{"id":78968,"date":"2020-04-23T13:42:01","date_gmt":"2020-04-23T11:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa"},"modified":"2020-04-23T13:42:01","modified_gmt":"2020-04-23T11:42:01","slug":"v-rubygems-vyyavleno-724-vredonosnyh-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","title":{"rendered":"V RubyGems bylo odhaleno 724 \u0161kodliv\u00fdch bal\u00ed\u010dk\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost ReversingLabs publikovala<\/a><\/noindex> v\u00fdsledky anal\u00fdzy pou\u017eit\u00ed typskvottingu<\/a><\/noindex> v repozit\u00e1\u0159i RubyGems. Typiskvotting se obvykle pou\u017e\u00edv\u00e1 k \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00fdch bal\u00ed\u010dk\u016f, kter\u00e9 jsou ur\u010deny k tomu, aby nedbal\u00fd v\u00fdvoj\u00e1\u0159 v pr\u016fb\u011bhu hled\u00e1n\u00ed ud\u011blal p\u0159eklep nebo si nev\u0161iml rozd\u00edlu. B\u011bhem v\u00fdzkumu bylo identifikov\u00e1no v\u00edce ne\u017e 700 bal\u00ed\u010dk\u016f, jejich\u017e n\u00e1zvy se podobaj\u00ed popul\u00e1rn\u00edm bal\u00ed\u010dk\u016fm a li\u0161\u00ed se nepatrn\u00fdmi detaily, jako je nahrazen\u00ed podobn\u00fdch p\u00edsmen nebo pou\u017eit\u00ed podtr\u017e\u00edtek m\u00edsto poml\u010dek. <\/p>\n

U v\u00edce ne\u017e 400 bal\u00ed\u010dk\u016f byly nalezeny komponenty podez\u0159el\u00e9 z vykon\u00e1v\u00e1n\u00ed \u0161kodliv\u00fdch \u010dinnost\u00ed. Konkr\u00e9tn\u011b uvnit\u0159 byl soubor aaa.png, kter\u00fd zahrnoval spustiteln\u00fd k\u00f3d ve form\u00e1tu PE. Tyto bal\u00ed\u010dky byly spojeny se dv\u011bma \u00fa\u010dty, prost\u0159ednictv\u00edm kter\u00fdch bylo od 16. do 25. \u00fanora 2020 v RubyGems um\u00edst\u011bno 724 \u0161kodliv\u00fdch bal\u00ed\u010dk\u016f<\/a><\/noindex>, kter\u00e9 byly celkov\u011b sta\u017eeny p\u0159ibli\u017en\u011b 95 tis\u00edckr\u00e1t. V\u00fdzkumn\u00edci informovali spr\u00e1vu RubyGems a zji\u0161t\u011bn\u00e9 \u0161kodliv\u00e9 bal\u00ed\u010dky byly ji\u017e odstran\u011bny z repozit\u00e1\u0159e. <\/p>\n

Mezi zji\u0161t\u011bn\u00fdmi probl\u00e9mov\u00fdmi bal\u00ed\u010dky se nejpopul\u00e1rn\u011bj\u0161\u00edm uk\u00e1zal bal\u00ed\u010dek «atlas-client», kter\u00fd je na prvn\u00ed pohled t\u00e9m\u011b\u0159 k nerozezn\u00e1n\u00ed od legitimn\u00edho bal\u00ed\u010dku «atlas_client<\/a><\/noindex>«. Uveden\u00fd bal\u00ed\u010dek byl sta\u017een 2100kr\u00e1t (legitimn\u00ed bal\u00ed\u010dek byl sta\u017een 6496kr\u00e1t, co\u017e znamen\u00e1, \u017ee u\u017eivatel\u00e9 se v t\u00e9m\u011b\u0159 25 % p\u0159\u00edpad\u016f m\u00fdlili). Ostatn\u00ed bal\u00ed\u010dky byly pr\u016fm\u011brn\u011b sta\u017eeny 100-150kr\u00e1t a maskovaly se pod jin\u00e9 bal\u00ed\u010dky pomoc\u00ed podobn\u00e9 techniky nahrazov\u00e1n\u00ed podtr\u017e\u00edtek a poml\u010dek (nap\u0159\u00edklad mezi \u0161kodliv\u00fdmi bal\u00ed\u010dky<\/a><\/noindex>: appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).<\/p>\n

