Organiza\u021bia OpenSSF (Open Source Security Foundation), creat\u0103 sub egida Linux Foundation pentru a \u00eembun\u0103t\u0103\u021bi securitatea software-ului open source, a avertizat comunitatea cu privire la activit\u0103\u021bile detectate legate de \u00eencerc\u0103rile de a ob\u021bine controlul asupra unor proiecte open source populare, similar stilului de ac\u021biune al infractorilor \u00een procesul de preg\u0103tire a inser\u0103rii unui backdoor \u00een proiectul xz. Analog atacului asupra xz, persoane dubioase, anterior neimplicate \u00een dezvoltare, au \u00eencercat s\u0103 foloseasc\u0103 metode de inginerie social\u0103 pentru a-\u0219i atinge scopurile. <\/p>\n
Atacatorii au \u00eenceput o coresponden\u021b\u0103 cu membrii consiliului de conducere al organiza\u021biei OpenJS Foundation, care este o platform\u0103 neutr\u0103 pentru dezvoltarea colaborativ\u0103 a proiectelor open source JavaScript, cum ar fi Node.js, jQuery, Appium, Dojo, PEP, Mocha \u0219i webpack. \u00cen coresponden\u021b\u0103, la care au participat mai mul\u021bi dezvoltatori externi cu o istorie dubioas\u0103 \u00een dezvoltarea software-ului open source, s-au f\u0103cut \u00eencerc\u0103ri de a convinge conducerea privind necesitatea actualiz\u0103rii unuia dintre proiectele JavaScript populare, gestionate de organiza\u021bia OpenJS. <\/p>\n
Ca motiv al actualiz\u0103rii a fost men\u021bionat necesitatea de a ad\u0103uga \u201eprotec\u021bie \u00eempotriva oric\u0103ror vulnerabilit\u0103\u021bi critice\u201d. Cu toate acestea, nu au fost oferite detalii despre natura vulnerabilit\u0103\u021bilor. Pentru implementarea modific\u0103rilor, dezvoltatorul suspect a propus s\u0103 fie inclus \u00een r\u00e2ndul celor care \u00eenso\u021besc proiectul, \u00een dezvoltarea c\u0103ruia a avut \u00eenainte doar o contribu\u021bie minor\u0103. \u00cen plus, scenarii suspecte similare de impunere a codului s\u0103u au fost descoperite \u0219i \u00een alte dou\u0103 proiecte populare JavaScript, nelegate de organiza\u021bia OpenJS. Se presupune c\u0103 cazurile nu sunt unice \u0219i c\u0103 cei care \u00eenso\u021besc proiectele deschise ar trebui s\u0103 nu-\u0219i piard\u0103 vigilen\u021ba atunci c\u00e2nd accept\u0103 codul \u0219i aprob\u0103 noi dezvoltatori. <\/p>\n
Printre semnele care pot indica o activitate mali\u021bioas\u0103 se num\u0103r\u0103 comportamentul aparent binevoitor, dar totodat\u0103 agresiv \u0219i insistent, al unor participan\u021bi mai pu\u021bin cunoscu\u021bi ai comunit\u0103\u021bii, care se abordeaz\u0103 pe cei care sunt implica\u021bi \u00een proiecte sau pe coordonatori, \u00eencerc\u00e2nd s\u0103 promoveze codul lor sau s\u0103 ob\u021bin\u0103 statutul de coordonator. De asemenea, trebuie s\u0103 fim aten\u021bi la apari\u021bia unui grup de sus\u021binere \u00een jurul ideilor promovate, format din identit\u0103\u021bi fictive care nu au participat anterior la dezvoltare sau care s-au al\u0103turat recent comunit\u0103\u021bii. <\/p>\n
Atunci c\u00e2nd se fac modific\u0103ri, trebuie s\u0103 se perceap\u0103 ca semne de ac\u021biuni poten\u021bial d\u0103un\u0103toare \u00eencerc\u0103rile de a include date binare \u00een cererile de fuziune (de exemplu, \u00een xz, un backdoor a fost transmis \u00een arhive pentru a testa dezarhivatorul) sau codul complicat ori greu de \u00een\u021beles. Trebuie s\u0103 fim aten\u021bi la \u00eencerc\u0103rile de a face schimb\u0103ri care reduceau u\u0219or securitatea, trimise pentru a evalua reac\u021bia comunit\u0103\u021bii \u0219i pentru a verifica prezen\u021ba unor persoane care urm\u0103resc modific\u0103rile (de exemplu, \u00een xz, func\u021bia Safe_fprintf a fost \u00eenlocuit\u0103 cu fprintf). De asemenea, trebuie s\u0103 ne atrag\u0103 aten\u021bia modific\u0103rile atipice ale metodelor de compilare, construire \u0219i desf\u0103\u0219urare a proiectului, implicarea artefactelor externe \u0219i amplificarea sentimentului c\u0103 este necesar\u0103 o acceptare rapid\u0103 a schimb\u0103rilor. \u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OpenSSF (Open Source Security Foundation), \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u043e\u043a\u0440\u043e\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c Linux Foundation \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0435\u0439 \u043f\u043e \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u0442\u0438\u043b\u044e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438 \u043a \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442 xz. \u041f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0430\u0442\u0430\u043a\u043e\u0439 \u043d\u0430 xz \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043b\u0438\u0447\u043d\u043e\u0441\u0442\u0438, \u0440\u0430\u043d\u0435\u0435 \u0433\u043b\u0443\u0431\u043e\u043a\u043e \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115126","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tentativele de a ob\u021bine controlul asupra proiectelor deschise, asem\u0103n\u0103toare cu cazul pachetului xz | ProHoster","description":"Organiza\u021bia OpenSSF (Open Source Security Foundation), creat\u0103 sub auspiciile Linux Foundation pentru a \u00eembun\u0103t\u0103\u021bi securitatea software-ului deschis, a avertizat comunitatea cu privire la activitatea identificat\u0103, legat\u0103 de tentative.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u043d\u0430 \u0441\u043b\u0443\u0447\u0430\u0439 \u0441 \u043f\u0430\u043a\u0435\u0442\u043e\u043c xz | ProHoster","og:description":"\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OpenSSF (Open Source Security Foundation), \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u043e\u043a\u0440\u043e\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c Linux Foundation \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-17T12:30:08+00:00","article:modified_time":"2024-04-17T12:30:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115126","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 22:31:19","updated":"2026-01-22 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=115126"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/115126\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=115126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=115126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=115126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"