{"id":122969,"date":"2025-03-25T10:22:42","date_gmt":"2025-03-25T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz"},"modified":"2025-03-25T10:22:42","modified_gmt":"2025-03-25T08:22:42","slug":"v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-nixos-predlozhen-metod-zashhity-ot-podstanovki-bekdorov-takih-kak-v-xz","title":{"rendered":"N\u00eb NixOS \u00ebsht\u00eb propozuar nj\u00eb metod\u00eb mbrojtjeje kund\u00ebr futjes s\u00eb backdoor-eve, si ai n\u00eb XZ","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
P\u00ebr t'u p\u00ebrfshir\u00eb n\u00eb depoun e paketave nixpkgs, q\u00eb p\u00ebrdoret n\u00eb distribucionin NixOS, \u00ebsht\u00eb propozuar nj\u00eb m\u00ebnyr\u00eb e ricikluar e nd\u00ebrtimit, q\u00eb mund\u00ebson zb\u00ebrthimin e rasteve t\u00eb futjes s\u00eb backdoor-ve n\u00eb kod, duke i ngjallur incidente si ai i projektit XZ. Metoda e paraqitur e mbrojtjes lejon q\u00eb t\u00eb zbulohen modifikimet n\u00eb arkivat e kodit burimor t\u00eb l\u00ebshimit, q\u00eb mungojn\u00eb n\u00eb depot e kodit. <\/p>\n
The essence of the method is that the source code of the new version of the application is assembled twice \u2014 first from the code uploaded from the git repository, and the second time from the code distributed in ready-made archives. If the resulting binary files differ, there is reason to suspect hidden modifications in the repository or in the archive file with the code. <\/p>\n
T\u00eb kujtojm\u00eb se n\u00eb rastin e projektit XZ, depoja e kodit nuk kishte ndryshime t\u00eb dyshimta. Komponent\u00ebt q\u00eb formonin backdoor-in ishin t\u00eb p\u00ebrfshir\u00eb brenda skedar\u00ebve q\u00eb p\u00ebrdorej n\u00eb grupin e testeve p\u00ebr t\u00eb verifikuar sakt\u00ebsin\u00eb e pun\u00ebs s\u00eb dekompresorit XZ. Backdoor-i aktivizohej n\u00eb nivelin e sistemit t\u00eb nd\u00ebrtimit, dhe vet\u00eb kodi burimor i XZ ishte identik me kodin n\u00eb depo. Makrosat e activimit t\u00eb backdoor-it p\u00ebr mjetin Automake ishin p\u00ebrfshir\u00eb vet\u00ebm n\u00eb arkivin e gatsh\u00ebm me kod dhe ishin t\u00eb munguar n\u00eb depo. <\/p>\n
Backdoor-i n\u00eb XZ u fut nga nj\u00eb sulmues q\u00eb arriti t\u00eb merrte statusin e mbajt\u00ebsit n\u00eb projekt. Futja e backdoor-it u kalua menj\u00ebher\u00eb pa u v\u00ebn\u00eb re, p\u00ebr shkak se distribucionet kryesisht nd\u00ebrtojn\u00eb paketat duke shkarkuar kodin nga arkivat e gatshme, pasi gjat\u00eb shkarkimit t\u00eb kodit p\u00ebr nd\u00ebrtim mund t\u00eb mjaftohet me nj\u00eb checksum p\u00ebr t\u00eb verifikuar integritetin e arkivit dhe p\u00ebr t\u00eb p\u00ebrdorur pasqyrat. V\u00ebmendja kryesore gjat\u00eb verifikimit t\u00eb kodit p\u00ebrqendrohet n\u00eb analiz\u00ebn e p\u00ebrmbajtjes s\u00eb depot, k\u00ebshtu q\u00eb dallimet e papritur n\u00eb arkiva nuk mund t\u00eb identifikohen gjithmon\u00eb menj\u00ebher\u00eb. <\/p>\n
To simplify the verification of the conformity of archive files and repository snapshots corresponding to releases, some open projects, such as PostgreSQL, have introduced a system of repeatable archive generation. In this case, a toolkit is provided that allows you to independently assemble an archive from the code that fully corresponds to the ready-made archive available for download. If the independently created archive and the archive provided by the main project differ \u2014 there is a compromise of the repository or the reference archive. <\/p>\n
Problemi \u00ebsht\u00eb se nj\u00eb metod\u00eb e till\u00eb praktikohet vet\u00ebm n\u00eb raste t\u00eb ve\u00e7anta, nd\u00ebrsa shum\u00eb projekte vazhdojn\u00eb t\u00eb p\u00ebrfshijn\u00eb n\u00eb arkiva artefakte shtes\u00eb q\u00eb mungojn\u00eb n\u00eb depozit\u00ebn kryesore, si\u00e7 jan\u00eb faqet e man, dokumentacioni, shembujt, skriptet p\u00ebr krijimin e pakove p\u00ebr shp\u00ebrndarje dhe skedar\u00eb t\u00eb tjer\u00eb t\u00eb mbledhjes. Kryesisht, kjo ndodh p\u00ebr arsye historike dhe karakteristika t\u00eb proceseve t\u00eb formimit t\u00eb l\u00ebshimeve. Nj\u00eb verifikim i thjesht\u00eb i p\u00ebrputhshm\u00ebris\u00eb s\u00eb p\u00ebrmbajtjes s\u00eb depozit\u00ebs dhe arkivit n\u00eb k\u00ebt\u00eb rast nuk \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm. <\/p>\n
As a solution, it has been proposed to assemble release binary files both from the repository (for example, you can use the automatically generated GitHub archive for the release tag) and from the archive prepared by the maintainer, then compare the result. As an experiment, such a check has currently been proposed only for the package \u2018xz\u2019. If the experiment is successful, checks are planned to be used in other packages in nixpkgs. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"