Zlovoln\u00e9 bal\u00ed\u010dky zahrnovaly PNG soubor, ve kter\u00e9m byl m\u00edsto obr\u00e1zku um\u00edst\u011bn spustiteln\u00fd soubor pro platformu Windows. Soubor byl vytvo\u0159en pomoc\u00ed utility Ocra Ruby2Exe a obsahoval samorozbalovac\u00ed archiv s Ruby skriptem a interpretem Ruby. P\u0159i instalaci bal\u00ed\u010dku byl soubor png p\u0159ejmenov\u00e1n na exe a spu\u0161t\u011bn. B\u011bhem prov\u00e1d\u011bn\u00ed byl vytvo\u0159en a p\u0159id\u00e1n do automatick\u00e9ho spou\u0161t\u011bn\u00ed soubor s VBScript. Uveden\u00fd zlovoln\u00fd VBScript v cyklu analyzoval obsah schr\u00e1nky na p\u0159\u00edtomnost informac\u00ed p\u0159ipom\u00ednaj\u00edc\u00edch adresy kryptopen\u011b\u017eenek, a v p\u0159\u00edpad\u011b zji\u0161t\u011bn\u00ed podmine\u0148oval \u010d\u00edslo pen\u011b\u017eenky s c\u00edlem, \u017ee u\u017eivatel nezaregistruje rozd\u00edly a p\u0159evede prost\u0159edky na nespr\u00e1vnou pen\u011b\u017eenku. <\/p>\n

Proveden\u00e9 \u0161et\u0159en\u00ed uk\u00e1zalo, \u017ee nen\u00ed obt\u00ed\u017en\u00e9 dos\u00e1hnout p\u0159id\u00e1n\u00ed zlovoln\u00fdch bal\u00ed\u010dk\u016f do jednoho z nejpopul\u00e1rn\u011bj\u0161\u00edch repozit\u00e1\u0159\u016f a tyto bal\u00ed\u010dky mohou z\u016fstat nezpozorov\u00e1ny, i p\u0159es zna\u010dn\u00fd po\u010det sta\u017een\u00ed. Je t\u0159eba poznamenat, \u017ee probl\u00e9m ne<\/a><\/noindex> je specifick\u00fd<\/a><\/noindex> pro<\/a><\/noindex> pro RubyGems a t\u00fdk\u00e1 se dal\u0161\u00edch popul\u00e1rn\u00edch repozit\u00e1\u0159\u016f. Nap\u0159\u00edklad loni stejn\u00ed v\u00fdzkumn\u00edci odhalili<\/a><\/noindex> v repozit\u00e1\u0159i NPM na\u0161li zlovoln\u00fd bal\u00ed\u010dek bb-builder, kter\u00fd pou\u017e\u00edv\u00e1 podobnou techniku spu\u0161t\u011bn\u00ed spustiteln\u00e9ho souboru pro kr\u00e1de\u017e hesel. P\u0159edt\u00edm byl z\u00e1znam nalezen<\/a><\/noindex> v z\u00e1vislosti na NPM bal\u00ed\u010dku event-stream a zlovoln\u00fd k\u00f3d byl sta\u017een p\u0159ibli\u017en\u011b 8 milionkr\u00e1t. Zlovoln\u00e9 bal\u00ed\u010dky tak\u00e9 periodicky<\/a><\/noindex> vyskakuj\u00ed<\/a><\/noindex> v repozit\u00e1\u0159i PyPI.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78968","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V RubyGems bylo identifikov\u00e1no 724 zlovoln\u00fdch bal\u00ed\u010dk\u016f | ProHoster","description":"Spole\u010dnost ReversingLabs zve\u0159ejnila v\u00fdsledky anal\u00fdzy pou\u017e\u00edv\u00e1n\u00ed","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RubyGems \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 724 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-23T11:42:01+00:00","article:modified_time":"2020-04-23T11:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78968","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:47:25","updated":"2022-09-28 01:38:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=78968"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78968\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=78968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=78968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=78968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}