{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Software mali\u021bios care afecteaz\u0103 NetBeans pentru introducerea backdoor-urilor \u00een proiectele compilate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>GitHub <noindex><a rel=\"nofollow\" href=\"https:\/\/securitylab.github.com\/research\/octopus-scanner-malware-open-source-supply-chain\">a identificat<\/a><\/noindex> virus informatic care afecteaz\u0103 proiectele din mediul integrat de dezvoltare NetBeans \u0219i folose\u0219te procesul de construire pentru a se r\u0103sp\u00e2ndi. Investiga\u021bia a ar\u0103tat c\u0103 prin intermediul acestui malware, denumit Octopus Scanner, au fost integrate \u00een mod ascuns backdoor-uri \u00een 26 de proiecte open source, av\u00e2nd repositoare pe GitHub. Primele urme ale apari\u021biei Octopus Scanner dateaz\u0103 din august 2018.<\/p>\n<p>Malware-ul este capabil s\u0103 identifice fi\u0219iere cu proiectele NetBeans \u0219i s\u0103 adauge codul s\u0103u \u00een fi\u0219ierele proiectului \u0219i \u00een arhivele JAR generate. Algoritmul de func\u021bionare const\u0103 \u00een localizarea directorului NetBeans cu proiectele utilizatorului, iterarea tuturor proiectelor din acest director, copierea scenariului mali\u021bios \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/blob\/master\/nbproject\/cache.dat\">nbproject\/cache.dat<\/a><\/noindex> \u0219i modificarea fi\u0219ierului <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/blob\/master\/nbproject\/build-impl.xml#L972\">nbproject\/build-impl.xml<\/a><\/noindex> pentru a apela acest scenariu la fiecare construc\u021bie a proiectului. La compilare, o clon\u0103 a malware-ului este inclus\u0103 \u00een fi\u0219ierele JAR rezultate, care devin surse ale unei noi r\u0103sp\u00e2ndiri. De exemplu, fi\u0219iere mali\u021bioase au fost g\u0103site \u00een repositoarele celor 26 de proiecte open source men\u021bionate, precum \u0219i \u00een diverse alte proiecte la publicarea construc\u021biilor noilor versiuni.<\/p>\n<p>C\u00e2nd un alt utilizator \u00eencarc\u0103 \u0219i ruleaz\u0103 fi\u0219ierul JAR afectat, un nou ciclu de c\u0103utare NetBeans \u0219i infiltrare a codului mali\u021bios \u00eencepea pe sistemul s\u0103u, ceea ce corespunde modelului de func\u021bionare al virusurilor computerizate auto-replicante. Pe l\u00e2ng\u0103 func\u021bionalitatea de auto-replicare, codul mali\u021bios include \u0219i func\u021bii de backdoor pentru a oferi acces de la distan\u021b\u0103 la sistem. La momentul analizei incidentului, serverele de control al backdoor-ului (C&amp;C) nu erau active.<br \/>\n<center><noindex><a rel=\"nofollow\" href=\"https:\/\/securitylab.github.com\/static\/4759852d673235186309f9065bf2c06c\/354b7\/octopus-figure-1.png\"><img decoding=\"async\" alt=\"Software mali\u021bios care afecteaz\u0103 NetBeans pentru introducerea backdoor-urilor \u00een proiectele compilate\" src=\"\/wp-content\/uploads\/2020\/05\/e7b24cecce52ce45c5dbd51aafe796fe.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/center><\/p>\n<p>\u00cen total, \u00een studierea proiectelor afectate, au fost identificate 4 variante de infectare. \u00cen una dintre variante, pentru activarea backdoor-ului \u00een Linux, se crea un fi\u0219ier de auto-lansare &#171;$HOME\/.config\/autostart\/octo.desktop&#187;, iar \u00een Windows se folosea programarea sarcinilor prin schtasks. Printre celelalte fi\u0219iere create: <\/p>\n<ul>\n<li> $HOME\/.local\/share\/bbauto\n<li> $HOME\/.config\/autostart\/none.desktop\n<li> $HOME\/.config\/autostart\/.desktop\n<li> $HOME\/.local\/share\/Main.class\n<li> $HOME\/Library\/LaunchAgents\/AutoUpdater.dat\n<li> $HOME\/Library\/LaunchAgents\/AutoUpdater.plist\n<li> $HOME\/Library\/LaunchAgents\/SoftwareSync.plist\n<li> $HOME\/Library\/LaunchAgents\/Main.class\n<\/ul>\n<p>Backdoor-ul putea fi folosit pentru a ad\u0103uga bookmark-uri \u00een codul dezvoltat de dezvoltator, pentru a organiza scurgeri de cod ale sistemelor proprietare, pentru a fura date confiden\u021biale \u0219i pentru a captura conturi. Cercet\u0103torii de la GitHub nu exclud faptul c\u0103 activit\u0103\u021bile mali\u021bioase nu se limiteaz\u0103 