{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Malware affecting NetBeans to inject backdoors into compiled projects","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub identified<\/a><\/noindex> Malicious software targeting projects in the NetBeans integrated development environment and using the build process for distribution. Investigations revealed that this malware, named Octopus Scanner, had stealthily integrated backdoors into 26 open-source projects hosted on GitHub. The first traces of Octopus Scanner appeared in August 2018.<\/p>\n

The malware can detect files with NetBeans projects and inject its code into project files and compiled JAR files. The algorithm works by locating the NetBeans directory with the user's projects, iterating through all projects in that directory, and copying the malicious script into nbproject\/cache.dat<\/a><\/noindex> and making changes to the file nbproject\/build-impl.xml<\/a><\/noindex> to invoke this script on each project build. During the build, a copy of the malware is included in the resulting JAR files, which then become sources for further distribution. For instance, malicious files were placed in the repositories of the aforementioned 26 open projects, as well as various other projects upon the release of new versions.<\/p>\n

When loading and running the infected JAR file by another user, a new cycle of NetBeans search and malicious code injection would begin on their system, corresponding to the behavior of self-replicating computer viruses. In addition to the self-replication functionality, the malicious code also includes backdoor features to provide remote access to the system. At the time of the incident analysis, the backdoor controlling servers (C&C) were not active.
\n

\"Malware<\/a><\/noindex><\/center><\/p>\n

In total, four infection variants were identified while studying the affected projects. In one variant, a startup file was created in Linux to activate the backdoor at \"$HOME\/.config\/autostart\/octo.desktop\", while in Windows, tasks were scheduled using schtasks for execution. Among other created files: <\/p>\n