The Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ…

The Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ – René Mayrhofer & Mario Lins, Johannes Kepler University Linz

An emerging supply-chain attack due to a backdoor in XZ Utils has been identified. The backdoor allows an attacker to run commands remotely on vulnerable servers utilizing SSH without prior authentication. We have analyzed the critical attack path to discuss current mitigation strategies for such kinds of supply-chain attacks.