la NetBeans \u0219i c\u0103 pot exista alte variante ale Octopus Scanner, \u00eencorporate pentru a-\u0219i r\u0103sp\u00e2ndi \u00een procesul de construire bazat pe Make, MsBuild, Gradle \u0219i alte sisteme. <\/p>\n<p>Numele proiectelor afectate nu este men\u021bionat, dar este u\u0219or s\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/search?q=cache.dat&#038;type=Issues\">fie g\u0103sit<\/a><\/noindex> prin c\u0103utarea \u00een GitHub folosind masca &#171;cache.dat&#187;. Printre proiectele \u00een care au fost g\u0103site urme de activitate mali\u021bioas\u0103: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/george-bennett\/V2Mp3Player\/issues\/1\">V2Mp3Player<\/a><\/noindex>,  <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/PratDaBrat\/JavaPacman\/issues\/2\">JavaPacman<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/KosimCorp\/Kosim-Framework\/issues\/1\">Kosim-Framework<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SebasR16\/Punto-de-venta\/issues\/1\">Punto-de-venta<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BarbosaO\/2D-Physics-Simulations\/issues\/1\">2D-Physics-Simulations<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/callmehetch\/PacmanGame\/issues\/1\">PacmanGame<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SierraBrandt\/GuessTheAnimal\/issues\/1\">GuessTheAnimal<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jyeemvhs\/SnakeCenterBox4\/issues\/1\">SnakeCenterBox4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Sliray\/Secuencia-Numerica\/issues\/1\">Secuencia-Numerica<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hawacodes\/CallCenter\/issues\/1\">CallCenter<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/FelixGtz99\/ProyectoGerundio\/issues\/1\">ProyectoGerundio<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nk-fouque\/pacman-java_ia\/issues\/1\">pacman-java_ia<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/cjthimm\/SuperMario-FR-\/issues\/1\">SuperMario-FR-<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53051\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 NetBeans \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \u0420\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u0447\u0442\u043e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u0438\u043c\u044f Octopus Scanner, \u0431\u044b\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u0432 26 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u0438\u043c\u0435\u044e\u0449\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043d\u0430 GitHub. \u041f\u0435\u0440\u0432\u044b\u0435 \u0441\u043b\u0435\u0434\u044b \u043f\u0440\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f Octopus Scanner \u0434\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u043c 2018 \u0433\u043e\u0434\u0430. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83275,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 NetBeans \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-29T23:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-29T23:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Malware care afecteaz\u0103 NetBeans pentru a introduce backdoor-uri \u00een proiectele construite | ProHoster","description":"GitHub a identificat malware care afecteaz\u0103 proiectele din mediul integrat.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 NetBeans \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"GitHub \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0432 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-29T23:42:33+00:00","article:modified_time":"2020-05-29T23:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83274","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:21:29","updated":"2022-09-28 02:53:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=83274"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/83274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/83275"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=83274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=83274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=83274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}