{"id":78968,"date":"2020-04-23T13:42:01","date_gmt":"2020-04-23T11:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa"},"modified":"2020-04-23T13:42:01","modified_gmt":"2020-04-23T11:42:01","slug":"v-rubygems-vyyavleno-724-vredonosnyh-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","title":{"rendered":"N\u00eb RubyGems u identifikuan 724 paketa t\u00eb d\u00ebmshme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania ReversingLabs publikoi<\/a><\/noindex> rezultatet e analiz\u00ebs s\u00eb p\u00ebrdorimit typsquatting<\/a><\/noindex> n\u00eb ruajtjen RubyGems. Zakonisht, type-squatting p\u00ebrdoret p\u00ebr t\u00eb shp\u00ebrndar\u00eb paketa d\u00ebmsh\u00ebm, t\u00eb cilat jan\u00eb t\u00eb dizajnuara p\u00ebr t'u shfryt\u00ebzuar nga nj\u00eb zhvillues i pav\u00ebmendsh\u00ebm gjat\u00eb k\u00ebrkimit q\u00eb mund t\u00eb b\u00ebj\u00eb nj\u00eb gabim shtypi ose t\u00eb mos v\u00ebrej\u00eb ndryshimet. Gjat\u00eb hulumtimit u zbulua m\u00eb shum\u00eb se 700 paketa, emrat e t\u00eb cilave jan\u00eb t\u00eb ngjash\u00ebm me paketat popullore dhe ndryshojn\u00eb n\u00eb detaje t\u00eb vogla, p\u00ebr shembull, duke z\u00ebvend\u00ebsuar shkronjat e ngjashme ose duke p\u00ebrdorur n\u00ebnvizim n\u00eb vend t\u00eb lidhjes. <\/p>\n

N\u00eb m\u00eb shum\u00eb se 400 paketa u gjet\u00ebn komponente t\u00eb dyshuara p\u00ebr veprime t\u00eb d\u00ebmshme. N\u00eb ve\u00e7anti, brenda ishte nj\u00eb skedar aaa.png, q\u00eb p\u00ebrmbante kod ekzekutiv n\u00eb formatin PE. Paketat e p\u00ebrmendura ishin t\u00eb lidhura me dy llogari, p\u00ebrmes t\u00eb cilave nga 16 deri m\u00eb 25 shkurt 2020 u vendos\u00ebn 724 paketa t\u00eb d\u00ebmshme<\/a><\/noindex>, t\u00eb cilat jan\u00eb shkarkuar rreth 95 mij\u00eb her\u00eb n\u00eb total. Hulumtuesit e informuan administrat\u00ebn e RubyGems dhe paketat e identifikuara t\u00eb d\u00ebmshme tashm\u00eb jan\u00eb fshir\u00eb nga ruajtja. <\/p>\n

Nga paketet problematike t\u00eb identifikuara, paketi m\u00eb i njohur ishte «atlas-client», i cili n\u00eb pamje t\u00eb par\u00eb gati nuk dallohet nga paketi legjitim «atlas_client<\/a><\/noindex>«. Paketi n\u00eb fjal\u00eb u shkarkua 2100 her\u00eb (nd\u00ebrsa paketi normal u shkarkua 6496 her\u00eb, pra, p\u00ebrdoruesit gabuan n\u00eb pothuajse 25% t\u00eb rasteve). Paketat e tjera mesatarisht u shkarkuan 100-150 her\u00eb dhe u kamufluan si paketa t\u00eb tjera duke p\u00ebrdorur teknika t\u00eb ngjashme p\u00ebr z\u00ebvend\u00ebsimin e n\u00ebnvizimeve dhe dashit (p\u00ebr shembull, midis paketave t\u00eb d\u00ebmshme<\/a><\/noindex>: appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).<\/p>\n

