Malicious Code in xz Utils: Back to the Development Build Pipeline
Each code contributor (internal or external) should be treated as a potential insider threat.
Recently, a malicious backdoor was discovered in a widely used open-source utility called xz Utils. This compression tool is nearly ubiquitous in the Linux ecosystem, providing lossless data compression on various Unix-like operating systems. The backdoor was introduced in versions 5.6.0 and 5.6.1 of xz Utils. Although there are no known reports of these versions being incorporated into production releases for major Linux distributions, some beta releases (such as Fedora Rawhide and Debian testing) did use the compromised versions. A stable release of Arch Linux was also affected, although it’s not commonly used in production systems.
Sophisticated attackers like we have seen before can compromise a build pipeline by infiltrating the software development process. Once inside an organization, attackers can manipulate the build process, potentially affecting downstream consumers who use the affected software.
Open Source vs. Closed Source Software: What’s Safer?
Both open source and closed source (commercial) software are vulnerable to attacks. Each have their merits and drawbacks. While there is no definitive answer to whether one is inherently more secure than the other, let’s explore some reasons why:
1
Transparency and Trust:
- Open Source: Open-source software offers true transparency. Users can inspect the source code and evaluate its security. Community collaboration ensures continuous improvement.
- Closed Source: Closed source software relies on trust in the vendor’s claims. Without visibility into the code, users must rely on assurances without direct verification.
2
Vulnerability Exposure:
- Open Source: While open-source code is accessible to everyone, it also means that vulnerabilities can be more visible. However, prompt fixes are not always possible due to community involvement. Further there may not be any structured standards or compliance to identify vulnerabilities.
- Closed Source: Vulnerabilities may exist but remain hidden until discovered. In smaller and non-regulated development teams, this may not be a priority.
3
Dependency Risks:
- Open Source: Relies on external libraries and dependencies. Vulnerabilities in these components can affect the overall security.
- Closed Source: Dependencies are managed internally, but users may still face risks if third-party components are vulnerable.
4
Customization and Control:
- Open Source: Customization is possible, allowing organizations to tailor software. However, this flexibility can introduce security risks if not handled carefully.
- Closed Source: Limited customization options, but the vendor maintains control over security features.
The Defense Strategy
Vigilance and monitoring in the fast-paced DevOps landscape is critical. Organizations must fortify their defenses by employing governance to monitor the integrity of their software build process regardless of type. Critical areas of focus include:
- Implement secure security by design principles.1
- Source code repository monitoring to validate contributors are authenticated and expected.
- Dependency management scrutiny by generating and analyzing a valid software bill of materials (SBOM) for changes in open-source library usage.
- Build process vigilance including watching for unauthorized modifications to the build server(s), certificates, or signing keys.
- Artifact repository integrity checks such as comparing file hashes, performing behavioral analysis, monitoring for unusual account access or network traffic.
Source: Cybersecurity and Infrastructure Security Agency, Secure by Design | CISA
Are You Prepared?
Fortunately, this backdoor was discovered before it made its way into production versions of Linux, but this incident highlights the importance of what-if. Consider using this as an opportunity to ask yourself and cross-functional teams what if this had not been detected earlier? How would you have determined scope and impact? What containment and remediation steps you would have taken?
Insights on cyber security
KPMG professionals are passionate and objective about cyber security. We’re always thinking, sharing and debating. Because when it comes to cyber security, we’re in it together.
Meet our team
