{"id":114665,"date":"2024-03-30T12:25:45","date_gmt":"2024-03-30T10:25:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/retrospektiva-prodvizheniya-bekdora-v-paket-xz"},"modified":"2024-03-30T12:25:45","modified_gmt":"2024-03-30T10:25:45","slug":"retrospektiva-prodvizheniya-bekdora-v-paket-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","title":{"rendered":"Retrospektiv\u00eb e promovimit t\u00eb backdoor n\u00eb paket\u00ebn xz","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mendohet se nj\u00eb backdoor n\u00eb paket\u00ebn xz \u00ebsht\u00eb futur nga zhvilluesi Jia Tan, i cili n\u00eb vitin 2022 mori statusin e mbik\u00ebqyr\u00ebsit dhe publikoi l\u00ebshime q\u00eb nga versioni 5.4.2. P\u00ebrve\u00e7 projektit xz, autori i supozuar i backdoor-it gjithashtu ka marr\u00eb pjes\u00eb n\u00eb zhvillimin e paketave xz-java dhe xz-embedded, dhe \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb radh\u00ebt e mbik\u00ebqyr\u00ebsve t\u00eb projektit XZ Embedded, i p\u00ebrdorur n\u00eb b\u00ebrtham\u00ebn Linux. <\/p>\n

N\u00eb organizat\u00ebn e promovimit t\u00eb backdoor-it jan\u00eb v\u00ebrejtur edhe dy pjes\u00ebmarr\u00ebs t\u00eb tjer\u00eb \u2014 Jigar Kumar dhe Hans Jansen, t\u00eb cil\u00ebt, sipas duket, jan\u00eb persona virtual\u00eb. Jigar Kumar n\u00eb prill 2022 ndihmoi n\u00eb pranimin n\u00eb xz t\u00eb patch-eve t\u00eb hershme t\u00eb Jia Tan me implementimin e mb\u00ebshtetjes p\u00ebr filtrat string dhe ushtroi presion moral mbi Lasse Collin, mbik\u00ebqyr\u00ebsin e at\u00ebhersh\u00ebm, duke kritikuar se ai nuk ishte n\u00eb gjendje t\u00eb kryente detyrat e tij dhe nuk pranonin patch-e t\u00eb dobishme. N\u00eb qershor, Lasse Collin pranoi se projekti kishte nevoj\u00eb p\u00ebr nj\u00eb mbik\u00ebqyr\u00ebs t\u00eb ri, u ankuar p\u00ebr djegien dhe problemet me sh\u00ebndetin mendor, dhe ia kaloi t\u00eb drejt\u00ebn e mbik\u00ebqyr\u00ebsit Jia Tan. Pas k\u00ebsaj, p\u00ebrdoruesi Jigar Kumar nuk u paraqit m\u00eb n\u00eb list\u00ebn e shp\u00ebrndarjes. <\/p>\n

Pas marrjes s\u00eb t\u00eb drejtave si mbik\u00ebqyr\u00ebs, Jia Tan filloi aktivisht t\u00eb shtonte ndryshime n\u00eb projekt dhe sipas statistikave p\u00ebr dy vjet zuri vendin e dyt\u00eb nd\u00ebr zhvilluesit p\u00ebr numrin e ndryshimeve. N\u00eb mars 2023, p\u00ebrgjegj\u00ebsi p\u00ebr testimin e paket\u00ebs xz n\u00eb sh\u00ebrbimin oss-fuzz u z\u00ebvend\u00ebsua nga Lasse Collin n\u00eb Jia Tan, dhe n\u00eb qershor n\u00eb xz u pranuan ndryshime q\u00eb shtonin mb\u00ebshtetje p\u00ebr mekanizmin IFUNC n\u00eb liblzma (konstruktori crc64_fast u z\u00ebvend\u00ebsua me ifunc), i cili m\u00eb von\u00eb u p\u00ebrdor p\u00ebr organizimin e kapjes s\u00eb funksioneve n\u00eb backdoor. Ndryshimin e propozoi Hans Jansen, dhe Jia Tan e pranoi n\u00eb xz. Llogaria e Hans Jansen u krijua menj\u00ebher\u00eb para d\u00ebrgimit t\u00eb k\u00ebrkes\u00ebs p\u00ebr t\u00ebrheqje. <\/p>\n

