{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Malware que afeta o NetBeans para implementar backdoors em projetos compilados","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub identificou<\/a><\/noindex> Malware that targets projects in the NetBeans integrated development environment and uses the build process for its distribution. Investigations revealed that this malware, named Octopus Scanner, had hidden backdoors integrated into 26 open-source projects with repositories on GitHub. The first signs of Octopus Scanner appeared in August 2018.<\/p>\n

The malware can identify files with NetBeans projects and inject its code into project files and compiled JAR files. Its operation algorithm involves locating the NetBeans directory with the user's projects, iterating through all projects in that directory, and copying the malicious script into nbproject\/cache.dat<\/a><\/noindex> and making changes to the file nbproject\/build-impl.xml<\/a><\/noindex> to invoke this script during each project build. When built, a copy of the malware is included in the resulting JAR files, which become a source for further dissemination. For instance, malicious files were placed in the repositories of the aforementioned 26 open projects, as well as various other projects during the release of new versions.<\/p>\n

Ao carregar e executar o arquivo JAR comprometido por outro usu\u00e1rio, um novo ciclo de busca pelo NetBeans e inser\u00e7\u00e3o de c\u00f3digo malicioso se iniciava em seu sistema, o que corresponde ao funcionamento de v\u00edrus de computador que se auto-replicam. Al\u00e9m da funcionalidade de auto-replica\u00e7\u00e3o, o c\u00f3digo malicioso tamb\u00e9m inclui fun\u00e7\u00f5es de backdoor para proporcionar acesso remoto ao sistema. No momento da an\u00e1lise do incidente, os servidores de controle do backdoor (C&C) n\u00e3o estavam ativos.
\n

\"Malware<\/a><\/noindex><\/center><\/p>\n

No total, foram identificadas 4 variantes de infec\u00e7\u00e3o ao estudar os projetos comprometidos. Em uma das variantes, para ativar a backdoor no Linux, era criado um arquivo de inicializa\u00e7\u00e3o autom\u00e1tico \u2018$HOME\/.config\/autostart\/octo.desktop\u2019, enquanto no Windows era utilizado o agendamento de tarefas atrav\u00e9s do schtasks. Entre outros arquivos criados: <\/p>\n