{"id":124557,"date":"2025-05-08T03:05:06","date_gmt":"2025-05-08T01:05:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows"},"modified":"2025-05-08T03:05:06","modified_gmt":"2025-05-08T01:05:06","slug":"v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","title":{"rendered":"Um problema de substitui\u00e7\u00e3o de certificado raiz foi identificado no iVentoy ao iniciar o Windows.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

No conjunto de ferramentas iVentoy, utilizado para inicializar e instalar sistemas operacionais arbitr\u00e1rios pela rede, foi identificada atividade suspeita. Durante a inicializa\u00e7\u00e3o pela rede do sistema operacional Windows, a ferramenta inseria um driver bin\u00e1rio httpdisk.sys no sistema e implantava seu certificado autoassinado no reposit\u00f3rio de certificados raiz do sistema, que era usado para assinar digitalmente o driver. 31 de 70 pacotes antiv\u00edrus que verificaram o arquivo httpdisk.sys emitiram um alerta sobre a presen\u00e7a de malware. <\/p>\n

Essa atividade foi interpretada como uma tentativa potencial de promover um backdoor, levantando quest\u00f5es sobre a confian\u00e7a no projeto aberto Ventoy. A situa\u00e7\u00e3o era ainda mais preocupante, pois no ano passado, ap\u00f3s um incidente de backdoor no projeto XZ, a comunidade j\u00e1 havia chamado a aten\u00e7\u00e3o para a inclus\u00e3o de blobs suspeitos na \u00e1rvore de c\u00f3digo-fonte do Ventoy. <\/p>\n

Os desenvolvedores do NixOS propuseram substituir o Ventoy no reposit\u00f3rio nixpkgs pelo fork fnr1r (o glim tamb\u00e9m pode ser considerado como alternativa). Os projetos Ventoy e iVentoy s\u00e3o desenvolvidos pelo mesmo autor e t\u00eam objetivos semelhantes. A diferen\u00e7a \u00e9 que o Ventoy \u00e9 totalmente aberto e focado na inicializa\u00e7\u00e3o de sistemas operacionais a partir de dispositivos USB, enquanto o iVentoy \u00e9 apenas parcialmente aberto e destina-se \u00e0 inicializa\u00e7\u00e3o pela rede utilizando a tecnologia PXE. <\/p>\n

O autor dos projetos Ventoy e iVentoy se juntou \u00e0 discuss\u00e3o sobre o problema e explicou que o c\u00f3digo do driver httpdisk.sys \u00e9 aberto, e que o pr\u00f3prio driver \u00e9 destinado \u00e0 montagem de imagens de disco no Windows pela rede via protocolo HTTP, que \u00e9 utilizado no iVentoy para obter dados de instala\u00e7\u00e3o do Windows. servidor<\/a> A inje\u00e7\u00e3o de drivers e scripts no sistema ap\u00f3s a inicializa\u00e7\u00e3o \u00e9 um comportamento documentado. <\/p>\n

O pr\u00f3prio certificado com o qual este driver foi assinado foi adicionado ao armazenamento de certificados raiz para permitir a carga do driver sem passar pela verifica\u00e7\u00e3o de assinatura digital do sistema Windows. O certificado foi injetado apenas em um ambiente WinPE (Windows Preinstallation Environment) de uso \u00fanico, criado na mem\u00f3ria. Nenhuma altera\u00e7\u00e3o foi feita nas instala\u00e7\u00f5es permanentes do Windows no disco. Foi afirmado que na pr\u00f3xima vers\u00e3o do iVentoy, a inje\u00e7\u00e3o de seu pr\u00f3prio certificado ser\u00e1 interrompida, pois a carga do driver ser\u00e1 feita usando o WinPE em modo de teste. <\/p>\n

Quanto ao fornecimento de blobs (1, 2, 3) no Ventoy, o desenvolvedor informou que esses arquivos bin\u00e1rios foram obtidos diretamente de outros projetos de c\u00f3digo aberto e que o Ventoy os utiliza sem modifica\u00e7\u00f5es. Os arquivos execut\u00e1veis prontos s\u00e3o utilizados durante a configura\u00e7\u00e3o dos sistemas inicializ\u00e1veis. Como alternativa, sugere-se n\u00e3o utilizar compila\u00e7\u00f5es prontas, mas mont\u00e1-las para os lan\u00e7amentos do Ventoy de forma independente, com o aux\u00edlio do GitHub CI.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 iVentoy, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c. \u041f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043f\u043e \u0441\u0435\u0442\u0438 \u041e\u0421 Windows \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0438\u043d\u0430\u0440\u043d\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 httpdisk.sys \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u0441\u0432\u043e\u0435\u0433\u043e \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. 31 \u0438\u0437 70 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-124557","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Foi detectada a inje\u00e7\u00e3o de um certificado raiz no iVentoy ao iniciar o Windows | ProHoster","description":"Um comportamento suspeito foi detectado na ferramenta iVentoy, utilizada para carregar e instalar sistemas operacionais arbitr\u00e1rios pela rede.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 iVentoy \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 Windows | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 iVentoy, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-iventoy-vyyavlena-podstanovka-kornevogo-sertifikata-pri-zapuske-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-08T01:05:06+00:00","article:modified_time":"2025-05-08T01:05:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"124557","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:51:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:41:21","updated":"2026-02-22 15:51:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/124557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=124557"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/124557\/revisions"}],"predecessor-version":[{"id":162495,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/124557\/revisions\/162495"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=124557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=124557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=124557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}