Microsoft employee and
PostgreSQL developer Andres Freund reported the backdoor after investigating a
performance regression in
Debian Sid. Freund noticed that
SSH connections were generating an unexpectedly high amount of CPU usage as well as causing errors in
Valgrind, He reported his finding to
Openwall Project's open source security mailing list, which brought it to the attention of various software vendors. The attacker made efforts to
obfuscate the code, as the backdoor consists of multiple stages that act together. Once the compromised version is incorporated into the operating system, it alters the behavior of
OpenSSH's SSH server daemon by abusing the
systemd library, allowing the attacker to gain administrator access. According to the analysis by
Red Hat, the backdoor can "enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely". A subsequent investigation found that the campaign to insert the backdoor into the
XZ Utils project was a culmination of over two years of effort, between November 2021 and February 2024, by a user going by the name
Jia Tan and the nickname JiaT75 to gain access to a position of trust within the project. After a period of pressure on the founder and head maintainer to hand over the control of the project via apparent
sock puppetry,
Jia Tan gained the position of co-maintainer of
XZ Utils and was able to sign off on version 5.6.0, which introduced the backdoor, and version 5.6.1, which patched some anomalous behavior that could have been apparent during software testing of the operating system. Some of the suspected sock puppetry pseudonyms include accounts with usernames like
Jigar Kumar,
krygorin4545, and
misoeater91. It is suspected that the names
Jia Tan, as well as the supposed code author
Hans Jansen (for versions 5.6.0 and 5.6.1), are pseudonyms chosen by the participants of the campaign. Neither have any sort of visible public presence in software development beyond the short few years of the campaign. The backdoor was notable for its level of sophistication and for the fact that the perpetrator practiced a high level of
operational security for a long period of time while working to attain a position of trust. American security researcher
Dave Aitel has suggested that it fits the pattern attributable to
APT29, an
advanced persistent threat actor believed to be working on behalf of the
Russian
Foreign Intelligence Service (SVR). Journalist Thomas Claburn suggested that it could be any state actor or a non-state actor with considerable resources. ==Mechanism==