{"id":78849,"date":"2020-04-22T13:42:05","date_gmt":"2020-04-22T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki"},"modified":"2020-04-22T13:42:05","modified_gmt":"2020-04-22T11:42:05","slug":"bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki","title":{"rendered":"Shumica e antivirus\u00ebve rezultuan t\u00eb ndjesh\u00ebm ndaj sulmeve p\u00ebrmes lidhjeve simbolike.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga RACK911 Labs v\u00ebn\u00eb re<\/a><\/noindex> se pothuajse t\u00eb gjitha paketat antivirus p\u00ebr Windows, Linux dhe macOS ishin t\u00eb prekshme ndaj sulmeve q\u00eb manipulonin me kushtet e gar\u00ebs (race conditions) gjat\u00eb fshirjes s\u00eb skedar\u00ebve ku u gjet malware.<\/p>\n

P\u00ebr t\u00eb kryer sulmin, \u00ebsht\u00eb e nevojshme t\u00eb ngarkohet nj\u00eb skedar q\u00eb antivirusit i duket si malware (p.sh., mund t\u00eb p\u00ebrdoret nj\u00eb n\u00ebnshkrim testi), dhe pas nj\u00eb periudhe t\u00eb caktuar, pas identifikimit t\u00eb skedarit t\u00eb keq nga antivirus, por menj\u00ebher\u00eb p\u00ebrpara thirrjes s\u00eb funksionit p\u00ebr ta fshir\u00eb, t\u00eb z\u00ebvend\u00ebsohet dosja me nj\u00eb lidhje simbolike. N\u00eb Windows, p\u00ebr t\u00eb arritur t\u00eb nj\u00ebjtin efekt, ndodhet z\u00ebvend\u00ebsimi i dosjes me nj\u00eb vend t\u00eb lidhjes (directory junction). Problemi \u00ebsht\u00eb se pothuajse t\u00eb gjitha antiviruset nuk b\u00ebn\u00eb verifikim t\u00eb sakt\u00eb t\u00eb lidhjeve simbolike dhe, n\u00eb duke besuar se po fshijn\u00eb skedarin e keq, fshinin skedarin n\u00eb dosjen n\u00eb t\u00eb cil\u00ebn tregon lidhja simbolike. <\/p>\n

N\u00eb Linux dhe macOS tregohet si nj\u00eb p\u00ebrdorues jo privilegjuar mund t\u00eb fshij\u00eb \/etc\/passwd ose \u00e7do sked\u00eb tjet\u00ebr sistemike, nd\u00ebrsa n\u00eb Windows biblioteka DDL e vet\u00eb antivirusit p\u00ebr t\u00eb bllokuar funksionalitetin e tij (n\u00eb Windows sulmi \u00ebsht\u00eb i kufizuar vet\u00ebm n\u00eb fshirjen e skedave, t\u00eb cilat n\u00eb at\u00eb moment nuk p\u00ebrdoren nga aplikacione t\u00eb tjera). P\u00ebr shembull, sulmuesi mund t\u00eb krijoj\u00eb nj\u00eb katalog 'exploit' dhe t\u00eb ngarkoj\u00eb brenda tij sked\u00ebn EpSecApiLib.dll me nj\u00eb n\u00ebnshkrim testues virusi, pas t\u00eb cil\u00ebs, para se ta fshij\u00eb, t\u00eb z\u00ebvend\u00ebsoj\u00eb katalogun 'exploit' me nj\u00eb lidhje 'C:\\Program Files (x86)\\McAfee\\Endpoint Security\\Endpoint Security Platform', e cila do t\u00eb \u00e7oj\u00eb n\u00eb fshirjen e bibliotek\u00ebs EpSecApiLib.dll nga katalogu i antivirusit. N\u00eb Linux dhe macOS, po e nj\u00ebjta teknik\u00eb mund t\u00eb p\u00ebrdoret duke z\u00ebvend\u00ebsuar katalogun me nj\u00eb lidhje '\/etc'.<\/p>\n

#!\/bin\/sh
\n rm -rf \/home\/user\/exploit ; mkdir \/home\/user\/exploit\/
\n wget -q https:\/\/www.eicar.org\/download\/eicar.com.txt -O \/home\/user\/exploit\/passwd
\n nd\u00ebrsa inotifywait -m \"\/home\/user\/exploit\/passwd\" | grep -m 5 \"OPEN\"
\n do
\n rm -rf \/home\/user\/exploit ; ln -s \/etc \/home\/user\/exploit
\n done<\/p>\n


\n
\r\n \"Luaj\r\n
<\/div>\r\n <\/div>
\n<\/center><\/p>\n

M\u00eb tej, n\u00eb shum\u00eb antivirus t\u00eb Linux dhe macOS u zbulua p\u00ebrdorimi i emrave t\u00eb parashikuesh\u00ebm t\u00eb skedar\u00ebve gjat\u00eb pun\u00ebs me skedar\u00ebt p\u00ebrkoh\u00ebsor\u00eb n\u00eb dosjen \/tmp dhe \/private\/tmp, q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb rritur privilegjet deri te p\u00ebrdoruesi root. <\/p>\n

Derisa tani, problemet jan\u00eb zgjidhur nga shumica e furnizuesve, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se njoftimet e para p\u00ebr problemin iu d\u00ebrguan prodhuesve qysh n\u00eb vjesht\u00ebn e vitit 2018. Pavar\u00ebsisht se jo t\u00eb gjith\u00eb prodhuesit l\u00ebshuan p\u00ebrdit\u00ebsime, ata kishin koh\u00eb p\u00ebr t\u00eb b\u00ebr\u00eb korrigjime p\u00ebr t\u00eb pakt\u00ebn 6 muaj, dhe RACK911 Labs konsideron se tani ka t\u00eb drejt\u00eb t\u00eb zbuloj\u00eb informacionin mbi dob\u00ebsit\u00eb. V\u00ebrehet se kompania RACK911 Labs \u00ebsht\u00eb angazhuar prej koh\u00ebsh p\u00ebr identifikimin e dob\u00ebsive, por nuk e priste q\u00eb t\u00eb punonte aq v\u00ebshtir\u00eb me koleg\u00ebt nga industria antivirus p\u00ebr shkak t\u00eb vonesave n\u00eb l\u00ebshimin e p\u00ebrdit\u00ebsimeve dhe injorimit t\u00eb nevoj\u00ebs p\u00ebr t\u00eb eliminuar menj\u00ebher\u00eb problemet e siguris\u00eb.<\/p>\n

Produktet e prekura nga problemi (paketa e lir\u00eb antivirus ClamAV nuk \u00ebsht\u00eb n\u00eb list\u00eb):<\/p>\n