Cyber Horror: The XZ Utils Backdoor Case (CVE-2024-

When the "back door" is secretly installed in the backbone of the Internet,

Imagine you locked a house with the strongest key in the world... but the "locksmith" you trust the most, sneaked a small secret hole in the back of the house without anyone knowing. This is the true story that almost destroyed the security system of the Internet world forever. - The XZ Utils Backdoor Case (CVE-2024-3094)

Lasse Collin: The Tired Single Caretaker

Before the incident, the XZ Utils program was overseen by Lasse Collin (Larhzu) for more than 15 years (since 2009) as a single volunteer. There was no compensation. He had to bear everything. Amid mental health problems and stress, he accumulated so much that activity in the project declined.

This is a weakness that "someone" sees and uses as a perfect infiltration channel.

Jia Tan (JiaT75): The Devil in the Saint Stain, and a 2-Year Plot

November 2021, a mysterious character named Jia Tan appeared. He did not hack the model in the movie, but used Social Engineering calmly and cruelly:

• Create trust - Send good code to help with small tasks.

• Create pressure - Use multiple sockpuppet accounts to send Lasse Collin pressure emails saying "Update is too slow" or "If you can't do it, give it to someone else."

• Seize Power - 2022, the weakest Lasse Collin, accepts Jia Tan as co-maintainer By 2023, Jia Tan controls almost all of the projects, and signs a backdoor-mounted version of tarball himself.

What Happened: Every Open Ghost Shackle (Technical Backdoor Mechanism)

The latter gained full-handed power, Jia Tan secretly embedded the backdoor into versions 5.6.0 (February 24, 2024) and 5.6.1 (March 9, 2024). This code is so complex that "looking with the naked eye can't see."

Details the techniques that make it the scariest:

• Backdoor is only hidden in release tarball (not in Git repository), thus passing the general developer review.

• Use 2 test files that are binary (bad-3-corrupt _ lzma2.xz and good-large _ compresed.lzma), which look like normal test files.

• The build-to-host.m4 file is modified (only available in tarball) to run multi-layer scripts: decode → crack file → insert shared object named liblzma _ la-crc64-fast.o

• Use the glibc IFUNC mechanism, replacing the RSA _ public _ decrypt function of OpenSSL.

• Relying on a "third-party patch" that makes sshd load libsystemd → load liblzma automatically

• Results: When a hacker sends a unique Ed448 key → a remote code execution (RCE) can be ordered before authentication without the system detecting it.

The 5.6.1 version also improves to hide the notch and add "modularity" (SentinelOne believes this is to prepare an additional backdoor implant in the future).

Turning point: A slowness of only 0.5 seconds that changed the world.

This almost became a global tragedy, if not for Andres Freund (Microsoft engineer).

While testing Debian Sid, he found:

• SSH login slows down 500 milliseconds (0.5 seconds)

• CPU usage slightly higher + Valgrind error

He dug so deep that he found several layers of foreign code and hurried to post oss-security on March 29, 2024, before this version was pushed into a big production distro for just a few days!

Current status of the project (2026)

• XZ Utils is edited immediately. Every big distro (Debian, Fedora, Red Hat, SUSE) withdraws version 5.6.x back to the old version.

• Lasse Collin back in charge of regular project GitHub open repo back

• Jia Tan is also a mystery. No one knows the real identity (expected to be a government-sponsored actor. Because of 2 + years of patience + high level of complexity).

• The "remains" of the backdoor were also found in some Debian Docker images on the Docker Hub (discovered by Binarly August 2025), but Debian left it as "historical artifacts" because it was a dev building, not a production.

Conclusion: The Expensive Lessons of the Open Source World

XZ Utils is the biggest reminder that "trust" is the most dangerous weakness in this day and age. The Internet world relies on volunteers like Lasse Collin who are overworked to allow the possibility of infiltration of bad-wishers like Jia Tan.

This event brought the Open Source community about a big change: increased governance, automated scanning, and better maintainer care.

But the question that still haunts everyone is...

Where is Jia Tan still hiding? And what is he planning next in other projects?

Main reference source (2026 update)

• Wikipedia: XZ Utils backdoor

• Wired: The Mystery of Jia Tan

• SentinelOne: XZ Utils Backdoor - Threat Actor Planned Further Vulnerabilities

• Binarly: Persistent risk in Docker images (2025)

• Ars Technica & The Verge

By the round ⚽️

# Trending

# Programming

# Lemon8