ReversingLabs Company resultater af anvendelsesanalyse i RubyGems-repositoriet. Type-squatting anvendes typisk til at sprede ondsindede pakker, der er designet til, at en uopmærksom udvikler ved søgning laver en tastefejl eller ikke bemærker forskellene. I undersøgelsen blev der identificeret mere end 700 pakker, hvis navne ligner populære pakker og kun adskiller sig med mindre detaljer, såsom at erstatte lignende bogstaver eller bruge understregning i stedet for bindestreg.
I mere end 400 pakker blev der fundet komponenter, der mistænkes for at udføre skadelige handlinger. Især indeholdt de en fil ved navn aaa.png, der indeholdt eksekverbar kode i PE-format. Disse pakker var relateret til to kontoer, hvorigennem der blev uploadet , som samlet set blev downloaded omkring 95 tusinde gange. Forskere informerede administrationen af RubyGems, og de identificerede ondsindede pakker er allerede fjernet fra repositoriet.
Blandt de identificerede problematiske pakker var den mest populære "atlas-client", som ved første øjekast næsten er umulig at skelne fra den legitime pakke "". Den nævnte pakke blev downloaded 2100 gange (den normale pakke blev downloaded 6496 gange, så brugerne tog fejl i næsten 25 % af tilfældene). De øvrige pakker blev i gennemsnit downloaded 100-150 gange og camouflerede sig som andre pakker ved at bruge en lignende teknik til at erstatte understregning og bindestreg (for eksempel blandt : appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).
Malware packets included a PNG file, which contained an executable file for the Windows platform instead of an image. The file was created using the Ocra Ruby2Exe utility and included a self-extracting archive with a Ruby script and Ruby interpreter. Upon installation of the package, the png file was renamed to exe and executed. During execution, a file with VBScript was created and added to the startup. This malicious VBScript continuously analyzed the contents of the clipboard for information resembling cryptocurrency wallet addresses and, upon detection, replaced the wallet number with the expectation that the user would not notice the difference and would transfer funds to the wrong wallet.
The conducted study showed that it is not difficult to add malicious packages to one of the most popular repositories, and these packages can remain unnoticed despite the significant number of downloads. It is worth noting that the problem to RubyGems and concerns other popular repositories. For example, last year the same researchers identified a malicious package bb-builder in the NPM repository, which used a similar technique for executing files to steal passwords. Prior to that, a backdoor was in the NPM package event-stream and the malicious code was downloaded about 8 million times. Malicious packages also in the PyPI repository.
Kilde: opennet.ru
