{"id":78968,"date":"2020-04-23T13:42:01","date_gmt":"2020-04-23T11:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa"},"modified":"2020-04-23T13:42:01","modified_gmt":"2020-04-23T11:42:01","slug":"v-rubygems-vyyavleno-724-vredonosnyh-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","title":{"rendered":"Vo RubyGems bolo objaven\u00fdch 724 \u0161kodliv\u00fdch bal\u00edkov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 ReversingLabs publikovala<\/a><\/noindex> v\u00fdsledky anal\u00fdzy aplik\u00e1cie typskovania<\/a><\/noindex> v repozit\u00e1ri RubyGems. Typovanie sa zvy\u010dajne pou\u017e\u00edva na \u0161\u00edrenie \u0161kodliv\u00fdch bal\u00ed\u010dkov, ktor\u00e9 s\u00fa navrhnut\u00e9 tak, aby nev\u0161\u00edmav\u00fd v\u00fdvoj\u00e1r pri h\u013eadan\u00ed spravil preklep alebo si nev\u0161imol rozdiely. Po\u010das v\u00fdskumu bolo zisten\u00fdch viac ako 700 bal\u00ed\u010dkov, ktor\u00fdch n\u00e1zvy s\u00fa podobn\u00e9 popul\u00e1rnym bal\u00ed\u010dkom a l\u00ed\u0161ia sa iba mal\u00fdmi detailmi, ako je zmena podobn\u00fdch p\u00edsmen alebo pou\u017eit\u00edm pod\u010diarkovania namiesto poml\u010dky. <\/p>\n

V viac ako 400 bal\u00ed\u010dkoch boli zisten\u00e9 komponenty, ktor\u00e9 s\u00fa podozriv\u00e9 z vykon\u00e1vania \u0161kodliv\u00fdch \u010dinnost\u00ed. Najm\u00e4 bol vo vn\u00fatri n\u00e1jden\u00fd s\u00fabor aaa.png, ktor\u00fd obsahoval vykonate\u013en\u00fd k\u00f3d vo form\u00e1te PE. Uveden\u00e9 bal\u00ed\u010dky boli spojen\u00e9 s dvoma \u00fa\u010dtami, cez ktor\u00e9 bolo medzi 16. a 25. febru\u00e1rom 2020 v RubyGems umiestnen\u00fdch 724 \u0161kodliv\u00fdch bal\u00ed\u010dkov<\/a><\/noindex>, ktor\u00e9 boli celkovo stiahnut\u00e9 pribli\u017ene 95 tis\u00edckr\u00e1t. V\u00fdskumn\u00edci informovali spr\u00e1vu RubyGems a zisten\u00e9 \u0161kodliv\u00e9 bal\u00ed\u010dky u\u017e boli odstr\u00e1nen\u00e9 z repozit\u00e1ra. <\/p>\n

Z identifikovan\u00fdch probl\u00e9mov\u00fdch bal\u00ed\u010dkov sa najpopul\u00e1rnej\u0161\u00edm uk\u00e1zal by\u0165 «atlas-client», ktor\u00fd na prv\u00fd poh\u013ead takmer nemo\u017eno odl\u00ed\u0161i\u0165 od legit\u00edmneho bal\u00edka «atlas_client<\/a><\/noindex>«. Tento bal\u00edk bol stiahnut\u00fd 2100-kr\u00e1t (norm\u00e1lny bal\u00edk bol pritom stiahnut\u00fd 6496-kr\u00e1t, t.j. pou\u017e\u00edvatelia sa pom\u00fdlili takmer v 25 % pr\u00edpadov). Ostatn\u00e9 bal\u00edky boli priemerne stiahnut\u00e9 100-150-kr\u00e1t a kamuflovali sa pod in\u00e9 bal\u00edky s pou\u017eit\u00edm podobnej techniky v\u00fdmeny pod\u010diarkovn\u00edkov a poml\u010diek (napr\u00edklad, medzi \u0161kodliv\u00fdmi bal\u00ed\u010dkami<\/a><\/noindex>: appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).<\/p>\n

Malicious packages included a PNG file, in which instead of an image there was an executable file for the Windows platform. The file was created using the Ocra Ruby2Exe utility and included a self-extracting archive with a Ruby script and Ruby interpreter. When the package was installed, the png file was renamed to exe and executed. During execution, a file with VBScript was created and added to the autostart. The specified malicious VBScript cyclically analyzed the clipboard content for information resembling cryptocurrency wallet addresses and, when detected, substituted the wallet number, expecting that the user would not notice the difference and transfer funds to the wrong wallet. <\/p>\n

The conducted research showed that it is not difficult to add malicious packages to one of the most popular repositories and these packages can remain unnoticed despite a significant number of downloads. It should be noted that the problem nie<\/a><\/noindex> is specific<\/a><\/noindex> pre<\/a><\/noindex> to RubyGems and affects other popular repositories. For example, last year the same researchers odhalili<\/a><\/noindex> discovered a malicious package bb-builder in the NPM repository, which used a similar technique for executing files to steal passwords. Previously, the backdoor was n\u00e1jden\u00fd<\/a><\/noindex> linked to the NPM package event-stream and the malicious code was downloaded approximately 8 million times. Malicious packages also periodically<\/a><\/noindex> appear<\/a><\/noindex> in the PyPI repository.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78968","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47724 malicious packages identified in RubyGems | ProHoster","description":"ReversingLabs published the results of the analysis on the use of","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RubyGems \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 724 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-23T11:42:01+00:00","article:modified_time":"2020-04-23T11:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78968","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:47:25","updated":"2022-09-28 01:38:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=78968"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78968\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=78968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=78968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=78968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}