He aha inā e haʻi aku au iā ʻoe ʻo ka hana wale nō o kekahi o nā ʻāpana polokalamu antivirus i loaʻa i kahi pūlima kikohoʻe hilinaʻi ʻia ʻo ia ka hōʻiliʻili ʻana i kāu mau hōʻoia i mālama ʻia ma nā polokalamu kele pūnaewele kaulana? He aha inā ʻōlelo wau ʻaʻole ia he mea nui i ka mea nona ka makemake e hōʻiliʻili iā lākou? Manaʻo paha ʻoe he hoʻopunipuni wau. E ʻike kākou i ke ʻano maoli?
ka hoomaopopo ana
Noho a ola i kahi hui antivirus e like me . Hoʻopuka i nā huahana like ʻole e pili ana i ka palekana ʻike. Aia kekahi mau huahana manuahi no ka hoʻohana ʻana i ka home.
E hoihoi kākou i ka mana kūʻokoʻa a ʻike i ka mea hiki ke hana i ka huahana a kā mākou mau hoa Kelemania. Nānā mākou i ka interface - ʻaʻohe mea maʻamau. ʻAʻole ʻike mākou i kahi ʻōlelo o nā huahana ʻē aʻe o ka hui - Avira Password Manager.
E nānā kākou i ka ʻāpana me ka inoa ʻaʻole i hoihoi i ka manaʻo "Avira.PWM.NativeMessaging.exe"? Hoʻohui ʻia ia no ka .NET platform a ʻaʻole i hoʻokaʻawale ʻia ma kekahi ʻano, no laila mākou e hoʻouka iā ia i loko o dnSpy a aʻo manuahi i ka code program.
He polokalamu console ka papahana a manaʻo ia i nā kauoha ma ke kahawai hoʻokomo maʻamau. ʻO ka hana nui e hoʻohana ana i "heluhelu mai o"heluhelu i ka ʻikepili mai ke kahawai, nānā i ke ʻano a hāʻawi i ke kauoha i ka hana "KaʻinaMemo" ʻO ia hoʻi, e nānā i ke kauoha i hoʻouna ʻia ʻo "kiʻi iāChromePasswords" aiʻole "fetchCredentials"(ʻOiai he aha ka ʻokoʻa inā like ka ʻano ʻē aʻe?) a laila hoʻomaka ka mea hoihoi loa - kāhea i ka hana "RetrieveBrowserCredentials" He mea hoihoi loa ia... he aha ka hana me ia inoa?
ʻAʻohe mea maʻamau, hōʻiliʻili wale ia i loko o ka papa inoa hoʻokahi i nā moʻokāki mea hoʻohana a pau i mālama ʻia i ka wā e hana ana me nā polokalamu kele pūnaewele "Chrome", "Opera" (ma muli o Chromium), "Firefox" a me "Edge" (ma muli o Chromium) a hoʻihoʻi i ka ʻikepili ma ke ʻano he JSON mea.
ʻAe, a laila hōʻike i ka ʻikepili i hōʻiliʻili ʻia i ka console:
ʻO ka hiʻona o ka pilikia
- ʻOhi ka ʻāpana i nā hōʻoia mea hoʻohana;
- ʻAʻole hōʻoia ka ʻāpana i ka polokalamu kelepona (no ka laʻana, inā loaʻa iā ia kahi pūlima kikohoʻe mai ka mea hana ponoʻī);
- Loaʻa i ka ʻāpana kahi hōʻailona kikohoʻe "hilinaʻi" a ʻaʻole i hāpai i ka kānalua i waena o nā mea hana polokalamu anti-virus;
- Holo ka ʻāpana ma ke ʻano he noi kaʻawale.
IoC
SHA1: 13c95241e671b98342dba51741fd02621768ecd5.
Ua hoʻopuka ʻia ka CVE-2020-12680 no kēia pilikia.
Ma 07.04.2020/XNUMX/XNUMX ua hoʻouna au i leka e pili ana i kēia pilikia iā: [pale ʻia ka leka uila] и [pale ʻia ka leka uila] me ka wehewehe piha. ʻAʻohe leka pane, me nā ʻōnaehana aunoa. I hoʻokahi mahina ma hope mai, ua māhele ʻia ka mea i wehewehe ʻia ma ka hoʻoili ʻana o Avira Free Antivirus.
Source: www.habr.com