XZ Utils Backdoor Found in Docker Hub Images, Posing Supply Chain Risks

New research has revealed that dozens of Docker Hub images still contain the XZ Utils backdoor, more than a year after its initial discovery. This alarming finding highlights the persistent risks to software supply chains, as these compromised images have been used as base layers for other images, propagating the threat transitively.

XZ Utils Backdoor Re-emerges in Docker Hub

Security firm Binarly Research has identified 35 Docker images on Docker Hub that are infected with the XZ Utils backdoor. The backdoor, first disclosed in March 2024, was embedded in XZ Utils versions 5.6.0 and 5.6.1. The incident underscores the vulnerability of open-source software and the potential for sophisticated, long-term attacks.

How the Backdoor Works

The XZ Utils backdoor, identified by the CVE-2024-3094, could grant unauthorized remote access and allow arbitrary code execution via SSH. It operates by compromising the library, which is utilized by the OpenSSH server. The malicious code intercepts the function, enabling an attacker with a specific private key to bypass authentication and execute commands with root privileges.

Sophisticated and Meticulous Attack

Further analysis revealed the attack was meticulously planned and executed by a developer known as "Jia Tan" (JiaT75). Tan contributed to the XZ Utils project for nearly two years, building trust before gaining maintainer access, which allowed for the backdoor's insertion. This level of planning suggests a state-sponsored operation with significant resources and foresight.

Ongoing Supply Chain Risks

Binarly's latest findings indicate that the impact of the XZ Utils incident continues to ripple through the software ecosystem. The research uncovered 12 Debian Docker images containing the backdoor, along with subsequent images built upon these compromised foundations. While Binarly reported these images to Debian maintainers, who opted to keep them available for historical context, the security firm warns that leaving such images publicly accessible poses a significant risk.

Key Takeaways:

• Dozens of Docker Hub images still contain the XZ Utils backdoor.

• The backdoor allows for unauthorized remote access and arbitrary code execution via SSH.

• The attack was sophisticated, involving a developer who spent years building trust.

• Compromised images are propagating through the Docker ecosystem via transitive dependencies.

• Continuous binary-level monitoring is crucial, beyond simple version tracking.

Despite the specific conditions required for exploitation – network access to an infected device with the SSH service running – the persistence of these images highlights the ongoing threat to software supply chains. The incident serves as a stark reminder that malicious code can remain hidden in official container images for extended periods and spread silently through development pipelines.

As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks, The Hacker News.