A new XZ backdoor scanner will be able to safeguard any Linux binary from threats

Pls share this post

Listen to this article

IT teams worried about the XZ Utils supply chain attack can breathe a bit more easily after Binarly released a free online scanner to ease worries.

Cybersecurity researchers looking into slow SSH logins on Debian Sid recently discovered a backdoor in the latest version of XZ Utils, a set of data compression tools and libraries, used by major Linux distros.

The backdoor leveraged a vulnerability tracked as CVE-2024-3094, and was introduced to XZ version 5.6.0 by a pseudonymous attacker, and it persisted in 5.6.1. Soon after its discovery, the cybersecurity community rallied to address the issue, with CISA suggesting downgrading the tool to 5.4.6. Stable, and then hunting for, and reporting, any malicious activity.

World's first modular handheld inkjet printer claims revolutionary print-on-any-surface capabilities — Chinese startup makes big promises but watch out for the price of consumables

Better results

Other security teams started byte string matching, file hash blocklisting, and different YARA rules, all of which weren’t exceptionally effective. Some even led to false positives, which only made the problem worse.

Enter Binarly, with a dedicated scanner that works for the particular library, and any file with the same backdoor.

“Such a complex and professionally designed comprehensive implantation framework is not developed for a one-shot operation. It could already be deployed elsewhere or partially reused in other operations. That’s exactly why we started focusing on more generic detection for this complex backdoor,” Binarly said in its announcement.

Compared to previous methods, this scanner returns better results, it was said, as it scans for various supply chain points beyond just the XZ Utils project.

This rugged smartphone has the biggest phone battery ever but that's not its most interesting feature - TANK3 PRO has a DLP projector, a 200-megapixel camera and a camping light

“This detection is based on behavioral analysis and can detect any variants automatically if a similar backdoor is implanted somewhere else,” Binarly’s lead security researcher and CEO, Alex Matrosov, told BleepingComputer. “Even after recompilation or code changes, we will detect it,” Matrosov added. 

The scanner can be found at xz.fail.

More from TechRadar Pro


Pls share this post
Previous article100 billion reasons Apple is putting up a fight
Next articleApple TV Plus just added 30 more classic movies to its library – here are 7 to stream first