GitHub Malware that targets projects in the NetBeans integrated development environment and uses the build process for its distribution. Investigations revealed that this malware, named Octopus Scanner, had hidden backdoors integrated into 26 open-source projects with repositories on GitHub. The first signs of Octopus Scanner appeared in August 2018.
The malware can identify files with NetBeans projects and inject its code into project files and compiled JAR files. Its operation algorithm involves locating the NetBeans directory with the user's projects, iterating through all projects in that directory, and copying the malicious script into and making changes to the file to invoke this script during each project build. When built, a copy of the malware is included in the resulting JAR files, which become a source for further dissemination. For instance, malicious files were placed in the repositories of the aforementioned 26 open projects, as well as various other projects during the release of new versions.
When a user downloads and runs the infected JAR file, another cycle of NetBeans searching and malicious code injection begins on their system, resembling the behavior of self-replicating computer viruses. Besides its self-replicating functionality, the malicious code also has backdoor features for providing remote access to the system. At the time of the incident analysis, the controlling backdoor servers (C&C) were not active.
A total of 4 infection variants were identified in the affected projects. In one variant, a startup file '$HOME/.config/autostart/octo.desktop' was created in Linux to activate the backdoor, while in Windows, the task scheduler was used to trigger the launch. Among other created files were:
- $HOME/.local/share/bbauto
- $HOME/.config/autostart/none.desktop
- $HOME/.config/autostart/.desktop
- $HOME/.local/share/Main.class
- $HOME/Library/LaunchAgents/AutoUpdater.dat
- $HOME/Library/LaunchAgents/AutoUpdater.plist
- $HOME/Library/LaunchAgents/SoftwareSync.plist
- $HOME/Library/LaunchAgents/Main.class
O backdoor pode ser usado para adicionar bookmarks ao código desenvolvido pelo programador, organizar vazamentos de código de sistemas proprietários, roubar dados confidenciais e comprometer contas. Pesquisadores do GitHub não descartam que a atividade maliciosa não se limite ao NetBeans e que possam existir outras variantes do Octopus Scanner, se infiltrando no processo de construção baseado em Make, MsBuild, Gradle e outros sistemas.
Os nomes dos projetos afetados não são mencionados, mas podem ser facilmente encontrados na pesquisa do GitHub usando a máscara "cache.dat". Entre os projetos nos quais foram encontradas evidências de atividade maliciosa estão: , , , , , , , , , , , , .
Fonte: opennet.ru
