The XZ back door: a two-year con caught by accident

The story

XZ Utils is small, free software that compresses files. It is part of most Linux systems, which run a large share of the world’s servers. For years it was maintained mostly by one volunteer.

Starting around 2021, someone using the name “Jia Tan” began contributing helpful changes. Other accounts, probably fake, pressured the maintainer about slow progress. Over time, Jia Tan earned the maintainer’s trust and became a co-maintainer.

In February 2024, Jia Tan added a cleverly hidden back door. On affected systems it would have let whoever held a secret key run commands remotely through SSH, the tool used to manage servers from a distance.

On March 29, 2024, Andres Freund, a software engineer at Microsoft, noticed that signing in to a test system was taking about half a second longer than it should. He investigated and found the back door. The affected versions had only reached test editions of Linux, not the main releases most businesses run, and were withdrawn.

Why it mattered

One security expert said it could have been the most widespread and effective back door ever planted in any software product. It raised hard questions about critical software that depends on unpaid volunteers. Open-source foundations warned maintainers to watch for friendly but persistent strangers seeking control of their projects.

The lesson today

This was patient, careful and almost worked. It was found because one person took the time to look into something odd. Unusual behavior is worth reporting, even when it seems small.