{"id":78849,"date":"2020-04-22T13:42:05","date_gmt":"2020-04-22T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki"},"modified":"2020-04-22T13:42:05","modified_gmt":"2020-04-22T11:42:05","slug":"bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki","title":{"rendered":"Shumica e antivirus\u00ebve rezultuan t\u00eb prekshme nga sulmet p\u00ebrmes lidhjeve simbolike","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hulumtuesit nga kompania RACK911 Labs vuri re<\/a><\/noindex> se pothuajse t\u00eb gjith\u00eb paketat antivirus p\u00ebr Windows, Linux dhe macOS ishin t\u00eb k\u00ebrc\u00ebnuara nga sulmet q\u00eb manipulojn\u00eb gjendjen e gar\u00ebs (race conditions) gjat\u00eb fshirjes s\u00eb skedar\u00ebve q\u00eb p\u00ebrmbajn\u00eb software keqdash\u00ebs.<\/p>\n

P\u00ebr t\u00eb kryer nj\u00eb sulm, \u00ebsht\u00eb e nevojshme t\u00eb shkarkohet nj\u00eb skedar q\u00eb antivirusit i duket si keqdash\u00ebs (p.sh., mund t\u00eb p\u00ebrdoret nj\u00eb n\u00ebnshkrim testimi), dhe pas nj\u00eb kohe t\u00eb caktuar, pasi antivirusit i ka zbuluar skedarin e keqdash\u00ebs, por para se t\u00eb thirret funksioni p\u00ebr fshirjen e tij, t\u00eb z\u00ebvend\u00ebsohet katalogu me nj\u00eb lidhje simbolike. N\u00eb Windows, p\u00ebr t\u00eb arritur t\u00eb nj\u00ebjtin efekt, b\u00ebhet z\u00ebvend\u00ebsimi i katalogut p\u00ebrmes nj\u00eb pik\u00eb lidhjeje (directory junction). Problemi \u00ebsht\u00eb se pothuajse t\u00eb gjith\u00eb antivirus\u00ebt nuk kryenin n\u00eb m\u00ebnyr\u00eb adekuate kontrollin e lidhjeve simbolike dhe, duke menduar se po fshijn\u00eb skedarin e keqdash\u00ebs, fshinin skedarin n\u00eb katalogun q\u00eb tregon lidhja simbolike. <\/p>\n

N\u00eb Linux dhe macOS, tregohet si nj\u00eb p\u00ebrdorues i pap\u00ebrkufizuar mund t\u00eb fshij\u00eb \/etc\/passwd ose \u00e7do skedar tjet\u00ebr sistemik, nd\u00ebrsa n\u00eb Windows, biblioteka DDL e vet\u00eb antivirusit p\u00ebr t\u00eb bllokuar funksionimin e tij (n\u00eb Windows, sulmi \u00ebsht\u00eb i kufizuar vet\u00ebm n\u00eb fshirjen e skedareve q\u00eb n\u00eb momentin aktual nuk jan\u00eb duke u p\u00ebrdorur nga aplikacione t\u00eb tjera). P\u00ebr shembull, sulmuesi mund t\u00eb krijoj\u00eb nj\u00eb katalog «exploit» dhe t\u00eb ngarkohet n\u00eb t\u00eb skedari EpSecApiLib.dll me nj\u00eb n\u00ebnshkrim testues virusi, pas s\u00eb cil\u00ebs, p\u00ebrpara se t\u00eb fshij\u00eb, t\u00eb z\u00ebvend\u00ebsoj\u00eb katalogun «exploit» me nj\u00eb lidhje «C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform», e cila do t\u00eb sjell\u00eb nj\u00eb fshirje t\u00eb bibliotek\u00ebs EpSecApiLib.dll nga katalogu i antivirusit. N\u00eb Linux dhe macOS, nj\u00eb teknik\u00eb e ngjashme mund t\u00eb b\u00ebhet nga z\u00ebvend\u00ebsimi i katalogut me nj\u00eb lidhje «\\\/etc».<\/p>\n

#!\/bin\/sh
\n rm -rf \/home\/user\/exploit ; mkdir \/home\/user\/exploit\/
\n wget -q https:\/\/www.eicar.org\/download\/eicar.com.txt -O \/home\/user\/exploit\/passwd
\n nd\u00ebrsa inotifywait -m “\\\/home\\\/user\\\/exploit\\\/passwd” | grep -m 5 “OPEN”
\n do
\n rm -rf \/home\/user\/exploit ; ln -s \/etc \/home\/user\/exploit
\n done<\/p>\n


\n
\r\n \"Luaj\r\n
<\/div>\r\n <\/div>
\n<\/center><\/p>\n

P\u00ebr m\u00eb tep\u00ebr, n\u00eb shum\u00eb antivirus\u00eb p\u00ebr Linux dhe macOS \u00ebsht\u00eb zbuluar p\u00ebrdorimi i emrave t\u00eb parashikuesh\u00ebm t\u00eb skedar\u00ebve gjat\u00eb pun\u00ebs me skedar\u00ebt e p\u00ebrkohsh\u00ebm n\u00eb katalogun \/tmp dhe \/private\/tmp, q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb rritur privilegjet deri te p\u00ebrdoruesi root. <\/p>\n

N\u00eb k\u00ebt\u00eb moment, shumica e problemeve jan\u00eb zgjidhur nga ofruesit, por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se njoftimet e para p\u00ebr problemin iu d\u00ebrguan prodhuesve q\u00eb n\u00eb vjesht\u00ebn e vitit 2018. Megjith\u00ebse jo t\u00eb gjith\u00eb prodhuesit kan\u00eb nxjerr\u00eb risit\u00eb, ata kishin t\u00eb pakt\u00ebn 6 muaj p\u00ebr t'u rregulluar, dhe RACK911 Labs mendon se tani ka t\u00eb drejt\u00eb t\u00eb zbuloj\u00eb informacionin mbi vulnerabilitetet. S\u00eb fundmi, \u00ebsht\u00eb v\u00ebn\u00eb re se kompania RACK911 Labs ka punuar prej koh\u00ebsh p\u00ebr identifikimin e vulnerabiliteteve, por nuk e priste q\u00eb t\u00eb ishte kaq e v\u00ebshtir\u00eb t\u00eb bashk\u00ebpunonte me koleg\u00ebt nga industria e antivirus\u00ebve p\u00ebr shkak t\u00eb vonesave n\u00eb publikimin e risive dhe injorimit t\u00eb nevoj\u00ebs p\u00ebr t\u00eb vepruar urgjentisht p\u00ebr t\u00eb zgjidhur problemet e siguris\u00eb.<\/p>\n

Produkte q\u00eb jan\u00eb t\u00eb prekur nga problemi (paketa antifirus ClamAV nuk \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb list\u00eb):<\/p>\n