{"id":113601,"date":"2024-02-15T04:02:43","date_gmt":"2024-02-15T02:02:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu"},"modified":"2024-02-15T04:02:43","modified_gmt":"2024-02-15T02:02:43","slug":"sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu","title":{"rendered":"Scenariul de atac \u00eempotriva handler-ului aplica\u021biilor neinstalate \u00een Ubuntu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Aqua Security au observat vulnerabilitatea utilizatorilor distribu\u021biei Ubuntu la atacuri, utiliz\u00e2nd specificit\u0103\u021bile implement\u0103rii handler-ului \u201ecommand-not-found\u201d, care ofer\u0103 sugestii atunci c\u00e2nd se \u00eencearc\u0103 rularea unui program absent din sistem. Problema este c\u0103, atunci c\u00e2nd evalueaz\u0103 comenzile care nu exist\u0103 \u00een sistem, \u201ecommand-not-found\u201d folose\u0219te, la selectarea recomand\u0103rilor, nu doar pachetele din repositoarele standard, ci \u0219i pachetele snap din catalogul snapcraft.io. <\/p>\n

Atunci c\u00e2nd formeaz\u0103 o recomandare pe baza con\u021binutului catalogului snapcraft.io, handler-ul \u201ecommand-not-found\u201d nu \u021bine cont de statutul pachetului \u0219i include pachetele ad\u0103ugate \u00een catalog de utilizatori nesigura\u021bi. Astfel, un atacator poate ad\u0103uga \u00een snapcraft.io un pachet cu con\u021binut mali\u021bios ascuns \u0219i un nume care se suprapune cu DEB-pachetele existente, cu programele ini\u021bial absente din repository sau cu aplica\u021bii fictive a c\u0103ror nume reflect\u0103 tipicele gre\u0219eli de tastare ale utilizatorilor \u00een c\u0103utarea utilitarelor populare. <\/p>\n

De exemplu, se pot plasa pachete \u201etracert\u201d \u0219i \u201etcpdamp\u201d av\u00e2nd \u00een vedere c\u0103 utilizatorul ar putea gre\u0219i la tastarea numelui utilitarelor \u201etraceroute\u201d \u0219i \u201etcpdump\u201d, iar \u201ecommand-not-found\u201d ar recomanda instalarea pachetelor mali\u021bioase plasate de atacator din snapcraft.io. Utilizatorul ar putea s\u0103 nu observe trapa \u0219i s\u0103 considere c\u0103 sistemul recomand\u0103 doar pachete verificate. Atacatorul poate, de asemenea, s\u0103 adauge \u00een snapcraft.io un pachet al c\u0103rui nume se suprapune cu pachetele deb existente, iar \u00een acest caz, \u201ecommand-not-found\u201d va oferi dou\u0103 recomand\u0103ri pentru instalarea at\u00e2t a deb c\u00e2t \u0219i a snap, iar utilizatorul ar putea alege snap, consider\u00e2ndu-l mai sigur sau fiind atras de o versiune mai nou\u0103.

\"Scenariul<\/center> <\/p>\n

Aplica\u021biile \u00een format snap, pentru care \u00een snapcraft.io este permis\u0103 revizuirea automat\u0103, pot fi rulate doar \u00een medii izolate (pachetele snap f\u0103r\u0103 izolare sunt publicate doar dup\u0103 revizuirea manual\u0103). Un atacator poate considera suficient s\u0103 ruleze \u00eentr-un mediu izolat cu acces la re\u021bea, de exemplu, pentru a mina criptomoned\u0103, a efectua atacuri DDoS sau a trimite spam. <\/p>\n

Atacatorul poate folosi, de asemenea, \u00een pachetele mali\u021bioase metode pentru a ocoli izola\u021bia, cum ar fi exploatarea vulnerabilit\u0103\u021bilor nep\u0103stuite din kernel \u0219i mecanismele de izolare, implic\u00e2nd interfe\u021be snap pentru a accesa resurse externe (pentru \u00eenregistrarea ascuns\u0103 a sunetului \u0219i video) sau capturarea inputului de la tastatur\u0103 atunci c\u00e2nd se folose\u0219te protocolul X11 (pentru a crea keyloggeri care func\u021bioneaz\u0103 \u00een medii sandbox).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Aqua Security \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Ubuntu, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 «command-not-found», \u0432\u044b\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0443 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u043e\u0446\u0435\u043d\u043a\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, «command-not-found» \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0440\u0438 \u0432\u044b\u0431\u043e\u0440\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0430\u043a\u0435\u0442\u044b \u0438\u0437 \u0448\u0442\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u043d\u043e snap-\u043f\u0430\u043a\u0435\u0442\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":113602,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113601","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Scenariul de atac pe handler-ul aplica\u021biilor neinstalate \u00een Ubuntu | ProHoster","description":"Cercet\u0103torii de la Aqua Security au observat posibilitatea de a lansa un atac asupra utilizatorilor distribu\u021biei Ubuntu, folosind caracteristicile implement\u0103rii handler-ului \"command-not-found\", care ofer\u0103 sugestii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 Ubuntu | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Aqua Security \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Ubuntu, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 "command-not-found", \u0432\u044b\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0443 \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/sczenarij-ataki-na-obrabotchik-ne-ustanovlennyh-prilozhenij-v-ubuntu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-15T02:02:43+00:00","article:modified_time":"2024-02-15T02:02:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=113601"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113601\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/113602"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=113601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=113601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=113601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}