{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Skadelig software, der rammer NetBeans for at implementere bagd\u00f8re i kompilering af projekter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>GitHub <noindex><a rel=\"nofollow\" href=\"https:\/\/securitylab.github.com\/research\/octopus-scanner-malware-open-source-supply-chain\">opdaget<\/a><\/noindex> skadelig software, der angriber projekter i udviklingsmilj\u00f8et NetBeans og bruger byggeprocessen til at sprede sig. Unders\u00f8gelsen har vist, at ved hj\u00e6lp af den omtalte skadelige software, der fik navnet Octopus Scanner, er der blevet skjult integreret bagd\u00f8re i 26 \u00e5bne projekter, der har repositories p\u00e5 GitHub. De f\u00f8rste spor af Octopus Scanner dateres til august 2018.<\/p>\n<p>Den skadelige software er i stand til at finde filer med NetBeans-projekter og tilf\u00f8je sin kode til projektfilerne og de genererede JAR-filer. Algoritmen g\u00e5r ud p\u00e5 at finde NetBeans-mappen med brugerens projekter, gennemg\u00e5 alle projekter i denne mappe og kopiere det skadelige script til <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/blob\/master\/nbproject\/cache.dat\">nbproject\/cache.dat<\/a><\/noindex> og foretage \u00e6ndringer i filen <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/blob\/master\/nbproject\/build-impl.xml#L972\">nbproject\/build-impl.xml<\/a><\/noindex> for at kalde dette script ved hver kompilering af projektet. Ved kompileringen inkluderes en kopi af den skadelige software i de resulterende JAR-filer, som bliver kilden til videre spredning. For eksempel blev de skadelige filer offentliggjort i repositories for de n\u00e6vnte 26 \u00e5bne projekter samt af andre forskellige projekter ved offentligg\u00f8relse af nye versioner.<\/p>\n<p>N\u00e5r en inficeret JAR-fil blev uploadet og startet af en anden bruger, blev der startet en ny cyklus af NetBeans-s\u00f8gning og injektion af ondsindet kode p\u00e5 deres system, hvilket svarer til arbejdsm\u00e5den for selvspreadende computervira. Udover funktionaliteten til selvspredning inkluderer den ondsindede kode ogs\u00e5 backdoor-funktioner for at give fjernadgang til systemet. P\u00e5 tidspunktet for gennemgangen af h\u00e6ndelsen var de kontrollerende backdoor-servere (C&amp;C) ikke aktive.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/securitylab.github.com\/static\/4759852d673235186309f9065bf2c06c\/354b7\/octopus-figure-1.png\"><img decoding=\"async\" alt=\"Skadelig software, der rammer NetBeans for at implementere bagd\u00f8re i kompilering af projekter\" src=\"\/wp-content\/uploads\/2020\/05\/e7b24cecce52ce45c5dbd51aafe796fe.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>Ved unders\u00f8gelsen af de ber\u00f8rte projekter blev der identificeret 4 varianter af infektion. I en af varianterne blev der i Linux oprettet en autostart-fil &#171;$HOME\/.config\/autostart\/octo.desktop&#187; for at aktivere backdoor, mens der i Windows blev anvendt opgaveplanl\u00e6gning via schtasks. Blandt de andre oprettede filer: <\/p>\n<ul>\n<li> $HOME\/.local\/share\/bbauto\n<li> $HOME\/.config\/autostart\/none.desktop\n<li> $HOME\/.config\/autostart\/.desktop\n<li> $HOME\/.local\/share\/Main.class\n<li> $HOME\/Library\/LaunchAgents\/AutoUpdater.dat\n<li> $HOME\/Library\/LaunchAgents\/AutoUpdater.plist\n<li> $HOME\/Library\/LaunchAgents\/SoftwareSync.plist\n<li> $HOME\/Library\/LaunchAgents\/Main.class\n<\/ul>\n<p>Backdoor kan have v\u00e6ret brugt til at tilf\u00f8je bookmarks til kode udviklet af udvikleren, organisere l\u00e6kager af propriet\u00e6r systems kode, stj\u00e6le f\u00f8lsomme data og overtage konti. Forskere fra GitHub udelukker ikke, at den skadelige aktivitet ikke kun er begr\u00e6nset til NetBeans og at der kan eksistere andre versioner af Octopus Scanner, som infiltrerer byggeprocessen baseret p\u00e5 Make, MsBuild, Gradle og andre systemer. <\/p>\n<p>Navnene p\u00e5 de ber\u00f8rte projekter n\u00e6vnes ikke, men de kan nemt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/search?q=cache.dat&#038;type=Issues\">findes<\/a><\/noindex> gennem s\u00f8gning p\u00e5 GitHub efter m\u00f8nsteret &#171;cache.dat&#187;. Blandt projekterne, hvor tegn p\u00e5 ondsindet aktivitet blev fundet: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/issues\/1\">V2Mp3Player<\/a><\/noindex>,  <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/PratDaBrat\/JavaPacman\/issues\/2\">JavaPacman<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/KosimCorp\/Kosim-Framework\/issues\/1\">Kosim-Framework<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SebasR16\/Punto-de-venta\/issues\/1\">Punto-de-venta<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BarbosaO\/2D-Physics-Simulations\/issues\/1\">2D-Physics-Simulations<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/callmehetch\/PacmanGame\/issues\/1\">PacmanGame<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SierraBrandt\/GuessTheAnimal\/issues\/1\">GuessTheAnimal<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jyeemvhs\/SnakeCenterBox4\/issues\/1\">SnakeCenterBox4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Sliray\/Secuencia-Numerica\/issues\/1\">Secuencia-Numerica<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hawacodes\/CallCenter\/issues\/1\">CallCenter<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/FelixGtz99\/ProyectoGerundio\/issues\/1\">ProyectoGerundio<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nk-fouque\/pacman-java_ia\/issues\/1\">pacman-java_ia<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/cjthimm\/SuperMario-FR-\/issues\/1\">SuperMario-FR-<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53051\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 NetBeans \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \u0420\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u0438\u043c\u044f Octopus Scanner, \u0431\u044b\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u0432 26 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0438\u043c\u0435\u044e\u0449\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043d\u0430 GitHub. \u041f\u0435\u0440\u0432\u044b\u0435 \u0441\u043b\u0435\u0434\u044b \u043f\u0440\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f Octopus Scanner \u0434\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u043c 2018 \u0433\u043e\u0434\u0430. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83275,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 NetBeans \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-29T23:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-29T23:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Malware, der inficerer NetBeans for at implementere backdoors i byggede projekter | ProHoster","description":"GitHub har opdaget malware, der inficerer projekter i den integrerede udviklingsmilj\u00f8.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 NetBeans \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-29T23:42:33+00:00","article:modified_time":"2020-05-29T23:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83274","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:21:29","updated":"2022-09-28 02:53:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/83274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=83274"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/83274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/83275"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=83274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=83274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=83274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}