www.helpnetsecurity.com Open in urlscan Pro
52.40.95.94  Public Scan

Form analysis
1 forms found in the DOM

POST

<form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-244483 mc4wp-ajax" method="post" data-id="244483" data-name="Footer newsletter form">
  <div class="mc4wp-form-fields">
    <div class="hns-newsletter">
      <div class="hns-newsletter__top">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__title">
              <i>
                        <svg class="hic">
                            <use xlink:href="#hic-plus"></use>
                        </svg>
                    </i>
              <span>Cybersecurity news</span>
            </div>
          </div>
        </div>
      </div>
      <div class="hns-newsletter__bottom">
        <div class="container">
          <div class="hns-newsletter__wrapper">
            <div class="hns-newsletter__body">
              <div class="row">
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="520ac2f639" id="mcs1">
                    <label class="form-check-label text-nowrap" for="mcs1">Daily Newsletter</label>
                  </div>
                </div>
                <div class="col">
                  <div class="form-check form-control-lg">
                    <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="d2d471aafa" id="mcs2">
                    <label class="form-check-label text-nowrap" for="mcs2">Weekly Newsletter</label>
                  </div>
                </div>
              </div>
            </div>
            <div class="form-check form-control-lg mb-3">
              <input class="form-check-input" type="checkbox" name="_mc4wp_lists[]" value="28abe5d9ef" id="mcs3">
              <label class="form-check-label" for="mcs3">(IN)SECURE - monthly newsletter with top articles</label>
            </div>
            <div class="input-group mb-3">
              <input type="email" name="email" id="email" class="form-control border-dark" placeholder="Please enter your e-mail address" aria-label="Please enter your e-mail address" aria-describedby="hns-newsletter-submit-btn" required="">
              <button class="btn btn-dark rounded-0" type="submit" id="hns-newsletter-submit-btn">Subscribe</button>
            </div>
            <div class="form-check">
              <input class="form-check-input" type="checkbox" name="AGREE_TO_TERMS" value="1" id="mcs4" required="">
              <label class="form-check-label" for="mcs4">
                <span>I have read and agree to the <a href="https://www.helpnetsecurity.com/newsletter/" target="_blank" rel="noopener" class="d-inline-block">terms &amp; conditions</a>
                </span>
              </label>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"></label><input type="hidden" name="_mc4wp_timestamp"
    value="1712672929"><input type="hidden" name="_mc4wp_form_id" value="244483"><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1">
  <div class="mc4wp-response"></div>
</form>

Text Content

 * News
 * Features
 * Expert analysis
 * Videos
 * Events
 * Whitepapers
 * Industry news
 * Product showcase
 * Newsletters

 * 
 * 
 * 


Please turn on your JavaScript for this page to function normally.
Zeljka Zorz, Editor-in-Chief, Help Net Security
April 8, 2024
Share


XZ UTILS BACKDOOR: DETECTION TOOLS, SCRIPTS, RULES



As the analysis of the backdoor in XZ Utils continues, several security
companies have provided tools and advice on how to detect its presence on Linux
systems.




WHAT HAPPENED?

The open-source XZ Utils compression utility has been backdoored by a skilled
threat actor who tried to get the malicious packages included in mainstream
Linux distributions, to allow them unfettered, covert SSH access to Linux
systems around the world.

“The author intentionally obfuscated the backdoor in distribution tarballs,
intended for Linux distributions to use for building their packages. When the xz
build system is instructed to create an RPM or DEB for the x86-64 architecture
using gcc and gnu linker, the backdoor is included in the liblzma as part of the
build process. This backdoor is then shipped as part of the binary within the
RPM or DEB,” the Open Source Security Foundation succinctly explained.

The backdoor was discovered by Andres Freund, a software engineer at Microsoft,
and its existence was publicly revealed a little over a week ago. Stable
versions of a few Linux distros have been affected but widespread compromise has
been avoided.

Threat researchers are still working on analyzing the backdoor and are revealing
their findings daily.

It has become clear that is the work of a sophisticated threat actor who used
many tricks to:

 * Make the backdoor difficult to spot
 * Make their propagation efforts blend in within the normal open-source
   development process, and
 * Become a trusted persona in the open-source ecosystem (they made commits on
   other projects, as well).


HOW TO DETECT THE XZ UTILS BACKDOOR?

Triggering/using the backdoor requires authentication via a private SSH key
owned by the attacker, so exploitation – if it ever happens – will be limited.
The fact that the vulnerable library versions haven’t ended up in many
production systems is a huge blessing.

That said, a number of scripts and tools have been released allowing users to
check for the presence of the backdoor.

Freund’s post on the OSS mailing list includes a script to detect vulnerable SSH
binaries on systems, which has then been repurposed and extended to also check
whether a system uses a backdoored version of the liblzma library.

Binarly, a firmware security firm, has set up an online scanner that allows
users to analyze any binary for the backdoor implant.

“Such a complex and professionally designed comprehensive implantation framework
is not developed for a one-shot operation. It could already be deployed
elsewhere or partially reused in other operations. That’s exactly why we started
focusing on more generic detection for this complex backdoor,” they noted.

Late last week, Bitdefender released another scanner, that must be deployed on
systems that need testing. (Since the scanner requires root privileges to be
effective, the company has released the source code.)

It can search for all infected liblzma libraries, even if they are not used by
the Secure Shell Daemon application (sshd), as well as for a unique byte
sequence injected by the backdoor during library compilation.

Elastic Security Labs researchers have published their analysis of the backdoor,
as well as YARA signatures, detection rules, and osquery queries that Linux
admins can use to find vulnerable liblzma libraries and identify potentially
suspicious sshd behavior.





More about
 * backdoor
 * Binarly
 * Bitdefender
 * Elastic
 * GitHub
 * Linux
 * open source
 * supply chain compromise

Share


FEATURED NEWS

 * New Latrodectus loader steps in for Qbot
 * EJBCA: Open-source public key infrastructure (PKI), certificate authority
   (CA)
 * Strategies for secure identity management in hybrid environments

CISO’s guide to reducing the SaaS attack surface



SPONSORED

 * Whitepaper: Why Microsoft’s password protection is not enough
 * Guide: Application security posture management deep dive
 * eBook: Defending the Infostealer Threat




DON'T MISS

 * New Latrodectus loader steps in for Qbot
 * How exposure management elevates cyber resilience
 * EJBCA: Open-source public key infrastructure (PKI), certificate authority
   (CA)
 * Strategies for secure identity management in hybrid environments
 * Defining a holistic GRC strategy




Cybersecurity news
Daily Newsletter
Weekly Newsletter
(IN)SECURE - monthly newsletter with top articles
Subscribe
I have read and agree to the terms & conditions
Leave this field empty if you're human:

© Copyright 1998-2024 by Help Net Security
Read our privacy policy | About us | Advertise
Follow us
×