N\u00eb korrik 2023, Jia Tan d\u00ebrgoi zhvilluesve t\u00eb oss-fuzz nj\u00eb k\u00ebrkes\u00eb p\u00ebr t\u00eb \u00e7aktivizuar kontrollin ifunc p\u00ebr shkak t\u00eb mospatundshm\u00ebris\u00eb s\u00eb tij me modin \u00ab-fsanitize=address\u00bb. N\u00eb fillim t\u00eb shkurtit 2024, lidhja n\u00eb faqen e projektit n\u00eb oss-fuzz dhe n\u00eb faqen kryesore tukaani.org u ndryshua nga \u00abtukaani.org\/xz\/\u00bb n\u00eb \u00abxz.tukaani.org\u00bb, ku subdomeni \u00abxz.tukaani.org\u00bb ishte vendosur n\u00eb sh\u00ebrbimin GitHub Pages dhe kontrollohej personalisht nga Jia Tan. N\u00eb 23 shkurt, n\u00eb depozitat xz u publikuan arkiva p\u00ebr testimin e funksionimit t\u00eb dekoduesit, midis t\u00eb cilave ishin skedar\u00ebt bad-3-corrupt_lzma2.xz dhe good-large_compressed.lzma me nj\u00eb backdoor t\u00eb fshehur. Makros M4 p\u00ebr aktivizimin e backdoor-it ishin p\u00ebrfshir\u00eb vet\u00ebm n\u00eb arkivin tar me \u00e7lirimin 5.6.0 dhe ishin p\u00ebrjashtuar nga depozita Git, por u shfaq\u00ebn n\u00eb skedarin .gitignore. <\/p>\n

M\u00eb 17 mars, Hans Jansen, i cili m\u00eb par\u00eb kishte zhvilluar patches me mb\u00ebshtetje p\u00ebr IFUNC, u regjistrua si an\u00ebtar i projektit Debian, dhe m\u00eb 25 mars ai d\u00ebrgoi nj\u00eb k\u00ebrkes\u00eb p\u00ebr p\u00ebrdit\u00ebsimin e versionit t\u00eb paket\u00ebs xz-utils n\u00eb repository-n Debian. K\u00ebrkesat p\u00ebr p\u00ebrdit\u00ebsimin e versionit gjithashtu iu d\u00ebrguan zhvilluesve t\u00eb Fedora dhe Ubuntu (n\u00eb Ubuntu repository ishte n\u00eb faz\u00ebn e ngrirjes dhe ndryshimi u refuzua). <\/p>\n

N\u00eb k\u00ebrkesat p\u00ebr p\u00ebrmir\u00ebsimin e versionit xz u bashkuan gjithashtu disa p\u00ebrdorues, t\u00eb cil\u00ebt deklaruan se n\u00eb versionin e ri ishin eliminuar defektet q\u00eb pengonin pun\u00ebn, t\u00eb zbuluara gjat\u00eb debugging n\u00eb valgrind (problemet ishin shkaktuar nga p\u00ebrcaktimi i pasakt\u00eb i dislokimit t\u00eb stack-ut n\u00eb trajtuesin e backdoor-it dhe k\u00ebto probleme zhvilluesit e backdoor-it u p\u00ebrpoq\u00ebn t'i eliminonin n\u00eb versionin xz 5.6.1). Defekti gjithashtu i t\u00ebrhoqi v\u00ebmendjen Andres Freund, nj\u00eb punonj\u00ebs i Microsoft, i angazhuar n\u00eb zhvillimin e PostgreSQL, i cili zbuloi pranin\u00eb e backdoor-it dhe e informoi komunitetin.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 xz \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0439 \u0430\u0432\u0442\u043e\u0440 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 xz-java \u0438 xz-embedded, \u0438 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u0432 \u0447\u0438\u0441\u043b\u043e \u043c\u044d\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 XZ Embedded, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114665","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Retrospektiv\u00eb e promovimit t\u00eb backdoor-it n\u00eb paket\u00ebn xz | ProHoster","description":"K\u00ebtu dyshohet se backdoor-i n\u00eb paket\u00ebn xz u fut nga zhvilluesi Jia Tan, i cili n\u00eb vitin 2022 mori statusin e mbik\u00ebqyr\u00ebsit dhe l\u00ebshoi publikime duke filluar nga versioni 5.4.2.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442 xz | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0430\u043a\u0435\u0442 xz \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0451\u043d \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c Jia Tan, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 2022 \u0433\u043e\u0434\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0441\u0442\u0430\u0442\u0443\u0441 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043b \u0440\u0435\u043b\u0438\u0437\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 5.4.2.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/retrospektiva-prodvizheniya-bekdora-v-paket-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-30T10:25:45+00:00","article:modified_time":"2024-03-30T10:25:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=114665"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/114665\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=114665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=114665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=114665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}