Somebody spent three years becoming a trusted maintainer of a compression library so they could put a backdoor in it. The obfuscation was clever, and the obfuscation is not the interesting part. The patience is.

The talk walks through CVE-2024-3094 from 2021 to 2024. How the account operating as “Jia Tan” built a real contribution history in XZ Utils, became useful to a maintainer who had more work than time, and ended up a co-maintainer with commit access. Then the payload, which was staged so that no single place you might look contained anything alarming: binary blobs sitting in the repository as test fixtures for the compressor, and a build script that only existed in the release tarball to assemble them into a backdoor. Reading the git tree told you nothing. Once built, it hooked SSH authentication and gave the attacker remote code execution on any machine running it.

It was caught by Andres Freund, a developer at Microsoft, because logins to a test machine were taking about half a second longer than they should have. That is the detection story in full. No audit, no scanner, one person who noticed a performance regression and would not let it go.

The rest of the talk is what that costs us to think about. Critical infrastructure is maintained by people who are overworked and mostly unpaid, and a project in that state is a target precisely because help is what it needs and an attacker can offer help. Every dependency you do not actually need is attack surface somebody else chose for you. And the reason this ended as a near miss is that the backdoor only reached testing distributions before it was found, which is process in part, and luck in part, and it would be dishonest to claim we know the ratio.