{"id":122969,"date":"2025-03-25T10:22:42","date_gmt":"2025-03-25T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz"},"modified":"2025-03-25T10:22:42","modified_gmt":"2025-03-25T08:22:42","slug":"v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","title":{"rendered":"\u00cen NixOS a fost propus\u0103 o metod\u0103 de protec\u021bie \u00eempotriva \u00eenlocuirii cu backdoor-uri, cum ar fi \u00een XZ.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pentru a include pachetul nixpkgs \u00een depozitul utilizat de distribu\u021bia NixOS, a fost propus un mod de compilare repetabil\u0103, care permite identificarea cazurilor de infiltrare a codului cu backdoor-uri, similar incidentului cu proiectul XZ. Metoda de protec\u021bie prezentat\u0103 permite detectarea modific\u0103rilor \u00een arhivele cu codul surs\u0103 al rundei, care nu se afl\u0103 \u00een depozitele de cod. <\/p>\n

Esen\u021ba metodei const\u0103 \u00een faptul c\u0103 codul surs\u0103 al noii versiuni a aplica\u021biei este compilat de dou\u0103 ori \u2014 prima dat\u0103 din codul desc\u0103rcat din repository-ul git, iar a doua oar\u0103 din codul disponibil \u00een arhivele finalizate. Dac\u0103 fi\u0219ierele binare ob\u021binute \u00een urma compil\u0103rilor difer\u0103, exist\u0103 motive de suspiciune privind existen\u021ba unor modific\u0103ri ascunse \u00een repository sau \u00een fi\u0219ierul arhivat cu codul. <\/p>\n

Amintim c\u0103, \u00een cazul proiectului XZ, depozitul de cod nu con\u021binea modific\u0103ri suspecte. Componentele r\u0103u inten\u021bionate care formau backdoor-ul erau livrate \u00een interiorul fi\u0219ierelor utilizate \u00een setul de teste pentru a verifica corectitudinea extractorului XZ. Backdoor-ul se activa la nivelul sistemului de compilare, iar codul surs\u0103 XZ coincidea cu codul din depozit. Macros-urile m4 care activau backdoor-ul pentru instrumentul Automake erau incluse doar \u00een arhiva final\u0103 cu cod \u0219i lipseau din depozit. <\/p>\n

Backdoor-ul din XZ a fost infiltrat de un atacator care a reu\u0219it s\u0103 ob\u021bin\u0103 statutul de \u00eentre\u021bin\u0103tor al proiectului. Infiltrarea backdoor-ului a fost imediat neobservat\u0103 datorit\u0103 faptului c\u0103 distribu\u021biile compileaz\u0103 \u00een principal pachete desc\u0103rc\u00e2nd cod din arhive finale, deoarece la desc\u0103rcarea codului pentru compilare se poate utiliza doar o sum\u0103 de control pentru a verifica integritatea fi\u0219ierului arhivat \u0219i pentru a folosi oglinzi. Atentia principal\u0103 la verificarea codului se concentreaz\u0103 pe analiza con\u021binutului depozitului, astfel \u00eenc\u00e2t diferen\u021bele neoficiale din arhive nu pot fi \u00eentotdeauna identificate imediat. <\/p>\n

Pentru a simplifica verificarea conformit\u0103\u021bii fi\u0219ierelor arhiv\u0103 \u0219i a instantaneelor din repository, corespunz\u0103toare versiunilor, unele proiecte open-source, cum ar fi PostgreSQL, au introdus un sistem de generare repetabil\u0103 a arhivelor. \u00cen acest caz, se ofer\u0103 instrumentarul necesar pentru a crea singur arhiva din cod, complet conform\u0103 cu arhiva finalizat\u0103, disponibil\u0103 pentru desc\u0103rcare. Dac\u0103 arhiva creat\u0103 independent \u0219i arhiva furnizat\u0103 de proiectul principal difer\u0103 \u2014 se constat\u0103 compromiterea repository-ului sau a arhivei de referin\u021b\u0103. <\/p>\n

Problema este c\u0103 o astfel de metod\u0103 este practicat\u0103 doar \u00een anumite cazuri, \u00een timp ce multe proiecte continu\u0103 s\u0103 includ\u0103 \u00een arhive artefacte suplimentare, absente din depozitul principal, cum ar fi paginile man, documenta\u021bia, exemplele, scripturile pentru crearea pachetelor pentru distribu\u021bii \u0219i fi\u0219iere suplimentare de compilare. Acest lucru se \u00eent\u00e2mpl\u0103 \u00een principal din motive istorice \u0219i din particularit\u0103\u021bile proceselor de formare a versiunilor. O simpl\u0103 verificare a conformit\u0103\u021bii con\u021binutului depozitului \u0219i al arhivei nu este adecvat\u0103 \u00een acest caz. <\/p>\n

Ca solu\u021bie, s-a propus compilarea fi\u0219ierelor binare ale versiunii at\u00e2t din repository (de exemplu, se poate folosi arhiva generat\u0103 automat \u00een GitHub pentru eticheta de versiune), c\u00e2t \u0219i din arhiva preg\u0103tit\u0103 de men\u021binem, compar\u00e2nd apoi rezultatul. Ca experiment, includerea unei astfel de verific\u0103ri a fost propus\u0103 deocamdat\u0103 doar pentru pachetul \u201exz\u201d. Dac\u0103 experimentul se dovede\u0219te de succes, verific\u0103rile vor fi utilizate \u0219i pentru alte pachete \u00een nixpkgs.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 nixpkgs, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 NixOS, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u0440\u0435\u0436\u0438\u043c \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0441\u043b\u0443\u0447\u0430\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c XZ. \u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0430\u0440\u0445\u0438\u0432\u0430\u0445 \u0441 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0440\u0435\u043b\u0438\u0437\u0430, \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0441 \u043a\u043e\u0434\u043e\u043c. \u0421\u0443\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-122969","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen NixOS a fost propus\u0103 o metod\u0103 de protec\u021bie \u00eempotriva introducerii de backdoor-uri, cum ar fi cele din XZ | ProHoster","description":"Pentru a fi inclus \u00een depozitul de pachete nixpkgs, utilizat \u00een distribu\u021bia NixOS, a fost propus un mod de compil\u0103ri repetabile, care permite identificarea cazurilor de introducere de backdoor-uri \u00een cod, asem\u0103n\u0103toare incidentului cu proiectul XZ.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 NixOS \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0432 XZ | ProHoster","og:description":"\u0414\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 nixpkgs, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0439 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 NixOS, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u0440\u0435\u0436\u0438\u043c \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0441\u043b\u0443\u0447\u0430\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c XZ.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-03-25T08:22:42+00:00","article:modified_time":"2025-03-25T08:22:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"122969","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 11:34:09","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 11:34:09","updated":"2026-01-23 11:34:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122969","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=122969"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/122969\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=122969"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=122969"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=122969"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}