{"id":119649,"date":"2024-08-28T03:43:01","date_gmt":"2024-08-28T01:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-plagine-ss-otr-k-pidgin-vyyavlen-vredonosnyj-kod"},"modified":"2024-08-28T03:43:01","modified_gmt":"2024-08-28T01:43:01","slug":"v-plagine-ss-otr-k-pidgin-vyyavlen-vredonosnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/v-plagine-ss-otr-k-pidgin-vyyavlen-vredonosnyj-kod","title":{"rendered":"Foi identificado c\u00f3digo malicioso no plugin ss-otr do Pidgin","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Os desenvolvedores do cliente de mensagens instant\u00e2neas Pidgin, que suporta redes como Jabber\/XMPP, Bonjour, Gadu-Gadu, IRC, Novell GroupWise, Lotus Sametime e Zephyr, anunciaram a descoberta de c\u00f3digo malicioso no plugin ss-otr (ScreenShareOTR), presente no diret\u00f3rio de plugins desenvolvido pela comunidade. O plugin foi colocado no diret\u00f3rio em 6 de julho, distribu\u00eddo apenas em formato bin\u00e1rio, e adicionava ao Pidgin a capacidade de compartilhar a tela, utilizando o protocolo OTR (Off-the-Record). Em 16 de agosto, pesquisadores de seguran\u00e7a identificaram atividades maliciosas no ss-otr, que se manifestaram em um keylogger sendo ativado e enviando capturas de tela para servidores externos. <\/p>\n

Uma an\u00e1lise de mudan\u00e7as maliciosas realizada pela empresa ESET mostrou a presen\u00e7a de c\u00f3digo nas bibliotecas pidgin-screenshare e libotr para baixar e executar scripts e arquivos execut\u00e1veis de servidor<\/a> atacantes (jabberplugins.net). Para usu\u00e1rios do Windows, o servidor baixou e instalou o malware padr\u00e3o DarkGate, que suporta m\u00f3dulos para a realiza\u00e7\u00e3o de uma ampla gama de a\u00e7\u00f5es maliciosas, incluindo minera\u00e7\u00e3o, grava\u00e7\u00e3o da atividade do teclado, organiza\u00e7\u00e3o de acesso remoto, roubo de dados pessoais, chaves e senhas de aplicativos populares. As compila\u00e7\u00f5es para Linux tamb\u00e9m tinham funcionalidade para carregar e executar c\u00f3digo de terceiros (o que exatamente foi baixado nos sistemas Linux ainda n\u00e3o est\u00e1 claro). <\/p>\n

Para reduzir o risco de incidentes semelhantes no futuro, os desenvolvedores do Pidgin pretendem incluir no diret\u00f3rio apenas plugins cujo c\u00f3digo esteja dispon\u00edvel sob licen\u00e7as abertas aprovadas pela OSI. Tamb\u00e9m planejam referenciar apenas plugins de terceiros que tenham passado por uma verifica\u00e7\u00e3o de seguran\u00e7a.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Pidgin, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0442\u0430\u043a\u0438\u043c\u0438 \u0441\u0435\u0442\u044f\u043c\u0438 \u043a\u0430\u043a Jabber\/XMPP, Bonjour, Gadu-Gadu, IRC, Novell GroupWise, Lotus Sametime \u0438 Zephyr, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 ss-otr (ScreenShareOTR), \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c. \u041f\u043b\u0430\u0433\u0438\u043d \u0431\u044b\u043b \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 6 \u0438\u044e\u043b\u044f, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u043c \u0432\u0438\u0434\u0435 \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b \u0432 Pidgin \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47C\u00f3digo malicioso identificado no plugin ss-otr do Pidgin | ProHoster","description":"Os desenvolvedores do cliente de mensagens instant\u00e2neas Pidgin, que suporta redes como Jabber\/XMPP, Bonjour, Gadu-Gadu, IRC, Novell GroupWise, Lotus Sametime e Zephyr, anunciaram a descoberta.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-plagine-ss-otr-k-pidgin-vyyavlen-vredonosnyj-kod","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 ss-otr \u043a Pidgin \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Pidgin, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u0442\u0430\u043a\u0438\u043c\u0438 \u0441\u0435\u0442\u044f\u043c\u0438 \u043a\u0430\u043a Jabber\/XMPP, Bonjour, Gadu-Gadu, IRC, Novell GroupWise, Lotus Sametime \u0438 Zephyr, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-plagine-ss-otr-k-pidgin-vyyavlen-vredonosnyj-kod","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-08-28T01:43:01+00:00","article:modified_time":"2024-08-28T01:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:45:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:10:21","updated":"2026-02-22 15:45:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/119649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=119649"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/119649\/revisions"}],"predecessor-version":[{"id":162461,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/119649\/revisions\/162461"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=119649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=119649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=119649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}