Malware infikující NetBeans pro zavádění backdoorů do kompilovaných projektů

GitHub odhalil Malware that targets projects in the integrated development environment NetBeans and uses the build process for its distribution. Investigations revealed that this malware, named Octopus Scanner, had covertly integrated backdoors into 26 open projects hosted on GitHub. The first signs of Octopus Scanner appeared in August 2018.

The malware can identify files with NetBeans projects and add its code to project files and compiled JAR files. The algorithm involves finding the user's NetBeans project directory, iterating through all projects in this directory, and copying the malicious script into nbproject/cache.dat and making changes to the file nbproject/build-impl.xml to invoke this script with each project build. When building, a copy of the malware is included in the resulting JAR files, which become a source for further distribution. For instance, malicious files were found in the repositories of the aforementioned 26 open projects, as well as various other projects during the publication of new release builds.

When a user downloads and runs the infected JAR file, a new cycle of searching for NetBeans and injecting malicious code starts on their system, resembling the operation of self-replicating computer viruses. Besides self-replication functionality, the malicious code also includes backdoor functions for providing remote access to the system. At the time of the incident investigation, the backdoor management servers (C&C) were inactive.

In total, four infection variants were identified during the study of the affected projects. In one variant, a startup file "$HOME/.config/autostart/octo.desktop" was created in Linux to activate the backdoor, while in Windows, tasks were initiated using schtasks. Among the other created files are:

• $HOME/.local/share/bbauto
• $HOME/.config/autostart/none.desktop
• $HOME/.config/autostart/.desktop
• $HOME/.local/share/Main.class
• $HOME/Library/LaunchAgents/AutoUpdater.dat
• $HOME/Library/LaunchAgents/AutoUpdater.plist
• $HOME/Library/LaunchAgents/SoftwareSync.plist
• $HOME/Library/LaunchAgents/Main.class

Zadní vrátka mohla být použita k přidávání záložek do kódu vyvíjeného vývojářem, organizaci úniku kódu proprietárních systémů, krádeži důvěrných údajů a převzetí účtů. Badatelé z GitHubu nevylučují, že škodlivé aktivity se neomezují na NetBeans a mohou existovat další varianty Octopus Scanner, implantované pro své šíření do procesu sestavení založeného na Make, MsBuild, Gradle a dalších systémech.

Názvy zasažených projektů nejsou uvedeny, ale snadno je lze najít najít prostřednictvím vyhledávání na GitHubu pomocí masky „cache.dat“. Mezi projekty, ve kterých byly nalezeny stopy škodlivé aktivity, patří: V2Mp3Player, JavaPacman, Kosim-Framework, Punto-de-venta, 2D-Physics-Simulations, PacmanGame, GuessTheAnimal, SnakeCenterBox4, Secuencia-Numerica, CallCenter, ProyectoGerundio, pacman-java_ia, SuperMario-FR-.

Zdroj: opennet.ru