Half a second slower. That was the only clue.
How a backdoor planted over two years in a trusted open-source tool was caught by luck, and why no new version should go into your product unread.
The facts
What happened
A backdoor was found in versions 5.6.0 and 5.6.1 of xz utils, a compression library in many Linux systems (CVE-2024-3094). A contributor spent about two years making legitimate-looking contributions before gaining maintainer rights and slipping it in.
What it caused
It was caught by chance, when engineer Andres Freund investigated a delay of about half a second in SSH logins. It had reached some testing and development distributions, but not the major stable releases.
What the CRA now asks
Due diligence on third-party components (Article 13(5)); identify and document components (Annex I, Part II (1)); protect the integrity of programs (Annex I, Part I (2)(f)).
Source: NIST National Vulnerability Database, CVE-2024-3094
The story
In March 2024, a software engineer named Andres Freund noticed something most of us would have ignored. When he logged into one of his computers from another, it took about half a second longer than usual. Not broken, not failing, just slow. Half a second. You could blink and lose it. But he kept pulling at the thread, and at the other end of it was something chilling.
Hidden inside a small, free tool for squeezing files smaller, built into many of the computers that run the internet, was a secret door. And it had not been put there overnight. Someone using the name Jia Tan had spent about two years helping out on the project, patiently earning everyone's trust, until they were made one of the people allowed to approve changes. Then they used that trust to slip the door in. The poisoned version had reached some test systems, but not the versions most companies rely on. It was caught by one man's curiosity and a half-second delay.
Now picture the other version of this story, the one where nobody noticed: a company updates the free parts inside its products to the newest version without reading what changed, signs the result with its official key, and sends the secret door to every gadget it has ever sold. The Cyber Resilience Act says luck is not a plan. Companies must exercise due diligence on the parts they take from others: no new version goes in unread, every part's origin is written down, and the signing key is locked away so it can only be used on something that has been checked.
Andres Freund and Jia Tan are names from the public record. The incident and its facts are real.
The system that would have caught it
1. Know what's inside
A list of every software part inside your product, made automatically each time you build a new version. It is called an SBOM (software bill of materials).
How the system worksCould you do this today?
Does anyone read what changed before a new version of a third-party part goes into your product?
If it applies, how ready are we?
Six yes-or-no questions, two minutes. Your no's come back in the order to fix them.
Not sure the CRA applies to your product? Check that first