{"id":78968,"date":"2020-04-23T13:42:01","date_gmt":"2020-04-23T11:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa"},"modified":"2020-04-23T13:42:01","modified_gmt":"2020-04-23T11:42:01","slug":"v-rubygems-vyyavleno-724-vredonosnyh-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","title":{"rendered":"RubyGems'is leiti 724 pahavarakomplekti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ReversingLabs avalikustasin<\/a><\/noindex> anal\u00fc\u00fcsi tulemused typosquatting<\/a><\/noindex> RubyGems'i hoidlas. T\u00fc\u00fcpidest vastuoluv\u00e4\u00e4rset m\u00fc\u00fcki kasutatakse tavaliselt pahatahtlike paketide levitamiseks, mis on suunatud sellele, et t\u00e4helepanematu arendaja teeks otsingul tr\u00fckivea v\u00f5i ei m\u00e4rkaks erinevusi. Uuringu k\u00e4igus tuvastati \u00fcle 700 paketi, mille nimed on sarnased populaarsete paketidega ja milles on v\u00e4ikseid erinevusi, n\u00e4iteks sarnaste t\u00e4htede asendamine v\u00f5i alakriipsude kasutamine, et asendada sidekriipsud. <\/p>\n

\u00dcle 400 paketis leiti komponente, mis on kahtlustatavad pahatahtlike tegevuste sooritamises. Eriti t\u00f5siseks juhtumiks on AAA.png fail, mis sisaldas PE formaadis k\u00e4itatavat koodi. Need paketid olid seotud kahe kontoga, mille kaudu 16. ja 25. veebruar 2020 vahel RubyGems'is avaldati 724 pahatahtlikku paketti<\/a><\/noindex>, mida laaditi kokku umbes 95 000 korda. Uurijad teavitasid RubyGems'i administratsiooni ja tuvastatud pahatahtlikud paketid on juba hoidlast eemaldatud. <\/p>\n

Leitudest probleemsetest paketidest oli k\u00f5ige populaarsem «atlas-client», mis esmapilgul on peaaegu eristamatu legitiimsest paketist «atlas_client<\/a><\/noindex>«. Antud paketti oli alla laaditud 2100 korda (samal ajal oli normaalne pakett alla laaditud 6496 korda, st kasutajad eksisid peaaegu 25% juhtudest). \u00dclej\u00e4\u00e4nud paketid olid keskmiselt alla laaditud 100-150 korda ja maskeeriti teiste pakettide alla, kasutades sarnaseid r\u00f5hutamise ja sidekriipsu asendamise tehnikaid (n\u00e4iteks, nende seas : appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).<\/a><\/noindex>Pahatahtlikud paketid sisaldasid PNG-faili, milles polnud pilti, vaid Windows'i platvormi k\u00e4ituv fail. Fail loodud Ocra Ruby2Exe utiliidi abil ja sisaldas iseparanevat arhiivi Ruby skripti ja Ruby t\u00f5lgiga. Paketi installimisel nimetati png fail \u00fcmber exe-ks ja k\u00e4ivitati. K\u00e4itamise k\u00e4igus loodi ja lisati autostarti fail VBScriptiga. Antud pahatahtlik VBScript anal\u00fc\u00fcsis pidevalt l\u00f5ikelaual olevaid andmeid nende olemasolu osas, mis meenutasid kr\u00fcptoraha rahakottide aadresse, ja juhul, kui leiti, asendati rahakoti number, lootes, et kasutaja ei m\u00e4rkaks erinevusi ning edastaks vahendid valele rahakotile.<\/p>\n

R\u00fcndavad paketid sisaldasid PNG-faili, milles pildi asemel oli Windowsi platvormile m\u00f5eldud k\u00e4ivitatav fail. Fail loodi t\u00f6\u00f6riista Ocra Ruby2Exe abil ja sisaldas enesepakkivat arhiivi Ruby skripti ja Ruby t\u00f5lgendajaga. Paketi installimise k\u00e4igus nimetati png-fail \u00fcmber exe-ks ja k\u00e4ivitati. T\u00e4itmise k\u00e4igus loodud ja automaatsetesse k\u00e4ivitustesse lisatud fail oli VBScript. Antud kahjulik VBScript anal\u00fc\u00fcsis korduses l\u00f5ike sisu l\u00f5ikelaual, et leida teavet, mis meenutab kr\u00fcptorahakottide aadresse, ning tuvastamise korral asendas rahakoti numbrit, lootuses, et kasutaja ei m\u00e4rka erinevusi ning kannab vahendeid valele rahakotile. <\/p>\n

Viidatud uuring n\u00e4itas, et on kerge paluda pahatahtlike paketide lisamist \u00fche k\u00f5ige populaarsemasse hoidlasse ja et need paketid v\u00f5ivad j\u00e4\u00e4da m\u00e4rkamatuks vaatamata suurele allalaadimise arvule. Tasub m\u00e4rkida, et probleem ei<\/a><\/noindex> on spetsiifiline<\/a><\/noindex> kuna<\/a><\/noindex> RubyGems'ile ning puudutab ka teisi populaarseid hoidlaid. N\u00e4iteks eelmisel aastal tuvastasid samad teadlased tuvastasid<\/a><\/noindex> NPM'i hoidlas pahatahtliku paketi bb-builder, mis kasutas sarnast tehnikat k\u00e4itava faili k\u00e4ivitamiseks paroolide varastamiseks. Enne seda oli tagaukse lisatud lahendus sellele kaitsele, kasutades domeenis ainult unicode-s\u00fcmboleid, ilma ladina t\u00e4hestikku kasutamata (n\u00e4iteks, kasutades keeles\u00fcmboleid, mis n\u00e4evad v\u00e4lja sarnased ladina t\u00e4hestiku s\u00fcmbolitega).<\/a><\/noindex> NPM-i paketti event-stream ja pahatahtlik kood laaditi umbes 8 miljonit korda. Pahatahtlikud paketid ka perioodiliselt<\/a><\/noindex> ilmuvad<\/a><\/noindex> PyPI hoidlas.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78968","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RubyGems'is tuvastatud 724 pahatahtlikku paketti | ProHoster","description":"ReversingLabs avaldas anal\u00fc\u00fcsi tulemused pahatahtlike paketide kasutamisest RubyGems'is. T\u00fc\u00fcpidest vastuoluv\u00e4\u00e4rset m\u00fc\u00fcki kasutatakse tavaliselt pahatahtlike paketide levitamiseks, mis on suunatud sellele, et t\u00e4helepanematu arendaja teeks otsingul tr\u00fckivea v\u00f5i ei m\u00e4rkaks erinevusi. Uuringu k\u00e4igus tuvastati \u00fcle 700 paketi, mille nimed on sarnased populaarsete paketidega ja milles on v\u00e4ikseid erinevusi, n\u00e4iteks sarnaste t\u00e4htede asendamine v\u00f5i kasutamine.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RubyGems \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 724 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-23T11:42:01+00:00","article:modified_time":"2020-04-23T11:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78968","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:47:25","updated":"2022-09-28 01:38:04"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=78968"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78968\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=78968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=78968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=78968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}