Bakd\u00f6rren i paketet xz har troligen inf\u00f6rts av utvecklaren Jia Tan, som 2022 fick status som underh\u00e5llare och publicerade versioner fr\u00e5n och med version 5.4.2. F\u00f6rutom projektet xz deltog den misst\u00e4nkta f\u00f6rfattaren till bakd\u00f6rren ocks\u00e5 i utvecklingen av paketen xz-java och xz-embedded, och blev en av underh\u00e5llarna f\u00f6r projektet XZ Embedded, som anv\u00e4nds i Linux-k\u00e4rnan. <\/p>\n
In the promotion of the backdoor, two more participants have also been noted \u2014 Jigar Kumar and Hans Jansen, who apparently are virtual characters. In April 2022, Jigar Kumar facilitated the acceptance of early patches by Jia Tan into xz, which implemented support for string filters, and exerted moral pressure on Lasse Collin, the then maintainer, criticizing that he was unable to fulfill his duties and not accepting useful patches. In June, Lasse Collin agreed that the project needed a new maintainer, lamented burnout and mental health issues, and transferred maintainer rights to Jia Tan. After this, the user Jigar Kumar no longer appeared in the mailing list. <\/p>\n
N\u00e4r Jia Tan fick r\u00e4ttigheter som underh\u00e5llare b\u00f6rjade han aktivt l\u00e4gga till f\u00f6r\u00e4ndringar i projektet och enligt statistiken f\u00f6r tv\u00e5 \u00e5r hamnade han p\u00e5 andra plats bland utvecklarna n\u00e4r det g\u00e4ller antal f\u00f6r\u00e4ndringar. I mars 2023 ersattes den ansvarige f\u00f6r testningen av paketet xz i tj\u00e4nsten oss-fuzz fr\u00e5n Lasse Collin till Jia Tan, och i juni antogs \u00e4ndringar i xz som la till st\u00f6d f\u00f6r mekanismen IFUNC i liblzma (konstruktorn crc64_fast ersattes med ifunc), som senare anv\u00e4ndes f\u00f6r att organisera avlyssning av funktioner i bakd\u00f6rren. \u00c4ndringen f\u00f6reslogs av Hans Jansen och Jia Tan accepterade den i xz. Hans Jansen-kontot skapades strax f\u00f6re skickandet av pull-beg\u00e4ran. <\/p>\n
In July 2023, Jia Tan sent a request to the oss-fuzz developers to disable the ifunc check due to its incompatibility with the '-fsanitize=address' mode. In early February 2024, the link to the project site in oss-fuzz and on the main page of tukaani.org was changed from 'tukaani.org\/xz\/' to 'xz.tukaani.org', where the subdomain 'xz.tukaani.org' was hosted on GitHub Pages and personally controlled by Jia Tan. On February 23, archives for testing the decoder's operation were placed in the xz repository, including files bad-3-corrupt_lzma2.xz and good-large_compressed.lzma with a hidden backdoor. M4 macros for activating the backdoor were included only in the tar archive with the release 5.6.0 and were excluded from the Git repository, but appeared in the .gitignore file. <\/p>\n
Den 17 mars registrerades Hans Jansen, som tidigare utvecklat patchar med st\u00f6d f\u00f6r IFUNC, som deltagare i Debian-projektet, och den 25 mars skickades en beg\u00e4ran om att uppdatera versionen av paketet xz-utils i Debian-repositoriet. Beg\u00e4rningar f\u00f6r versionsuppdatering kom \u00e4ven till Fedora- och Ubuntu-utvecklarna (i Ubuntu var repositoriet i frysningsl\u00e4ge och \u00e4ndringen avslogs). <\/p>\n