Technical Analysis of the XZ Utils Backdoor (CVE-2024-3094)

Video URL: [https://www.youtube.com/watch?v=6hpVp7prlO8]

Overview

This repository contains the final project for CS50's Introduction to Cybersecurity. The project provides a thorough technical analysis of the supply chain attack on XZ Utils (CVE-2024-3094), discovered in March 2024.

Project Details

• Student Name: Mohamed Hamdy Ismail Mohamed
• edX Username: MOHAMED_60469
• GitHub Username: MHICAIRO-HUE
• Location: Riyadh, Saudi Arabia
• Date: September 2026

Contents

• slides.pdf: The 9-slide presentation deck used in the video.
• script.txt: The full presentation script.

Abstract

CVE-2024-3094 represents one of the most sophisticated supply chain attacks targeting Linux infrastructure. This project breaks down how the malicious maintainer compromised the upstream repository, obfuscated the payload inside release tarballs, intercepted OpenSSH via systemd/liblzma integration, and executed arbitrary commands remotely.