Caught Because His Login Was Half A Second Slow
In 2024, an engineer chased a half-second delay and uncovered a backdoor hidden inside Linux.
The script
His login was half a second slow... and that saved a huge part of the internet.
In twenty twenty-four, an engineer named Andres noticed his SSH logins were using too much CPU.
Most people would ignore it. He didn't.
He traced it to xz, a tiny compression library inside millions of Linux systems.
Inside was a hidden backdoor.
Someone called Jia Tan had spent two years helping on the project... earning trust... to slip it in.
It could have let them into servers around the world.
It was caught before most systems ever installed it.
Now I ask Dropstone what changed in every update. Because the only reason anyone caught this one?
The facts, checked
- March 2024: Andres Freund (a Microsoft engineer and PostgreSQL developer) noticed sshd using unusual CPU and logins about 500 ms slower.
- He traced it to a backdoor in xz/liblzma 5.6.0 and 5.6.1.
- The account "Jia Tan" had contributed to xz for about two years and become a maintainer.
- It was caught before reaching stable releases of most major Linux distributions.
