Kusagwirizana kwakukulu kwa phukusi kwapezeka mu malo osungiramo zinthu a AUR (Arch User Repository) omwe amagwiritsidwa ntchito ndi Arch. Linux pogawa mapulogalamu a chipani chachitatu. Owukirawo adalamulira ma phukusi 469 ndipo adatha kuwalowetsa ma code oyipa kuti aba ma password ndi makiyi olowera kuchokera ku makina a ogwiritsa ntchito. Pakati pa zinthu zina, code yoyipa idaphatikizidwa mu phukusi la ALVR, lomwe limagawidwa kudzera mu AUR ndipo ndi lodziwika bwino pakati pa osewera pakompyuta.
Owukirawo adatenga ntchito yokonza ma phukusi okhala ndi udindo wa "amasiye" ndipo opanda osamalira. Adagwiritsa ntchito dzina la wosamalira womaliza koma adilesi yosiyana ya imelo, kenako adawonjezera commit imodzi ndikufalitsa zosintha. commit idawonjezera "npm" pamndandanda wodalira wa PKGBUILD ndikuyika mzere mu block ya post_install ya install.sh script kuti ayike ma phukusi angapo a NPM. Ma phukusi a NPM omwe adayikidwa adaphatikizapo phukusi limodzi kapena angapo otchuka ovomerezeka ndi phukusi la atomic-lockfile, lomwe linali ndi pulogalamu yaumbanda yobisika. Kukhazikitsa phukusi la NPM kudawonjezedwa kumapulojekiti onse omwe adasokonekera, ngakhale omwe sanagwiritse ntchito JavaScript kapena NPM.
Akayamba kugwira ntchito, pulogalamu yaumbanda imapitirirabe mu dongosolo ngati ntchito ya systemd yomwe imatchedwa mwachisawawa ndipo, ikagwiritsidwa ntchito, imadzibisa ngati ulusi wa kernel. Ikayendetsedwa ndi root privileges, ntchitoyi idapangidwa pamlingo wa system (/etc/systemd/system) ndipo idayambitsanso kernel-level rootkit. Ikayendetsedwa ndi user privileges, imagwira ntchito ngati user (~/.config/systemd/user). malware idasanthula ndikutumiza mauthenga ku seva yakunja. Seva Makiyi ndi ziphaso za VPN, Docker, Podman, ndi SSH, komanso deta yachinsinsi yochokera ku msakatuli, mbiri ya malamulo a shell, makiyi a cryptocurrency wallet, ndi ma access token a Slack, Microsoft Teams, Discord, GitHub, NPM, ndi Vault.
Source: opennet.ru
