serendipitous discovery of anomalous CPU latency, rapid collaborative reverse engineering across the security community, and swift upstream neutralization before public releases reached stable Linux distributions.
Transforming Open-Source Supply Chain Security
Preventing future open-source supply chain compromises requires automated build artifact verification, reproducible builds, maintainer transparency, and enhanced funding for critical open-source infrastructure.
Related talks
Main Stage·38 min
Maksim Shudrak
Provides an in-depth breakdown of discovering and neutralizing the historic XZ Utils backdoor (CVE-2024-3094) before stable Linux distribution deployment.
Community Stage·53 min
Tom Berek · Farid Zakaria · D Baker
Explores how Nix and NixOS provide reproducible software builds, declarative dependency management, and SBOM traceability across homelabs and enterprise environments.
Community Stage·53 min
Tom Berek · Farid Zakaria
Tom Berek and Farid Zakaria dive into reproducible builds, Nixpkgs dependency isolation, and SBOM verification using Nix and NixOS.