XZ Backdoor Documented in New Book 'Half a Second'
The 2024 XZ Utils supply chain attack—one of the closest calls in open-source security—now has a comprehensive written account examining how it was discovered and stopped.
Chronicle of a Near-Miss
A new book titled 'Half a Second' documents the XZ Utils backdoor incident that nearly compromised Linux distributions worldwide in early 2024. The title refers to the minimal performance delay that ultimately led to the backdoor's discovery by a single developer.
The book provides a detailed account of how a years-long social engineering campaign inserted malicious code into the widely-used compression library. The backdoor would have granted remote access to SSH-enabled systems across millions of servers if it had reached production releases.
Lessons for Open Source Security
The incident highlighted critical vulnerabilities in how open-source projects manage maintainer succession and code review. A contributor gained trust over years before introducing the backdoor through obfuscated build scripts.
The book examines the technical detection process and the broader implications for supply chain security in foundational software components. It serves as a case study for understanding sophisticated attacks on open-source infrastructure.