Multiple Docker Images Discovered with Infamous XZ Backdoor Present for Over a Year
The cybersecurity community continues to confront the enduring ramifications of the XZ Utils backdoor, a sophisticated supply chain attack that significantly impacted the industry in March 2024. This attack originated from a meticulously planned two-year campaign by the pseudonymous developer Jia Tan, who gained credibility within the XZ Utils project through numerous legitimate contributions. Subsequently, Tan inserted a complex backdoor into the xz-utils packages, affecting major Linux distributions such as Debian, Fedora, and OpenSUSE. The backdoor operates through a sophisticated mechanism embedded within the liblzma.so library, which interfaces directly with OpenSSH servers. When triggered by client interactions with infected SSH servers, the malicious code establishes three critical hooks targeting the RSA_public_decrypt, RSA_get0_key, and EVP_PKEY_set1_RSA functions. This intricate attack chain commenced with modified IFUNC resolvers for lzma_crc32 and lzma_crc64 functions, creating a pathway for backdoor functionality that remained undetected for months.
Recent investigations by Binarly researchers have revealed that the XZ Utils backdoor continues to pose significant risks to containerised environments more than a year after its initial discovery. Their comprehensive analysis of Docker Hub repositories uncovered over 35 infected images, with 12 Debian-based containers still publicly available and actively distributing the compromised code. This discovery underscores a critical blind spot in container security, where historical artifacts containing known vulnerabilities persist in public repositories. The research findings extend beyond first-generation infected images, as Binarly analysts systematically scanned Docker Hub’s extensive repository network and identified numerous second-order containers built upon the compromised Debian base images. These derivative containers, which span various use cases from development environments to specialised applications, illustrate how supply chain compromises can propagate through containerised ecosystems with minimal visibility. The backdoor’s persistence within Docker environments highlights a fundamental challenge in container security lifecycle management, as container images often remain static historical artifacts once published.
Categories: Supply Chain Attacks, Container Security, Malware Persistence
Tags: Cybersecurity, XZ Utils, Backdoor, Supply Chain Attack, Linux Distributions, Container Security, Docker Hub, Malicious Code, Persistence, Propagation