CS50 Intro to Cybersecurity – Final Project

Case Study: XZ Utils Backdoor (CVE-2024-3094)

This repository supports my 7-10 minute presentation on the XZ Utils backdoor, including a recap of the backdoor, the mechanism for the backdoor via release tarballs, and relevant supply-chain mitigations.

Materials

• Slides (PDF): A Near-Miss in the Supply Chain: The XZ Utils Backdoor (CVE-2024-3094).pdf
• References: ./References.md
• Video (Unlisted): youtube-link

Key Takeaways

• Tarball ≠ Git: enforce artifact–tag parity in CI; fail on any mismatch.
• Supply-chain hardening: attestations (in-toto), SBOMs, SLSA ≥ L3, two-person review.
• Detect & recover: monitor sshd anomalous behavior/symbol interposition; retain tested rollback playbooks.

Incident Snapshot

• CVE: CVE-2024-3094
• When: March-April 2024
• Impact focus: risk to SSH auth via indirect dependency chain (ex. sshd → libsystemd → liblzma)

Acknowledgments