He Spent 2 Years Earning Trust. Then He Backdoored Linux

March 2024. An engineer notices that logging into a Linux machine takes half a second longer than it should: 0.8 seconds instead of 0.3. He refuses to let it go, and finds a hidden back door planted in xz, a tiny compression tool inside a huge number of Linux systems. Nobody broke in. Someone was invited. This is the story of the xz backdoor, step by step: a helpful stranger called "Jia Tan", more than two years of small, useful contributions, a pressure campaign aimed at a tired volunteer maintainer, the keys handed over one reasonable step at a time, a payload hidden where code reviewers don't look, and the half second that caught it weeks before it reached the stable releases that run real servers. Then: who might be behind it, how close it came, and what the same playbook looks like in your own life. This is a story about prevention. Nothing here explains how the back door worked in a way anyone could reuse: it's shown as a block, a lock and a key. Chapters 0:00 Half a second 1:21 The Tower 3:40 A Helpful Stranger 5:05 The Pressure 7:29 The Keys 8:58 The Hidden Piece 11:37 Half a Second 13:33 How Close It Came 15:20 Who Was Jia Tan? 16:39 Who Watches the Tower? What to take from it 1. Open source didn't fail here, it worked, barely: the code was public and one curious person looked. 2. The weakest point was a person, alone and unpaid. The people who maintain critical projects need support. 3. What you can read isn't always what you run: projects now check that what they ship can be rebuilt exactly from the public code. 4. The same psychology shows up in romance scams, fake recruiters and "can you send me that password just this once": friendly, trusted, then suddenly urgent. That's the moment to slow down. 5. Remove browser extensions and apps you don't use (they can change owners), and keep your devices updated. Numbers in this video • Login time: 0.299 s before, 0.807 s with the back door (Andres Freund's measurement). • First contribution from "Jia Tan": October 29, 2021. Backdoored release 5.6.0: February 24, 2024. Public disclosure: March 29, 2024. • CVE-2024-3094, severity 10 out of 10. The bad versions reached development and test releases, not the stable versions most servers run. Sources • Andres Freund, oss-security (March 29, 2024): https://www.openwall.com/lists/oss-security/2024/03/29/4 • Russ Cox, "Timeline of the xz open source attack": https://research.swtch.com/xz-timeline • Wikipedia, "XZ Utils backdoor": https://en.wikipedia.org/wiki/XZ_Utils_backdoor • OpenSSF and OpenJS Foundation advisory on takeover attempts (April 2024) How we made this: the tower, the mailing-list messages and every screen are illustrations made for this video; quotes from the mailing list are short and the paraphrased ones are labelled as such. Disclosure: researched and written with help from Claude, a model made by Anthropic. The narrator is a synthetic text-to-speech voice. Original score, made for this video. ⚡ Wiredeep — the tech you use every day, explained. 👉 Subscribe for more! #linux #opensource #cybersecurity