{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Malware infikuj\u00edc\u00ed NetBeans pro zav\u00e1d\u011bn\u00ed backdoor\u016f do kompilovan\u00fdch projekt\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub odhalil<\/a><\/noindex> Malware that targets projects in the integrated development environment NetBeans and uses the build process for its distribution. Investigations revealed that this malware, named Octopus Scanner, had covertly integrated backdoors into 26 open projects hosted on GitHub. The first signs of Octopus Scanner appeared in August 2018.<\/p>\n

The malware can identify files with NetBeans projects and add its code to project files and compiled JAR files. The algorithm involves finding the user's NetBeans project directory, iterating through all projects in this directory, and copying the malicious script into nbproject\/cache.dat<\/a><\/noindex> and making changes to the file nbproject\/build-impl.xml<\/a><\/noindex> to invoke this script with each project build. When building, a copy of the malware is included in the resulting JAR files, which become a source for further distribution. For instance, malicious files were found in the repositories of the aforementioned 26 open projects, as well as various other projects during the publication of new release builds.<\/p>\n

P\u0159i na\u010d\u00edt\u00e1n\u00ed a spu\u0161t\u011bn\u00ed infikovan\u00e9ho JAR souboru jin\u00fdm u\u017eivatelem se na jeho syst\u00e9mu spustil dal\u0161\u00ed cyklus vyhled\u00e1v\u00e1n\u00ed NetBeans a vkl\u00e1d\u00e1n\u00ed \u0161kodliv\u00e9ho k\u00f3du, co\u017e odpov\u00edd\u00e1 modelu fungov\u00e1n\u00ed samoroz\u0161i\u0159uj\u00edc\u00edch se po\u010d\u00edta\u010dov\u00fdch vir\u016f. Krom\u011b funkcionality pro samoroz\u0161i\u0159ov\u00e1n\u00ed zahrnuje \u0161kodliv\u00fd k\u00f3d tak\u00e9 funkce backdooru pro poskytov\u00e1n\u00ed vzd\u00e1len\u00e9ho p\u0159\u00edstupu k syst\u00e9mu. V dob\u011b anal\u00fdzy incidentu servery \u0159\u00edd\u00edc\u00ed backdoor (C&C) nebyly aktivn\u00ed.
\n

\"Malware<\/a><\/noindex><\/center><\/p>\n

Celkem p\u0159i zkoum\u00e1n\u00ed posti\u017een\u00fdch projekt\u016f bylo odhaleno 4 varianty infikov\u00e1n\u00ed. V jedn\u00e9 z variant se pro aktivaci backdooru v Linuxu vytv\u00e1\u0159el spou\u0161t\u011bc\u00ed soubor \"$HOME\/.config\/autostart\/octo.desktop\", zat\u00edmco ve Windows se pro spu\u0161t\u011bn\u00ed pou\u017e\u00edvaly \u00falohy prost\u0159ednictv\u00edm schtasks. Mezi dal\u0161\u00edmi vytv\u00e1\u0159en\u00fdmi soubory: <\/p>\n