Social Engineering Paves the Way for the XZ Cyber Incident

The XZ cyber incident is a textbook example of how sophisticated social engineering tactics can lead to significant security breaches.

Over the course of two years, a carefully planned attack was executed against the popular XZ Utils open-source project.

The attackers went to great lengths to ensure their plan was executed flawlessly, ultimately culminating in the successful insertion of a backdoor in early 2024. This breach had far-reaching consequences that affected countless project users.

The attackers believed to be using fake identities, worked on a long-term infiltration strategy for the XZ Utils project.

One of the central figures in this operation was Jia Cheong Tan(JiaT75), a likely pseudonymous entity who played a pivotal role in executing the attack.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Kaspersky has recently released an in-depth analysis of an incident that was primarily executed through social engineering techniques.

The report provides comprehensive details and insights into the incident, shedding light on the intricacies and nuances of social engineering as an attack vector.

The social engineering aspect of this incident was not only elaborate but also highlighted a significant vulnerability in the trust-based model of open-source projects.

The initial phase of the attack involved benign contributions to the project, which served dual purposes: to mask the attackers’ malicious intentions and to build a reputation within the community as trustworthy developers.

Attack Timeline

The security researcher Alden from Huntress has been analyzing Jai Tan’s commit history over a period of time.

The plot indicates that the cluster of offending commits happened at unusual times.

• Between February 23-26 and March 8-9, 2024, JiaT75 uploaded malicious code unrelated to their prior work times.
• It is suspected that a second party used the JiaT75 account to insert the malicious code, but it is unclear whether the contributor was aware of this.
• The individual contributor behind the JiaT75 account may have been under pressure to commit the malicious backdoor code quickly.
• A team managed the JiaT75 account, and one part needed to work beyond usual hours without interruptions.

As these contributions continued, the attackers engaged in strategic social interactions with key community members, gradually ingratiating themselves within the community.

By leveraging the open-source community’s reliance on mutual trust and collaborative development, the attackers positioned themselves as integral contributors to the XZ Utils project.

Over time, they expanded their roles within the project, advocating for additional maintainer roles under the pretext of enhancing the project.

This strategic placement allowed them unfettered access to the project’s codebase, setting the stage for the next phase of their plan.

In early 2024, the attackers executed the final phase of their strategy by inserting malicious code into the XZ Utils build process.

This code was designed to implement an exclusive use backdoor in sshd, a critical component of many Linux distributions.

The backdoor code was pushed to major Linux distributions as part of a large-scale supply chain attack, aiming to compromise millions of systems globally.

The malicious code’s subtlety in insertion, leveraging the build process in plain sight, was a testament to the attackers’ technical acumen and deep understanding of the open-source development ecosystem.

The social engineering tactics employed were not just about deceiving individuals; they were about exploiting the dynamics of community trust and collaboration, which are foundational to open-source projects.

Thanks to the vigilance of Andres Freund, a developer at Microsoft, this backdoor was discovered, preventing what could have been one of the most significant security breaches in recent history.

Freund’s investigation began when he noticed unusual activity in the SSH daemon, which led him to uncover the backdoor embedded within the XZ Utils.

As the cybersecurity community continues to analyze and learn from the XZ incident, it is clear that the battle against cyber threats is not just about technological defenses but also about understanding and mitigating the human and social factors that can often be the weakest links in security.

Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo