{"id":106945,"date":"2023-02-26T12:49:02","date_gmt":"2023-02-26T10:49:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=106945"},"modified":"2023-02-27T12:02:06","modified_gmt":"2023-02-27T10:02:06","slug":"v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","title":{"rendered":"V NPM bylo odhaleno 15 tis\u00edc bal\u00ed\u010dk\u016f pro phishing a spam.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Zaznamen\u00e1n \u00fatok na u\u017eivatele katalogu NPM, p\u0159i kter\u00e9m bylo 20. \u00fanora v repozit\u00e1\u0159i NPM zve\u0159ejn\u011bno v\u00edce ne\u017e 15 tis\u00edc bal\u00ed\u010dk\u016f, v jejich\u017e README souborech se objevovaly odkazy na phishingov\u00e9 str\u00e1nky nebo referral odkazy, za jejich\u017e proklik se vypl\u00e1cely provize. P\u0159i anal\u00fdze bylo v bal\u00ed\u010dc\u00edch odhaleno 190 unik\u00e1tn\u00edch phishingov\u00fdch nebo reklamn\u00edch odkaz\u016f, pokr\u00fdvaj\u00edc\u00edch 31 dom\u00e9n. <\/p>\n
N\u00e1zvy bal\u00ed\u010dk\u016f byly vybr\u00e1ny tak, aby p\u0159it\u00e1hly pozornost b\u011b\u017en\u00fdch u\u017eivatel\u016f, nap\u0159\u00edklad «free-tiktok-followers», «free-xbox-codes», «instagram-followers-free» a podobn\u011b. Po\u010d\u00edtalo se s t\u00edm, \u017ee spamersk\u00e9 bal\u00ed\u010dky zapln\u00ed seznam ned\u00e1vn\u00fdch aktualizac\u00ed na hlavn\u00ed str\u00e1nce NPM. V popisu bal\u00ed\u010dk\u016f byly uvedeny odkazy slibuj\u00edc\u00ed bezplatn\u00e9 rozd\u00e1v\u00e1n\u00ed, dary, hern\u00ed cheaty, a tak\u00e9 bezplatn\u00e9 slu\u017eby pro zv\u00fd\u0161en\u00ed po\u010dtu sleduj\u00edc\u00edch a lajk\u016f na soci\u00e1ln\u00edch s\u00edt\u00edch, jako jsou TikTok a Instagram. To nen\u00ed prvn\u00ed podobn\u00fd \u00fatok; v prosinci byla v kataloz\u00edch NuGet, NPM a PyPi zaznamen\u00e1na publikace 144 tis\u00edc spamersk\u00fdch bal\u00ed\u010dk\u016f.
<\/center> <\/p>\n
Obsah bal\u00ed\u010dk\u016f byl automaticky generov\u00e1n pomoc\u00ed python skriptu, kter\u00fd z\u0159ejm\u011b nedopat\u0159en\u00edm z\u016fstal v bal\u00ed\u010dc\u00edch a obsahoval funk\u010dn\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje, kter\u00e9 byly pou\u017eity b\u011bhem \u00fatoku. Bal\u00ed\u010dky byly publikov\u00e1ny pod mno\u017estv\u00edm r\u016fzn\u00fdch \u00fa\u010dt\u016f s vyu\u017eit\u00edm metod, kter\u00e9 zt\u011b\u017eovaly vystopov\u00e1n\u00ed a rychlou identifikaci probl\u00e9mov\u00fdch bal\u00ed\u010dk\u016f. <\/p>\n
Krom\u011b podvodn\u00fdch \u010dinnost\u00ed v repozit\u00e1\u0159\u00edch NPM a PyPi byly tak\u00e9 zaznamen\u00e1ny n\u011bkolik pokus\u016f o publikaci \u0161kodliv\u00fdch bal\u00ed\u010dk\u016f: <\/p>\n
\n
V repozit\u00e1\u0159i PyPI bylo nalezeno 451 \u0161kodliv\u00fdch bal\u00ed\u010dk\u016f, kter\u00e9 se maskovaly jako n\u011bkter\u00e9 popul\u00e1rn\u00ed knihovny pomoc\u00ed typov\u00e1n\u00ed (pou\u017eit\u00ed podobn\u00fdch n\u00e1zv\u016f, kter\u00e9 se li\u0161\u00ed jednotliv\u00fdmi znaky, nap\u0159\u00edklad vper m\u00edsto vyper, bitcoinnlib m\u00edsto bitcoinlib, ccryptofeed m\u00edsto cryptofeed, ccxtt m\u00edsto ccxt, cryptocommpare m\u00edsto cryptocompare, seleium m\u00edsto selenium, pinstaller m\u00edsto pyinstaller atd.). Bal\u00ed\u010dky obsahovaly obfuskovan\u00fd k\u00f3d pro kr\u00e1de\u017e kryptom\u011bn, kter\u00fd detekoval p\u0159\u00edtomnost identifik\u00e1tor\u016f kryptom\u011bnov\u00fdch pen\u011b\u017eenek ve schr\u00e1nce a m\u011bnil je na pen\u011b\u017eenku \u00fato\u010dn\u00edka (p\u0159edpokl\u00e1d\u00e1 se, \u017ee p\u0159i prov\u00e1d\u011bn\u00ed platby si ob\u011b\u0165 neuv\u011bdom\u00ed, \u017ee zkop\u00edrovan\u00e9 \u010d\u00edslo pen\u011b\u017eenky se li\u0161\u00ed). Z\u00e1m\u011bnu prov\u00e1d\u011blo vestav\u011bn\u00e9 roz\u0161\u00ed\u0159en\u00ed pro prohl\u00ed\u017ee\u010d, kter\u00e9 se spou\u0161t\u011blo v kontextu ka\u017ed\u00e9 prohl\u00ed\u017een\u00e9 webov\u00e9 str\u00e1nky.\n
V repozit\u00e1\u0159i PyPI byla zji\u0161t\u011bna \u0159ada \u0161kodliv\u00fdch HTTP knihoven. \u0160kodliv\u00e1 aktivita byla nalezena v 41 bal\u00ed\u010dc\u00edch, jejich\u017e n\u00e1zvy byly vyb\u00edr\u00e1ny pomoc\u00ed metod typov\u00e1n\u00ed a p\u0159ipom\u00ednaly popul\u00e1rn\u00ed knihovny (aio5, requestst, ulrlib, urllb, libhttps, piphttps, httpxv2 atd.). Obsah byl stylizov\u00e1n tak, aby vypadal jako funk\u010dn\u00ed HTTP knihovny nebo kop\u00edroval k\u00f3d existuj\u00edc\u00edch knihoven, p\u0159i\u010dem\u017e v popisu byly uv\u00e1d\u011bny tvrzen\u00ed o v\u00fdhod\u00e1ch a srovn\u00e1n\u00ed s leg\u00e1ln\u011b existuj\u00edc\u00edmi HTTP knihovnami. \u0160kodliv\u00e1 aktivita spo\u010d\u00edvala bu\u010f v na\u010d\u00edt\u00e1n\u00ed \u0161kodliv\u00e9ho softwaru do syst\u00e9mu, nebo ve shroma\u017e\u010fov\u00e1n\u00ed a odes\u00edl\u00e1n\u00ed citliv\u00fdch dat.\n
V NPM bylo zji\u0161t\u011bno 16 JavaScriptov\u00fdch bal\u00ed\u010dk\u016f (speedte*, trova*, lagra), kter\u00e9 krom\u011b deklarovan\u00e9 funk\u010dnosti (testov\u00e1n\u00ed pr\u016fchodnosti) tak\u00e9 obsahovaly k\u00f3d pro t\u011b\u017ebu kryptom\u011bn bez v\u011bdom\u00ed u\u017eivatele.\n
![\"V](\"\/wp-content\/uploads\/2023\/02\/434214f596ba6d4174a3f0a8eae982e4.jpg\")
<\/center> <\/p>\n