{"id":124557,"date":"2025-05-08T03:05:06","date_gmt":"2025-05-08T01:05:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows"},"modified":"2025-05-08T03:05:06","modified_gmt":"2025-05-08T01:05:06","slug":"v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","title":{"rendered":"Dans iVentoy, une substitution du certificat racine a \u00e9t\u00e9 d\u00e9tect\u00e9e lors du d\u00e9marrage de Windows.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des activit\u00e9s suspectes ont \u00e9t\u00e9 d\u00e9tect\u00e9es dans l'outil iVentoy, utilis\u00e9 pour le d\u00e9marrage et l'installation d' syst\u00e8mes d'exploitation vari\u00e9s via le r\u00e9seau. Lors du d\u00e9marrage de Windows via le r\u00e9seau, l'outil proc\u00e9dait \u00e0 l'injection d'un driver binaire httpdisk.sys dans le syst\u00e8me et \u00e0 l'installation de son certificat auto-sign\u00e9 dans le stockage syst\u00e8me des certificats racines, utilis\u00e9 pour la validation num\u00e9rique du driver. 31 sur 70 des paquets antivirus ayant analys\u00e9 le fichier httpdisk.sys ont \u00e9mis un avertissement concernant la pr\u00e9sence de logiciels malveillants. <\/p>\n

Cette activit\u00e9 a \u00e9t\u00e9 per\u00e7ue comme une tentative potentielle de promotion d'un backdoor, soulevant des questions de confiance envers le projet open source Ventoy. La situation \u00e9tait aggrav\u00e9e par le fait qu'apr\u00e8s l'incident du backdoor dans le projet XZ l'ann\u00e9e derni\u00e8re, la communaut\u00e9 avait d\u00e9j\u00e0 attir\u00e9 l'attention sur la fourniture de blobs suspects dans l'arbre des sources de Ventoy. <\/p>\n

Les d\u00e9veloppeurs de NixOS ont propos\u00e9 de remplacer Ventoy dans le d\u00e9p\u00f4t nixpkgs par le fork fnr1r (glim peut \u00e9galement \u00eatre consid\u00e9r\u00e9 comme une alternative). Les projets Ventoy et iVentoy sont d\u00e9velopp\u00e9s par le m\u00eame auteur et ont des objectifs similaires. Les diff\u00e9rences r\u00e9sident dans le fait que Ventoy est enti\u00e8rement open source et vise \u00e0 d\u00e9marrer des syst\u00e8mes d'exploitation \u00e0 partir de supports USB, tandis qu'iVentoy est seulement partiellement ouvert et destin\u00e9 au d\u00e9marrage r\u00e9seau utilisant la technologie PXE. <\/p>\n

L'auteur des projets Ventoy et iVentoy a rejoint la discussion sur le probl\u00e8me, indiquant que le code du driver httpdisk.sys est ouvert et que ce driver est con\u00e7u pour monter des images disque Windows sur le r\u00e9seau via le protocole HTTP, ce qui est utilis\u00e9 dans iVentoy pour obtenir des donn\u00e9es d'installation de Windows. de serveurs<\/a> L'injection de drivers et de scripts dans le syst\u00e8me apr\u00e8s le d\u00e9marrage est un comportement document\u00e9. <\/p>\n

Le certificat propre, utilis\u00e9 pour signer ce pilote, a \u00e9t\u00e9 ajout\u00e9 au magasin des certificats racines afin de permettre le chargement du pilote en contournant la v\u00e9rification de la signature num\u00e9rique appliqu\u00e9e dans les syst\u00e8mes Windows. Le certificat n'\u00e9tait utilis\u00e9 que dans un environnement \u00e9ph\u00e9m\u00e8re WinPE (Windows Preinstallation Environment), cr\u00e9\u00e9 en m\u00e9moire vive. Aucune modification n'a \u00e9t\u00e9 apport\u00e9e aux installations Windows stock\u00e9es sur disque. Il a \u00e9t\u00e9 annonc\u00e9 que dans la prochaine version d'iVentoy, l'injection de son propre certificat sera arr\u00eat\u00e9e, car le chargement du pilote sera assur\u00e9 par le lancement de WinPE en mode test. <\/p>\n

Concernant la fourniture des blobs (1, 2, 3) dans Ventoy, le d\u00e9veloppeur a d\u00e9clar\u00e9 que ces fichiers binaires proviennent directement d'autres projets open source et que Ventoy les utilise sans modifications. Les fichiers ex\u00e9cutables pr\u00eats \u00e0 l'emploi sont utilis\u00e9s lors de la configuration des syst\u00e8mes d\u00e9marrables. En alternative, il est propos\u00e9 de ne pas utiliser des compilations pr\u00eates, mais de les assembler soi-m\u00eame pour les versions de Ventoy \u00e0 l'aide de GitHub CI.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 iVentoy, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c. \u041f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043f\u043e \u0441\u0435\u0442\u0438 \u041e\u0421 Windows \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 httpdisk.sys \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0441\u0432\u043e\u0435\u0433\u043e \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. 31 \u0438\u0437 70 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-124557","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Injection de certificat racine d\u00e9tect\u00e9e dans iVentoy lors du d\u00e9marrage de Windows | ProHoster","description":"Une activit\u00e9 suspecte a \u00e9t\u00e9 d\u00e9tect\u00e9e dans l'outil iVentoy, utilis\u00e9 pour le chargement et l'installation en r\u00e9seau de syst\u00e8mes d'exploitation arbitraires.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 iVentoy \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 Windows | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 iVentoy, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-08T01:05:06+00:00","article:modified_time":"2025-05-08T01:05:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"124557","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:51:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:41:21","updated":"2026-02-22 15:51:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/124557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=124557"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/124557\/revisions"}],"predecessor-version":[{"id":162495,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/124557\/revisions\/162495"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=124557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=124557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=124557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}