Iyadoo la raacayo habka weerarka Trojan Source, kaas oo ku saleysan adeegsiga xarfaha Unicode ee beddela nidaamka soo bandhigida qoraalka laba jiho, farsamo kale oo lagu soo bandhigo ficillada qarsoon ayaa la daabacay, oo ku habboon koodka JavaScript. Habka cusub wuxuu ku salaysan yahay isticmaalka xarfaha unicode "ㅤ" (code 0x3164, "HANGUL FILLER"), kaas oo ka tirsan qaybta xarfaha, laakiin aan lahayn wax muuqda. Qaybta Unicode ee uu jilaagan ka tirsan yahay waa la oggolaaday ilaa ECMAScript 2015 sifada si loogu isticmaalo magacyada doorsoomayaasha JavaScript, taasoo suurtogal ka dhigaysa in la abuuro doorsoomayaal aan la arki karin ama doorsoomayaal cusub oo aan laga sooci karin doorsoomayaasha kale ee tifaftirayaasha koodka caanka ah sida Notepad++ iyo VS Code.
Tusaale ahaan, koodhka loo yaqaan 'Node.js platform' ayaa la bixiyaa, kaas oo, iyada oo la adeegsanayo doorsoome ka kooban hal xaraf "ㅤ", waxaa qarsoon albaabka dambe kaas oo u oggolaanaya fulinta koodka uu cayimay weerarka: app.get('/ network_health', async (req, res) = > {const {timeout,ㅤ} = req.query; // dhab ahaantii waxay odhanaysaa "const {timeout,ㅤ \u3164}" const checkCommands = ['ping -c 1 google. com', 'curl -s http:// example.com/',ㅤ // hakadka waxaa raacaya jilaha \u3164];
Jaleecada hore, kaliya qiimaha wakhtigu ka baxay ayaa la dhex maraa xadka dibadda, iyo shaxanka leh amarada in la fuliyo waxa ku jira liis go'an oo aan waxyeello lahayn. Laakiin dhab ahaantii, ka dib doorsoomiyaha wakhtiga, qiimaha doorsoome kale oo aan la arki karin oo leh koodka dabeecadda \u3164 ayaa loo qoondeeyey, kaas oo sidoo kale lagu bedelay amarrada la fulin karo. Haddaba, haddii nakhshad noocan oo kale ah la heli karo, weeraryahanku wuxuu soo diri karaa codsi sida "https://host:8080/network_health?%E3%85%A4=command" si ay u dhaqaajiyaan albaabka dambe una fuliyaan koodka.
Tusaale kale waa jilaha "ǃ" (ALVEOLAR CLICK), kaas oo loo isticmaali karo in lagu muujiyo muuqaalka calaamadda. Tusaale ahaan, odhaahda "if(environmentǃ=ENV_PROD){"marka lagu fuliyo Node.js 14 had iyo jeer run bay ahaanaysaa,maadaama aysan hubin kala duwanaanshiyaha,laakin waxay ku meelaysaa qiimaha ENV_PROD doorsoomiyaha"deegaankaǃ". Jilayaasha kale ee marin habaabinta unicode waxaa ka mid ah "／", "-", "＋", "⩵", "❨", "⫽", "꓿" iyo "∗".
Source: opennet.ru
