Lessons That The XZ Utils Backdoor Spells Out - Farshad Abasi - ASW #280

We look into the supply chain saga of the XZ Utils backdoor. It's a wild story of a carefully planned long con to add malicious code to a commonly used package that many SSH connections rely on. It hits themes from social engineering and abuse of trust to obscuring the changes and suppressing warnings. It also has a few lessons about software development, the social and economic dynamics of open source, and strategies for patching software.

It's an exciting topic …

abuse backdoor code con connections engineering malicious package social social engineering ssh story supply supply chain xz utils