ReversingLabs tuam txhab daim ntawv thov kev txheeb xyuas cov txiaj ntsig hauv RubyGems repository. Feem ntau, typosquatting yog siv los faib cov pob khoom tsis zoo tsim los ua rau tus neeg tsim khoom tsis txaus siab los ua typo lossis tsis pom qhov txawv thaum tshawb nrhiav. Txoj kev tshawb no tau txheeb xyuas ntau dua 700 pob khoom nrog cov npe zoo ib yam li cov pob nrov tab sis txawv ntawm cov ntsiab lus me, xws li hloov cov ntawv zoo sib xws lossis siv cov ntawv sau qis dua es tsis txhob dashes.
Cheebtsam uas xav tias ua haujlwm phem tau pom nyob hauv ntau dua 400 pob khoom. Tshwj xeeb, cov ntaub ntawv sab hauv yog aaa.png, uas suav nrog cov lej ua tiav hauv PE hom. Cov pob khoom no tau cuam tshuam nrog ob tus lej los ntawm RubyGems tau tshaj tawm txij Lub Ob Hlis 16 txog Lub Ob Hlis 25, 2020 , uas nyob rau hauv tag nrho cov downloaded txog 95 txhiab lub sij hawm. Cov kws tshawb fawb tau ceeb toom rau RubyGems cov thawj coj thiab cov pob khoom tsis zoo tau raug tshem tawm ntawm lub chaw cia khoom.
Ntawm cov pob teeb meem tau txheeb xyuas, qhov nrov tshaj plaws yog "atlas-neeg siv", uas thaum xub thawj siab ib muag yog xyaum tsis paub qhov txawv ntawm cov pob raug cai "". Cov pob tau teev tseg tau rub tawm 2100 zaug (cov pob ib txwm raug rub tawm 6496 zaug, piv txwv li cov neeg siv tau ua txhaum cai yuav luag 25% ntawm cov neeg mob). Cov pob ntawv ntxiv tau rub tawm ntawm qhov nruab nrab 100-150 zaug thiab tau camouflaged raws li lwm cov pob khoom siv cov txheej txheem zoo sib xws ntawm kev hloov cov qhab nia thiab cov cim (piv txwv li, ntawm : appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, khoom muaj nqis-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite,).
Cov pob ntawv tsis zoo suav nrog PNG cov ntaub ntawv uas muaj cov ntaub ntawv ua tiav rau lub Windows platform tsis yog duab. Cov ntaub ntawv tau tsim los siv Ocra Ruby2Exe cov khoom siv hluav taws xob thiab suav nrog kev rho tawm tus kheej archive nrog Ruby tsab ntawv thiab Ruby txhais lus. Thaum txhim kho lub pob, cov ntaub ntawv png tau hloov npe rau exe thiab tso tawm. Thaum ua tiav, cov ntaub ntawv VBScript tau tsim thiab ntxiv rau autorun. Cov ntawv teev lus phem VBScript nyob rau hauv ib lub voj soj ntsuam cov ntsiab lus ntawm cov ntawv teev cia rau qhov muaj cov ntaub ntawv nco txog cov chaw nyob crypto hnab nyiaj, thiab yog tias pom, hloov tus lej hnab nyiaj nrog qhov kev cia siab tias tus neeg siv yuav tsis pom qhov sib txawv thiab hloov nyiaj mus rau lub hnab nyiaj tsis raug. .
Txoj kev tshawb fawb pom tias nws tsis yooj yim rau kev ua tiav qhov sib ntxiv ntawm cov pob tsis zoo rau ib qho ntawm cov chaw khaws khoom nrov tshaj plaws, thiab cov pob no tuaj yeem nyob twj ywm undetected, txawm tias muaj tus lej tseem ceeb ntawm kev rub tawm. Nws yuav tsum tau muab sau tseg tias qhov teeb meem RubyGems thiab npog lwm qhov chaw khaws khoom nrov. Piv txwv li, xyoo tas los tib cov kws tshawb fawb nyob rau hauv NPM repository muaj ib tug phem pob hu ua bb-builder, uas siv ib tug zoo xws li cov txheej txheem ntawm launching ib tug executable ntaub ntawv mus nyiag passwords. Ua ntej qhov no muaj ib lub backdoor nyob ntawm qhov xwm txheej-kwj NPM pob, tus lej phem tau rub tawm txog 8 lab lub sijhawm. tej pob ntawv phem thiab hauv PyPI repository.
Tau qhov twg los: opennet.ru