namegabevictoire01-sys/cs50-cybersecurity-final-projectCS50 Cybersecurity Final Project - Analysis of CVE-2024-3094
This project provides a comprehensive cybersecurity analysis of the critical supply chain attack identified under CVE-2024-3094, commonly known as the XZ Utils backdoor incident. Discovered in late March 2024, this backdoor targeted the liblzma library, a core compression component widely deployed across major Linux distributions.
The attack was executed through a multi-year social engineering campaign. Starting around 2022, an account under the name 'Jia Tan' contributed legitimate patches to the XZ Utils repository to build trust within the developer community. Over time, the threat actor gained maintainer permissions and pushed hidden malicious files. In March 2024, Microsoft engineer Andres Freund identified a 500-millisecond delay during SSH authentication on Debian testing machines. Further investigation revealed that release tarballs for versions 5.6.0 and 5.6.1 contained modified build scripts not present in the public Git repository.
The injection mechanism was highly sophisticated and heavily obfuscated:
liblzma library hooked into OpenSSH (sshd) via systemd notification structures.To protect open-source ecosystems from similar supply chain compromises, several measures must be implemented: