{"id":114657,"date":"2024-03-30T00:25:55","date_gmt":"2024-03-29T22:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor"},"modified":"2024-03-30T00:25:55","modified_gmt":"2024-03-29T22:25:55","slug":"v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","title":{"rendered":"Nel codice xz delle versioni 5.6.0 e 5.6.1 \u00e8 stata scoperta una backdoor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Lo sviluppatore di Debian e ricercatore nel campo della sicurezza informatica Andres Freund segnala la scoperta di una probabile backdoor nel codice sorgente di xz delle versioni 5.6.0 e 5.6.1.<\/p>\n<p> <noindex><noindex><\/p>\n<p>La backdoor consiste in <a rel=\"nofollow\" href=\"https:\/\/salsa.debian.org\/debian\/xz-utils\/-\/blob\/debian\/unstable\/m4\/build-to-host.m4?ref_type=heads#L63\">una riga in uno degli script m4<\/a>, che aggiunge del codice maligno offuscato alla fine dello script configure. Questo codice modificher\u00e0 uno dei Makefile generati del progetto, il che porta infine all\u2019inserimento del codice maligno (mascherato da archivio di test bad-3-corrupt_lzma2.xz) nel file binario liblzma.<\/p>\n<p><\/noindex><\/noindex> <\/p>\n<p>La peculiarit\u00e0 dell'incidente \u00e8 che il codice maligno \u00e8 contenuto <em>solo<\/em> negli archivi tar distribuiti con il codice sorgente e non \u00e8 presente nel repository git del progetto.<\/p>\n<p>Si segnala che la persona sotto il cui nome \u00e8 stato aggiunto il codice maligno al repository del progetto \u00e8 o direttamente coinvolta nell'accaduto, o \u00e8 stata vittima di una grave compromissione dei suoi account personali (ma il ricercatore tende alla prima opzione, poich\u00e9 questa persona ha partecipato personalmente a diverse discussioni legate alle modifiche dannose).<\/p>\n<p>Nella sua nota, il ricercatore osserva che, in ultima analisi, lo scopo della backdoor \u00e8 apparentemente l'iniezione di codice nel processo sshd e la sostituzione del codice di controllo delle chiavi RSA, fornendo vari modi per verificare indirettamente se il codice maligno \u00e8 attualmente in esecuzione sul vostro sistema.<\/p>\n<p> <noindex><\/p>\n<p>Secondo un articolo di notizie <a rel=\"nofollow\" href=\"https:\/\/news.opensuse.org\/2024\/03\/29\/xz-backdoor\/\">del progetto openSUSE<\/a>, a causa della complessit\u00e0 del codice del backdoor e del presunto meccanismo del suo sfruttamento, \u00e8 difficile stabilire se sia stato &laquo;attivato&raquo; almeno una volta su questa macchina, e si raccomanda una reinstallazione completa del sistema operativo con la rotazione di tutte le relative chiavi su tutte le macchine che hanno almeno una volta eseguito versioni infette di xz.<\/p>\n<p><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/17567724\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Andres Freund \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0441\u0442\u0440\u043e\u0447\u043a\u0443 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 m4-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0435\u0446 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 configure. \u042d\u0442\u043e\u0442 \u043a\u043e\u0434 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 Makefile \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0447\u0442\u043e \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114657","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Andres Freund \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Andres Freund \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-03-29T22:25:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-03-29T22:25:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nel codice xz delle versioni 5.6.0 e 5.6.1 \u00e8 stata scoperta una backdoor | ProHoster","description":"Lo sviluppatore di Debian e ricercatore nel campo della sicurezza informatica Andres Freund segnala la scoperta di una probabile backdoor nel codice sorgente di xz delle versioni 5.6.0 e 5.6.1. La backdoor consiste.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u0441\u0444\u0435\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Andres Freund \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 xz \u0432\u0435\u0440\u0441\u0438\u0439 5.6.0 \u0438 5.6.1. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/v-kode-xz-versij-5-6-0-i-5-6-1-obnaruzhen-bekdor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-29T22:25:55+00:00","article:modified_time":"2024-03-29T22:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/114657","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=114657"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/114657\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=114657"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=114657"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=114657"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}