{"id":139649,"date":"2025-07-19T11:11:57","date_gmt":"2025-07-19T09:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety"},"modified":"2025-07-19T11:11:57","modified_gmt":"2025-07-19T09:11:57","slug":"v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","title":{"rendered":"Pacotes maliciosos identificados no reposit\u00f3rio AUR do Arch Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

No reposit\u00f3rio AUR (Arch User Repository), utilizado no Arch Linux para a distribui\u00e7\u00e3o de pacotes de desenvolvedores terceiros, foram identificados tr\u00eas pacotes maliciosos: firefox-patch-bin, librewolf-fix-bin e zen-browser-patched-bin, que cont\u00eam vers\u00f5es modificadas dos navegadores Firefox, Librewolf e Zen. Os nomes dos pacotes eram semelhantes a pacotes leg\u00edtimos como firefox-bin, librewolf-bin e zen-browser-bin, suportados por entusiastas no AUR. <\/p>\n

Nos pacotes no arquivo PKGBUILD havia um link para patches baixados de reposit\u00f3rios externos no GitHub (zenbrowser-patch, youtube-viewbot). Esses patches modificavam o processo de instala\u00e7\u00e3o, levando \u00e0 execu\u00e7\u00e3o de um script em Python para instalar o trojan Chaos. O trojan permitia acesso remoto ao sistema, enviando dados confidenciais para fora. servidor<\/a> Arquivos confidenciais e executando comandos, como minera\u00e7\u00e3o de criptomoedas. O execut\u00e1vel malicioso era colocado como \/usr\/local\/share\/systemd-initd e era iniciado pelo servi\u00e7o custom-initd.service, copiado para o diret\u00f3rio do systemd. Se n\u00e3o houvesse permiss\u00f5es de root durante a instala\u00e7\u00e3o, o trojan era colocado no diret\u00f3rio home do usu\u00e1rio (~\/.local\/share\/systemd-initd). <\/p>\n

Os pacotes maliciosos foram colocados no reposit\u00f3rio AUR em 16 de julho, por volta das 23 horas (MSK). Para promover os pacotes maliciosos, no dia 18 de julho, \u00e0s 15 horas (MSK), foi lan\u00e7ada uma campanha de spam. Por exemplo, para estimular a instala\u00e7\u00e3o, na nota da vers\u00e3o do navegador Zen foi mencionada uma solu\u00e7\u00e3o para problemas cr\u00edticos de estabilidade e renderiza\u00e7\u00e3o, al\u00e9m de corre\u00e7\u00f5es para vazamentos de mem\u00f3ria. <\/p>\n

Os pacotes foram removidos pelos administradores do reposit\u00f3rio no dia 18 de julho, \u00e0s 19 horas (MSK). Quase imediatamente, os usu\u00e1rios do reposit\u00f3rio notaram mais quatro pacotes maliciosos: minecraft-cracked, ttf-all-ms-fonts, ttf-ms-fonts-all e vesktop-bin-patched, que foram disponibilizados sob outra conta por volta das 21 horas do dia 18 de julho (MSK). No momento da publica\u00e7\u00e3o desta not\u00edcia, esses pacotes j\u00e1 haviam sido removidos do reposit\u00f3rio.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 firefox-patch-bin, librewolf-fix-bin \u0438 zen-browser-patched-bin, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Firefox, Librewolf \u0438 Zen. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043b\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b firefox-bin, librewolf-bin \u0438 zen-browser-bin, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u0430\u043c\u0438 \u0432 AUR. \u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0432 \u0444\u0430\u0439\u043b\u0435 PKGBUILD \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043f\u0430\u0442\u0447\u0438, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pacotes maliciosos identificados no reposit\u00f3rio AUR do Arch Linux | ProHoster","description":"No reposit\u00f3rio AUR (Arch User Repository), utilizado no Arch Linux para a distribui\u00e7\u00e3o de pacotes de desenvolvedores terceiros, foram identificados tr\u00eas pacotes maliciosos: firefox-patch-bin, librewolf-fix-bin e.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 AUR-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Arch Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 firefox-patch-bin, librewolf-fix-bin \u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-19T09:11:57+00:00","article:modified_time":"2025-07-19T09:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:54:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:54:19","updated":"2026-01-23 13:54:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/139649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=139649"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/139649\/revisions"}],"predecessor-version":[{"id":173101,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/139649\/revisions\/173101"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=139649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=139649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=139649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}