A new XZ backdoor scanner will be able to safeguard any Linux binary from threats

IT teams worried about the XZ Utils supply chain attack can breathe a bit more easily after Binarly released a free online scanner to ease worries.

Cybersecurity researchers looking into slow SSH logins on Debian Sid recently discovered a backdoor in the latest version of XZ Utils, a set of data compression tools and libraries, used by major Linux distros.

The backdoor leveraged a vulnerability tracked as CVE-2024-3094, and was introduced to XZ version 5.6.0 by a pseudonymous attacker, and it persisted in 5.6.1. Soon after its discovery, the cybersecurity community rallied to address the issue, with CISA suggesting downgrading the tool to 5.4.6. Stable, and then hunting for, and reporting, any malicious activity.

Better results

Other security teams started byte string matching, file hash blocklisting, and different YARA rules, all of which weren’t exceptionally effective. Some even led to false positives, which only made the problem worse.

Enter Binarly, with a dedicated scanner that works for the particular library, and any file with the same backdoor.

“Such a complex and professionally designed comprehensive implantation framework is not developed for a one-shot operation. It could already be deployed elsewhere or partially reused in other operations. That’s exactly why we started focusing on more generic detection for this complex backdoor,” Binarly said in its announcement.

Compared to previous methods, this scanner returns better results, it was said, as it scans for various supply chain points beyond just the XZ Utils project.

“This detection is based on behavioral analysis and can detect any variants automatically if a similar backdoor is implanted somewhere else,” Binarly’s lead security researcher and CEO, Alex Matrosov, told BleepingComputer. “Even after recompilation or code changes, we will detect it,” Matrosov added. 

The scanner can be found at xz.fail.

More from TechRadar Pro

• Huge backdoor discovered that could compromise SSH logins on Linux
• Here’s a list of the best firewalls around today
• These are the best endpoint security tools right now