Cybersecurity researchers at Binarly have uncovered a troubling discovery: the infamous XZ Utils backdoor, first detected in March 2024, continues to lurk in dozens of publicly available Docker images more than a year after its initial discovery.
The finding highlights the persistent nature of supply chain attacks and their ability to propagate silently through container ecosystems.
Persistent Threat in Container Infrastructure
The XZ Utils backdoor, initially inserted by developer ‘Jia Tan’, was embedded in versions 5.6.0 and 5.6.1 of the widely used compression utility.
The sophisticated attack targeted OpenSSH security by modifying GNU Indirect Function (ifunc) resolvers, allowing unauthorized remote access to affected systems.
While major Linux distributions quickly addressed the initial threat, Binarly’s recent analysis of nearly 15TB of Docker images revealed that the malicious code persists in container registries.
The security firm identified 12 Debian Docker images on Docker Hub that still contain the backdoor, including pictures tagged as “unstable,” “testing,” and “trixie” from March 11, 2024.
More concerning is the discovery of an additional 23 second-order images built upon these compromised base images, creating a cascading infection that could potentially affect enterprise environments.
Technical Sophistication and Detection Challenges
The XZ backdoor employs advanced techniques that make detection particularly challenging. The malicious code initially intercepts execution through ifunc calls, modifying the “is_arch_extension_supported” function to insert calls to a malformed “_get_cpuid()” function within the payload.
This sophisticated control flow manipulation demonstrates what security experts describe as “a state-sponsored operation with impressive sophistication and multi-year planning”.
Traditional detection methods focusing on version checks or hash-based identification have proven inadequate, as the backdoor can be recompiled and distributed through various Linux distributions without triggering existing security tools.
Binarly addressed this limitation by developing detection technology that analyzes ifunc transition behavioral patterns, achieving a “close to zero false positive rate.”
Industry Response and Ongoing Risks
Despite Binarly’s disclosure to Debian maintainers, the affected images remain publicly available on Docker Hub. The maintainers’ response suggested that users should rely on up-to-date photos.
Still, security experts argue that leaving backdoored containers accessible poses significant risks, particularly for organizations that may unknowingly deploy these images in production environments.
The incident underscores the critical need for continuous binary-level monitoring in container ecosystems. As Binarly notes, “even short-lived backdoored builds can remain unnoticed and persist in container registries for a very long time”.
The company has made its XZ backdoor scanner freely available at xz. Fail to help organizations identify potentially compromised systems.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
