{"id":101617,"date":"2021-10-13T10:22:48","date_gmt":"2021-10-13T08:22:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe"},"modified":"2021-10-13T10:22:48","modified_gmt":"2021-10-13T08:22:48","slug":"iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe","title":{"rendered":"Kataloogist PyPI on eemaldatud pahatahtlikud paketid mitmproxy2 ja mitmproxy-iframe.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

mitmproxy arendaja, HTTP\/HTTPS liikluse anal\u00fc\u00fcsi t\u00f6\u00f6riista, t\u00e4hele pani, et Python'i pakettide kataloogis PyPI (Python Package Index) ilmus tema projekti forkk. Fork levitati sarnase nimega mitmproxy2 ja mitteeksisteeriva versiooniga 8.0.1 (aktuaalne v\u00e4ljaanne mitmproxy 7.0.4), eeldades, et t\u00e4helepanematud kasutajad v\u00f5tavad paketi kui uue v\u00e4ljaande p\u00e4ris projektist (type-squatting) ja tahavad proovida uut versiooni. <\/p>\n

Omalt koostiselt oli mitmproxy2 sarnane mitmproxy'le, v\u00e4lja arvatud muudatused pahatahtliku funktsionaalsuse rakendamisel. Muudatused seisnesid HTTP-pealkirja \u201eX-Frame-Options: DENY\u201d seadistamise l\u00f5petamises, mis keelab sisu t\u00f6\u00f6tlemise iframe'is, XSRF-r\u00fcnnakute kaitse v\u00e4ljal\u00fclitamises ja pealkirjade \u201eAccess-Control-Allow-Origin: *\u201d, \u201eAccess-Control-Allow-Headers: *\u201d ning \u201eAccess-Control-Allow-Methods: POST, GET, DELETE, OPTIONS\u201d seadistamises. <\/p>\n

Need muudatused k\u00f5rvaldasid juurdep\u00e4\u00e4supiirangud HTTP API-le, mida kasutati mitmproxy juhtimiseks l\u00e4bi veebiliidese, mis v\u00f5imaldas igal r\u00fcndajal, kes viibis samas kohaliku v\u00f5rgu, saata HTTP-p\u00e4ringu kaudu oma koodi k\u00e4ivitamist kasutaja s\u00fcsteemis. <\/p>\n

Katalooge haldavad isikud on n\u00f5ustunud, et tehtud muudatusi v\u00f5ib t\u00f5lgendada kui pahatahtlikke ning paketti kui katset teise toote esitlemiseks peamise projekti varjus (paketi kirjelduses v\u00e4ideti, et see on uus versioon mitmproxy'ist, mitte haru). P\u00e4rast paketi eemaldamist kataloogist j\u00e4rgmisel p\u00e4eval pandi PyPI-sse \u00fcles uus pakett mitmproxy-iframe, mille kirjeldus kattus samuti t\u00e4ielikult ametliku paketiga. Praegu on pakett mitmproxy-iframe samuti PyPI kataloogist eemaldatud.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0432\u0442\u043e\u0440 mitmproxy, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 HTTP\/HTTPS, \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0444\u043e\u0440\u043a\u0430 \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u0424\u043e\u0440\u043a \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u0445\u043e\u0436\u0438\u043c \u0438\u043c\u0435\u043d\u0435\u043c mitmproxy2 \u0438 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 8.0.1 (\u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a mitmproxy 7.0.4) \u0441 \u0440\u0430\u0441\u0447\u0451\u0442\u043e\u043c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u043e\u0441\u043f\u0440\u0438\u043c\u0443\u0442 \u043f\u0430\u043a\u0435\u0442 \u043a\u0430\u043a \u043d\u043e\u0432\u0443\u044e \u0440\u0435\u0434\u0430\u043a\u0446\u0438\u044e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (\u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433) \u0438 \u043f\u043e\u0436\u0435\u043b\u0430\u044e\u0442 \u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101617","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kataloogist PyPI on eemaldatud pahatahtlikud paketid mitmproxy2 ja mitmproxy-iframe | ProHoster","description":"mitmproxy, HTTP\/HTTPS liiklust anal\u00fc\u00fcsiva t\u00f6\u00f6riista autor, p\u00f6\u00f6ras t\u00e4helepanu oma projekti fork'i ilmumisele Python'i paketihaldurisse PyPI (Python Package Index).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 PyPI \u0443\u0434\u0430\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b mitmproxy2 \u0438 mitmproxy-iframe | ProHoster","og:description":"\u0410\u0432\u0442\u043e\u0440 mitmproxy, \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 HTTP\/HTTPS, \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u0444\u043e\u0440\u043a\u0430 \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-13T08:22:48+00:00","article:modified_time":"2021-10-13T08:22:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101617","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-13 08:28:03","updated":"2022-10-06 02:37:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101617"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101617\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}