Paketet keqdor p\u00ebrfshinte nj\u00eb skedar PNG, n\u00eb t\u00eb cilin ndodhej nj\u00eb skedari ekzekutiv p\u00ebr platform\u00ebn Windows n\u00eb vend t\u00eb imazhit. Skedari ishte formuar me ndihm\u00ebn e utilitarit Ocra Ruby2Exe dhe p\u00ebrmbante nj\u00eb arkiv t\u00eb vet\u00eb-shkarkuesh\u00ebm me nj\u00eb skenari Ruby dhe interpretuesin Ruby. Gjat\u00eb instalimit t\u00eb paket\u00ebs, skedari png riem\u00ebrtohej n\u00eb exe dhe lan\u00e7ohej. Gjat\u00eb ekzekutimit krijohej dhe shtohej n\u00eb nisjen automatike nj\u00eb skedar me VBScript. Ky VBScript keqdash\u00ebs analizonte me cik\u00ebl p\u00ebrmbajtjen e tabel\u00ebs s\u00eb shk\u00ebmbimit p\u00ebr t\u00eb gjetur informacione q\u00eb ngjasonin me adresat e portofolit t\u00eb kriptovalutave, dhe n\u00eb rast t\u00eb gjetjes z\u00ebvend\u00ebsonte numrin e portofolit, duke llogaritur se p\u00ebrdoruesi nuk do t\u00eb v\u00ebrej\u00eb ndryshimet dhe do t\u00eb transferonte fonde jo n\u00eb portofolin e duhur. <\/p>\n

Studimi i kryer ka treguar se nuk \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb arrihet shtimi i paketave keqdash\u00ebse n\u00eb nj\u00eb nga repozitor\u00ebt m\u00eb t\u00eb njohur dhe k\u00ebto paketa mund t\u00eb mbeten t\u00eb padukshme, p\u00ebrkundrejt numrit t\u00eb madh t\u00eb shkarkimeve. Duhet theksuar se problemi jo<\/a><\/noindex> \u00ebsht\u00eb specifik<\/a><\/noindex> p\u00ebr<\/a><\/noindex> p\u00ebr RubyGems dhe \u00ebsht\u00eb n\u00eb lidhje me repozitor\u00eb t\u00eb tjer\u00eb t\u00eb njohur. P\u00ebr shembull, vitin e kaluar, t\u00eb nj\u00ebjtit hulumtues identifikuan<\/a><\/noindex> n\u00eb repozitorin NPM paket\u00ebn keqdash\u00ebse bb-builder, e cila p\u00ebrdor teknika t\u00eb ngjashme p\u00ebr t\u00eb ekzekutuar nj\u00eb skedar p\u00ebr t\u00eb vjedhur fjal\u00ebkalimet. Para k\u00ebsaj, backdoor-i ishte gjetur<\/a><\/noindex> n\u00eb var\u00ebsi t\u00eb paket\u00ebs NPM event-stream dhe kodi keqdash\u00ebs ishte shkarkuar rreth 8 milion her\u00eb. Paketat keqdash\u00ebse gjithashtu shfaqen p\u00ebrher\u00eb pashere<\/a><\/noindex> n\u00eb repozitorin PyPI.<\/a><\/noindex> Rebuilderd \u00ebsht\u00eb i disponuesh\u00ebm p\u00ebr verifikimin e pavarur t\u00eb Arch Linux me ndihm\u00ebn e nd\u00ebrtimeve t\u00eb p\u00ebrs\u00ebritshme.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78968","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb RubyGems jan\u00eb zbuluar 724 paketa keqdash\u00ebse | ProHoster","description":"\ud83e\udd47N\u00eb RubyGems jan\u00eb zbuluar 724 paketa keqdash\u00ebse | ProHoster","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RubyGems \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 724 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-23T11:42:01+00:00","article:modified_time":"2020-04-23T11:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78968","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:47:25","updated":"2022-09-28 01:38:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=78968"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78968\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=78968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=78968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=78968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}