Two years of social engineering, a backdoor hidden in build scripts, and detection via a 500-millisecond SSH latency spike. The book *Half a Second* reconstructs CVE-2024-3094—and extracts lessons every developer must learn.

XZ Utils and "Half a Second": Autopsy of the Supply Chain Attack That Almost Compromised the Internet

The Concrete Case

March 2024. Andres Freund, a Microsoft engineer, noticed that his SSH connections were taking 500 milliseconds too long. He dug deeper. He discovered that liblzma—the compression library for XZ Utils—had been modified to inject malicious code into the SSH daemon of most Linux distributions. CVE-2024-3094, CVSS 10.0. A backdoor that would have allowed its author to execute root code on millions of servers.

What makes this attack unique: it didn’t exploit a code flaw. It exploited human trust and open source governance processes—two years of patient work.

How "Jia Tan" Proceeded

The attacker began contributing to the XZ Utils project in 2021. Legitimate, high-quality, regular contributions. Two years of building a reputation, gaining the trust of maintainer Lasse Collin (by playing on his publicly documented health issues). Once in a position of trust and with commit rights, the backdoor was introduced—into the build scripts, not the visible source code, precisely to avoid classic code reviews.

No automated tool detected it. It was the 500ms anomaly noticed by a curious developer that revealed it.

What "Half a Second" Brings

The book reconstructs the full timeline, analyzes the obfuscation techniques in the build scripts, and proposes frameworks to strengthen the resilience of open source projects. The key lessons for a developer in 2026:

Governance is an attack surface. Who has the right to merge into your project? What process is in place to grant these rights to a new contributor? These are security questions, not just organizational ones.

Build scripts are critical code.Makefile, CMakeLists.txt, packaging scripts—they run with elevated privileges in your pipeline and are rarely scrutinized as closely as the main source code.

Behavioral detection trumps signature-based detection. Andres Freund didn’t have a rule to detect “backdoor in XZ Utils”—he was in the habit of observing anomalies in his system.

Key Takeaways

Key Takeaways

• CVE-2024-3094: Backdoor injected after 2 years of social infiltration. Detected by abnormal SSH latency of 500ms.
• The real vector: Trust in open source governance processes, not a code flaw.
• Actionable steps: Audit merge rights, treat build scripts as critical code, foster behavioral vigilance.
• "Half a Second" is essential reading for any open source maintainer or contributor—i.e., virtually everyone in the dev industry by 2026.

The XZ attack is a blueprint. Other actors have studied it. The question isn’t if a similar attempt will happen—it’s when, and whether we’ll be ready.