Deep Dive into XZ Utils Backdoor - Columbia Engineering, Advanced Systems Programming Guest Lecture

On March 29th, a developer from Microsoft published that he had discovered a backdoor built into XZ Utils, a compression package included with nearly every major Linux distribution. If gone unnoticed, this backdoor could have provided its authors with root-level access to millions servers across the internet. Interestingly, the core mechanism the backdoor uses to compromise host machines is something we just finished studying — dynamic linking and loading of ELF objects. This lecture will explore implementation details of the XZ Utils backdoor and describe the novel multi-year effort to put it in place–along with its consequences for the larger world of open source software development.

This is a recording of a guest lecture presented to the W4995 Advanced Systems Programming class at Columbia University.

00:00 - Intro
02:09 - Background on Open Source Development
05:47 - Backdoor Timeline
19:31 - How the Payload Works
48:46 - Reverse Engineering the Payload
57:56 - Live Demo
1:01:35 - Attribution
1:05:37 - Larger Implications

[VihaShah]

This is really cool. The college students asked really good questions, helped me understand everything so much better.

[jowsonjgong]

My computing teacher from high school (entering uni in 2025) posted about this CVE in april when it first got discovered. Today i watched a video from fern that talked about this same CVE. Then i went down a rabbit hole and found this gem! Thanks! Ive learnt a bit about buffer overflows in OSCP and the part on stack and heap really tickled my dormant memories on ESP and EBP hahahahaha i loved it!

[JoeTaber]

Getting a backdoor into open source software: 1. Start making useful contributions, 2. write mean messages to push for shared maintainership, 3. step in as savior, 4. build trust as competent contributor over years, 5. add overly convoluted testing system, 6. insert payload into repo, 7. make your first release as co-maintainer with untracked release script that compiles in backdoor, 8. nag distros to use the new version, 9. get caught in prerelease by german dev that notices the backdoor delays logins by 0.3s and decompiles your code to figure out why.
Getting a backdoor into proprietary software: 1. knock on CEO's office door, 2. present secret court order, 3. work with devs to add your backdoor.

[Stdvwr]

Such a brilliant presentation structure. Every slide answers the questions that arise from the previous

[TestamentScar]

This was a great explanation of how it worked on a technical level. Thanks for the lecture + summary!

[brentknight]

This was shockingly good & interesting. It is making me think about how a talk can be steered by posing an unusual audience — in this case, some college kids who just learned about linkers but can’t necessarily be assumed to know broadly what someone would typically know if they had that specialist knowledge. 5 stars, and your competition are the folks who’ve explained things from the internet worm thru stuxnet and beyond.

[Jabbl]

This was a really interesting and detailed overview of the backdoor.
I followed many of the discussions while it was being discovered, like how it was implemented, how it got compiled into the binary and what effect it had on sshd, but this lecture presented the actual effects on the system.

After reading the different discussions, seeing code examples and the details about the social engineering aspect, this video helped me see how the backdoor actually loaded itself into memory.
This reveals a lot more of the sophistication behind the backdoor and the layers of obfuscation wasn't really obvious to me before now.

Extremely helpful!

[Pii]

Awesome lecture! I learned a ton and it was super engaging.

[danygagnon]

This is amazing thank you so much for this lecture!

[cusematt]

This won't blow up like it should because you have 97 subscribers ... but the amount of depth you went into and the ease with which you explained a ton of very complicated concepts stretched out over 1+ hr is pretty absurd to me given that you are 20? years old. Damn bro. You know computers.

[michaelodonnell]

This is much needed presentation - thank you!
Gripes: the audio is OK but could be better, but most of all - and this can't be said too often - all presenters (all the time, in all venues) when taking audience questions need to *REPEAT THE FSCKING QUESTIONS* before answering them....

[playthingz]

Hey, this was a good video, thanks. I can't hear all of the questions though, it would have been good if you had repeated the questions that were being asked. Some of them became clear due to your answers, others less so. This can sometimes be an issue in the auditorium too.

[JohnAlanWoods]

great vid Denzel - so is it enough to update your XZ install to the "Fixed" packages with Jia's commits removed to fix this system wide?

[gruselhaus]

Lesson learned: dont't fuck around with database engineers unless you want to find out. Classic FAFO

[JB_inks]

At 4 minutes you said suppository rather than repository. Freudian slip methinks.

[Shahriyarj]

"Probably not US", the hypocrisy is at same level of the backdoor.

[Tibug]

What's the target audience that watches a talk about the details of the backdoor but doesn't know what SSH is or how the open-source community works?

Nice talk anyway!

[Flarel]

the volume is very low :( hard to hear this

[felipec]

Pretty good, but please no more upspeak.