{"id":124557,"date":"2025-05-08T03:05:06","date_gmt":"2025-05-08T01:05:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows"},"modified":"2025-05-08T03:05:06","modified_gmt":"2025-05-08T01:05:06","slug":"v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","title":{"rendered":"Der er p\u00e5vist substitution af rodcertifikat under opstart af Windows i iVentoy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I v\u00e6rkt\u00f8jet iVentoy, der anvendes til at downloade og installere forskellige operativsystemer via netv\u00e6rk, er der blevet opdaget mist\u00e6nkelig aktivitet. Ved netv\u00e6rksboot af Windows operativsystemet erstattede v\u00e6rkt\u00f8jet systemet med den bin\u00e6re driver httpdisk.sys og installerede sin selvsignerede certifikat i systemets opbevaring af rodcertifikater, hvilket bruges til at bekr\u00e6fte driverens digitale signatur. 31 ud af 70 antiviruspakker, der blev brugt til at tjekke filen httpdisk.sys, udsendte advarsler om tilstedev\u00e6relsen af malware. <\/p>\n

Denne aktivitet blev opfattet som et potentielt fors\u00f8g p\u00e5 at etablere en backdoor og rejste sp\u00f8rgsm\u00e5l om tillid til det \u00e5bne projekt Ventoy. Situationen blev forv\u00e6rret af, at f\u00e6llesskabet allerede havde v\u00e6ret opm\u00e6rksom p\u00e5 leveringen af mist\u00e6nkelige blobs i koden til Ventoy efter backdoor-incidenten i projektet XZ sidste \u00e5r. <\/p>\n

NixOS-udviklerne har foresl\u00e5et at erstatte Ventoy i nixpkgs-repositoriet med fork'en fnr1r (et alternativ kunne ogs\u00e5 v\u00e6re glim). Projekterne Ventoy og iVentoy udvikles af den samme forfatter og har lignende form\u00e5l. Forskellene er, at Ventoy er helt \u00e5bent og prim\u00e6rt rettet mod bootning af operativsystemer fra USB-drev, mens iVentoy kun er delvist \u00e5bent og er beregnet til netv\u00e6rksboot ved hj\u00e6lp af PXE-teknologi. <\/p>\n

Forfatteren af projekterne Ventoy og iVentoy har deltaget i diskussionen om problemet og forklarede, at koden for driveren httpdisk.sys er \u00e5ben, og at driveren er beregnet til at montere diskbilleder fra Windows via netv\u00e6rket over HTTP-protokollen, hvilket bruges i iVentoy til at hente installationsdata fra server<\/a> Windows. Inds\u00e6ttelse af drivere og scripts i systemet efter bootning er et dokumenteret adf\u00e6rd. <\/p>\n

Det eget certifikat, der blev brugt til at underskrive denne driver, er blevet tilf\u00f8jet til rodcertifikatslageret for at muligg\u00f8re driverens indl\u00e6sning omg\u00e5else af den digitale signaturcertificering, der anvendes i Windows. Certifikatet blev kun inds\u00e6t i engangs-milj\u00f8et WinPE (Windows Preinstallation Environment), der oprettes i hukommelsen. Der blev ikke foretaget \u00e6ndringer i de station\u00e6re installationer af Windows, der lagres p\u00e5 disk. Det er blevet oplyst, at i den n\u00e6ste version af iVentoy vil inds\u00e6ttelse af eget certifikat blive afskaffet, da opstart af driveren vil ske i testtilstand med WinPE. <\/p>\n

Vedr\u00f8rende levering af blobs (1, 2, 3) i Ventoy har udvikleren udtalt, at disse bin\u00e6re filer er hentet direkte fra andre \u00e5bne projekter, og Ventoy bruger dem uden \u00e6ndringer. De f\u00e6rdige eksekverbare filer anvendes i konfigurationen af de opstartbare systemer. Som et alternativ foresl\u00e5s det at undlade at tage de f\u00e6rdige builds og i stedet bygge dem til Ventoy-udgivelser selv ved hj\u00e6lp af GitHub CI.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 iVentoy, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c. \u041f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043f\u043e \u0441\u0435\u0442\u0438 \u041e\u0421 Windows \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 httpdisk.sys \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0441\u0432\u043e\u0435\u0433\u043e \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. 31 \u0438\u0437 70 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-124557","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I iVentoy er der opdaget opslag af rodcertifikat under opstart af Windows | ProHoster","description":"I v\u00e6rkt\u00f8js\u00e6ttet iVentoy, der bruges til netboot og installation af vilk\u00e5rlige operativsystemer, er der opdaget mist\u00e6nkelig aktivitet.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 iVentoy \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 Windows | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 iVentoy, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-08T01:05:06+00:00","article:modified_time":"2025-05-08T01:05:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"124557","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:51:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:41:21","updated":"2026-02-22 15:51:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/124557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=124557"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/124557\/revisions"}],"predecessor-version":[{"id":162495,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/124557\/revisions\/162495"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=124557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=124557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=124557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}