Welcome back to another episode of SnapAttack's Threat SnapShot! I’m AJ King, the Director of Threat Research here at SnapAttack. In today’s episode, I dive into detecting the XZ Backdoor, CVE-2024-3094, a sophisticated supply chain attack that could have had a massive impact on many Linux distributions.

This episode is crucial for anyone responsible for protecting Linux systems, providing you with the knowledge to hunt your in your environment for reverse shell activity. Whether you’re a seasoned professional or new to cybersecurity, this story of near-missed danger and breakdown of threat detection will keep you engaged and informed.

✅ *Subscribe to SnapAttack for more in-depth analyses and real-world applications of cybersecurity defenses.*

📢 *Have questions or topics you’d like us to cover? Drop a comment below!*

👋 *Follow us:*
https://www.linkedin.com/company/snapattack/
https://twitter.com/snapattackhq
https://www.linkedin.com/in/ajkingio/
https://twitter.com/ajkingio

References:

• https://github.com/tukaani-project/xz
• https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
• https://access.redhat.com/security/cve/CVE-2024-3094
• https://www.openwall.com/lists/oss-security/2024/03/29/4
• https://tukaani.org/xz-backdoor/
• https://tukaani.org/xz-backdoor/review.html
• https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
• https://jfrog.com/blog/xz-backdoor-attack-cve-2024-3094-all-you-need-to-know/
• https://pentest-tools.com/blog/xz-utils-backdoor-cve-2024-3094
• https://github.com/amlweems/xzbot

SnapAttack Resources:

• https://app.snapattack.com/collection/vulnerability/CVE-2024-3094 - Collection: CVE-2024-3094
• https://app.snapattack.com/threat/28365954-c874-cad9-ab16-1ef121a857b4 - Threat: XZ SSH Backdoor (CVE-2024-3094)
• https://app.snapattack.com/detection/4ce09a8a-fdb2-4713-ae25-69d4b637a372 - Detection: Suspicious SSH Child Process
• https://app.snapattack.com/detection/6829f248-0ea9-48e3-a439-eab8f4c55baf - Detection: Suspicious SSH Connection
• https://app.snapattack.com/detection/50a9de97-d58d-4844-8daf-928d2faceead - Detection: Netcat Outbound Connection
• https://app.snapattack.com/detection/8bcf72da-5317-4ad9-9ad0-a9bf89bb9b2c - Detection: Possible Netcat Reverse Shell
• https://app.snapattack.com/detection/d18674e7-249f-4388-9ee8-b60fff703413 - Detection: Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process
• https://app.snapattack.com/detection/d7a67b61-b244-4cb2-9450-ddded192054e - Detection: Potential Netcat Reverse Shell Execution