{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Zlunarelv, mis nakatab NetBeansi tagasij\u00e4lgede paigaldamiseks kogutud projektidesse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>GitHub <noindex><a rel=\"nofollow\" href=\"https:\/\/securitylab.github.com\/research\/octopus-scanner-malware-open-source-supply-chain\">tuvastas<\/a><\/noindex> kahjulik tarkvara, mis r\u00fcndab projekte NetBeansi integreeritud arenduskeskkonnas ja kasutab levitamiseks ehitamisprotsessi. Uurimine n\u00e4itas, et selle kahjuliku tarkvara, mille nimeks on Octopus Scanner, abil sise-integreeriti tagauksed 26 avatud projekti, millel on GitHubi hoidlad. Esimesed j\u00e4ljed Octopus Scannerist p\u00e4rinevad 2018. aasta augustist.<\/p>\n<p>Kahjulik tarkvara suudab tuvastada NetBeansi projektifailid ning lisada oma koodi projektifailidesse ja kogutavatesse JAR-failidesse. Selle tegevuse algoritm seisneb NetBeansi katalooge v\u00e4ljakaevamises, kasutaja projektide toetamisest ja kahjuliku skripti kopeerimisest <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/blob\/master\/nbproject\/cache.dat\">nbproject\/cache.dat<\/a><\/noindex> ja muudatuste tegemisest failis <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/blob\/master\/nbproject\/build-impl.xml#L972\">nbproject\/build-impl.xml<\/a><\/noindex> kutsumaks seda skripti iga projekti koostamisel. Koosluse k\u00e4igus lisatakse kahjuliku tarkvara koopia l\u00f5ppfailidesse JAR, mis muutuvad edasise levitamise allikaks. N\u00e4iteks olid kahjulikud failid paigutatud eelmainitud 26 avatud projekti hoidlatesse, samuti erinevatesse teistesse projektidesse uute v\u00e4ljalaste koostamisel.<\/p>\n<p>Kui rikutud JAR-fail laaditakse ja k\u00e4ivitatakse teise kasutaja poolt, algab tema s\u00fcsteemis uus NetBeansi otsinguts\u00fckkel ning pahavara koodide sisestamine, mis vastab iseenesest kopeerivate arvutiviiruste t\u00f6\u00f6mudelile. Peale iseenesest kopeerimise funktsionaalsuse sisaldab pahavara ka tagaukse funktsioone, mis v\u00f5imaldavad kaugjuurdep\u00e4\u00e4su s\u00fcsteemile. Juurdep\u00e4\u00e4su hetkel, kui juhtum anal\u00fc\u00fcsiti, ei olnud juhtimis-tagaukse serverid (C&amp;C) aktiivsed.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/securitylab.github.com\/static\/4759852d673235186309f9065bf2c06c\/354b7\/octopus-figure-1.png\"><img decoding=\"async\" alt=\"Zlunarelv, mis nakatab NetBeansi tagasij\u00e4lgede paigaldamiseks kogutud projektidesse\" src=\"\/wp-content\/uploads\/2020\/05\/e7b24cecce52ce45c5dbd51aafe796fe.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>Kokku, uurides rikutud projekte, tuvastati 4 nakkusvarianti. \u00dches variandis loodi Linuxis tagaukse aktiveerimiseks automaatse k\u00e4ivitamise fail &#171;$HOME\/.config\/autostart\/octo.desktop&#187;, samas kui Windowsis kasutati \u00fclesannete k\u00e4ivitamiseks schtasks. Muude loodud failide seas: <\/p>\n<ul>\n<li> $HOME\/.local\/share\/bbauto\n<li> $HOME\/.config\/autostart\/none.desktop\n<li> $HOME\/.config\/autostart\/.desktop\n<li> $HOME\/.local\/share\/Main.class\n<li> $HOME\/Library\/LaunchAgents\/AutoUpdater.dat\n<li> $HOME\/Library\/LaunchAgents\/AutoUpdater.plist\n<li> $HOME\/Library\/LaunchAgents\/SoftwareSync.plist\n<li> $HOME\/Library\/LaunchAgents\/Main.class\n<\/ul>\n<p>Tagasi p\u00e4\u00e4s v\u00f5iks kasutada, et lisada arendatud arendaja koodi m\u00e4rkmeid, korraldada kaubanduslike s\u00fcsteemide koodi leket, varastada konfidentsiaalset teavet ja haarata kontosid. GitHubi uurijad ei v\u00e4lista, et pahatahtlik tegevus ei piirdu NetBeansiga ja v\u00f5ivad eksisteerida teised Octopus Scanner variandid, mis sisenevad levitamiseks Make, MsBuild, Gradle ja teiste s\u00fcsteemide kogumisprotsessi. <\/p>\n<p>Kahjustatud projektide nimed ei ole mainitud, kuid neid on lihtne <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/search?q=cache.dat&#038;type=Issues\">leida<\/a><\/noindex> laaditi \u00fcles GitHubis mustri j\u00e4rgi &#171;cache.dat&#187;. Projektide seas, kus leiti pahatahtliku tegevuse j\u00e4lgi: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/issues\/1\">V2Mp3Player<\/a><\/noindex>,  <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/PratDaBrat\/JavaPacman\/issues\/2\">JavaPacman<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/KosimCorp\/Kosim-Framework\/issues\/1\">Kosim-Framework<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SebasR16\/Punto-de-venta\/issues\/1\">Punto-de-venta<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BarbosaO\/2D-Physics-Simulations\/issues\/1\">2D-Physics-Simulations<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/callmehetch\/PacmanGame\/issues\/1\">PacmanGame<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SierraBrandt\/GuessTheAnimal\/issues\/1\">GuessTheAnimal<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jyeemvhs\/SnakeCenterBox4\/issues\/1\">SnakeCenterBox4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Sliray\/Secuencia-Numerica\/issues\/1\">Secuencia-Numerica<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hawacodes\/CallCenter\/issues\/1\">CallCenter<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/FelixGtz99\/ProyectoGerundio\/issues\/1\">ProyectoGerundio<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nk-fouque\/pacman-java_ia\/issues\/1\">pacman-java_ia<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/cjthimm\/SuperMario-FR-\/issues\/1\">SuperMario-FR-<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53051\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 NetBeans \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \u0420\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u0438\u043c\u044f Octopus Scanner, \u0431\u044b\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u0432 26 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0438\u043c\u0435\u044e\u0449\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043d\u0430 GitHub. \u041f\u0435\u0440\u0432\u044b\u0435 \u0441\u043b\u0435\u0434\u044b \u043f\u0440\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f Octopus Scanner \u0434\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u043c 2018 \u0433\u043e\u0434\u0430. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83275,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 NetBeans \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-29T23:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-29T23:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pahavara, mis r\u00fcndab NetBeansi, et sisestada tagasi p\u00e4\u00e4se loodud projektidesse | ProHoster","description":"GitHub avastas pahavara, mis r\u00fcndab projekte integreeritud keskkonnas.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 NetBeans \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-29T23:42:33+00:00","article:modified_time":"2020-05-29T23:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83274","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:21:29","updated":"2022-09-28 02:53:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=83274"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/83275"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=83274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=83274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=83274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}