{"id":78968,"date":"2020-04-23T13:42:01","date_gmt":"2020-04-23T11:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa"},"modified":"2020-04-23T13:42:01","modified_gmt":"2020-04-23T11:42:01","slug":"v-rubygems-vyyavleno-724-vredonosnyh-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","title":{"rendered":"N\u00eb RubyGems jan\u00eb identifikuar 724 paketa t\u00eb d\u00ebmshme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania ReversingLabs publikoi<\/a><\/noindex> rezultatet e analiz\u00ebs s\u00eb aplikimit tiposquatting<\/a><\/noindex> n\u00eb depozit\u00ebn RubyGems. Zakonisht, type-squatting aplikohet p\u00ebr shp\u00ebrndarjen e pakove t\u00eb d\u00ebmshme, t\u00eb dizajnuara p\u00ebr t\u00eb shfryt\u00ebzuar nj\u00eb zhvillues t\u00eb pakujdessh\u00ebm q\u00eb mund t\u00eb b\u00ebj\u00eb nj\u00eb gabim kur k\u00ebrkon ose nuk e v\u00eb re diferenc\u00ebn. Gjat\u00eb hulumtimit, jan\u00eb identifikuar m\u00eb shum\u00eb se 700 paketa, emrat e t\u00eb cilave jan\u00eb t\u00eb ngjash\u00ebm me paketa populare dhe ndryshojn\u00eb nga detaje t\u00eb vogla, si\u00e7 \u00ebsht\u00eb z\u00ebvend\u00ebsimi i shkronjave t\u00eb ngjashme ose p\u00ebrdorimi i theksit n\u00eb vend t\u00eb presjes. <\/p>\n

N\u00eb m\u00eb shum\u00eb se 400 paketa jan\u00eb zbuluar componente, t\u00eb dyshuara p\u00ebr aktivitet t\u00eb d\u00ebmsh\u00ebm. Konkretisht, brenda ndodhej nj\u00eb sked\u00eb aaa.png, q\u00eb p\u00ebrmbante kod ekzekutiv n\u00eb formatin PE. Paketat e p\u00ebrmendura ishin t\u00eb lidhura me dy llogari, p\u00ebrmes t\u00eb cilave nga data 16 deri m\u00eb 25 shkurt 2020 jan\u00eb publikuar 724 paketa t\u00eb d\u00ebmshme<\/a><\/noindex>, t\u00eb cilat n\u00eb total jan\u00eb shkarkuar rreth 95 mij\u00eb her\u00eb. Studiuesit informuan administrat\u00ebn e RubyGems dhe paketat e d\u00ebmshme t\u00eb zbuluara tashm\u00eb jan\u00eb fshir\u00eb nga depozita. <\/p>\n

Nd\u00ebr paketat problematike t\u00eb identifikuara, m\u00eb e njohura ishte «atlas-client», i cili n\u00eb shikim t\u00eb par\u00eb \u00ebsht\u00eb pothuajse i pandash\u00ebm nga paketa legjitime «atlas_client<\/a><\/noindex>«. Paketa e p\u00ebrmendur u shkarkua 2100 her\u00eb (nj\u00eb paket\u00eb normale ishte shkarkuar 6496 her\u00eb, pra p\u00ebrdoruesit gabuan n\u00eb gati 25% t\u00eb rasteve). Paketat e tjera mesatarisht ishin shkarkuar 100-150 her\u00eb dhe u kamufluan si pako t\u00eb tjera duke p\u00ebrdorur teknika t\u00eb ngjashme t\u00eb z\u00ebvend\u00ebsimit t\u00eb n\u00ebnvizimeve dhe vijave (p\u00ebr shembull, mes paketave t\u00eb d\u00ebmshme<\/a><\/noindex>: appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).<\/p>\n

Pakot e d\u00ebmshme p\u00ebrfshinin nj\u00eb skedar PNG, n\u00eb t\u00eb cilin p\u00ebrve\u00e7 imazhit ishte nj\u00eb skedar ekzekutiv p\u00ebr platform\u00ebn Windows. Skedari ishte formuar me ndihm\u00ebn e mjetit Ocra Ruby2Exe dhe p\u00ebrfshinte nj\u00eb arkiv self-extracting me nj\u00eb skenar Ruby dhe interpretues Ruby. Gjat\u00eb instalimit t\u00eb paket\u00ebs, skedari png rinominohej n\u00eb exe dhe fillohej. Gjat\u00eb ekzekutimit, krijohej dhe shtohej n\u00eb fillimin automatik nj\u00eb skedar VBScript. Ky VBScript i d\u00ebmsh\u00ebm analizonte vazhdimisht p\u00ebrmbajtjen e zhvilluesit t\u00eb kopjimit p\u00ebr informacion q\u00eb i ngjante adresave t\u00eb portofolit kriptomonedh\u00eb, dhe n\u00ebse identifikohej ndonj\u00eb, z\u00ebvend\u00ebsonte numrin e portofolit duke supozuar se p\u00ebrdoruesi nuk do t\u00eb v\u00ebrej\u00eb ndryshimin dhe do t\u00eb transferonte fonde jo n\u00eb at\u00eb portofol. <\/p>\n

Studimi i kryer tregoi se nuk \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb arrihet shtimi i paketave t\u00eb d\u00ebmshme n\u00eb nj\u00eb nga depozitoret m\u00eb t\u00eb njohura dhe k\u00ebto paketa mund t\u00eb mbeten t\u00eb padukshme, pavar\u00ebsisht numrit t\u00eb konsideruesh\u00ebm t\u00eb shkarkimeve. Duhet theksuar se problemi nuk<\/a><\/noindex> \u00ebsht\u00eb specifik<\/a><\/noindex> p\u00ebr<\/a><\/noindex> p\u00ebr RubyGems dhe ka t\u00eb b\u00ebj\u00eb me depozitore t\u00eb tjera t\u00eb njohura. P\u00ebr shembull, vitin e kaluar, t\u00eb nj\u00ebjtit k\u00ebrkues identifikuan<\/a><\/noindex> n repositorin NPM ka nj\u00eb paket\u00eb t\u00eb d\u00ebmshme bb-builder, e cila p\u00ebrdor nj\u00eb teknik\u00eb t\u00eb ngjashme p\u00ebr t\u00eb ekzekutuar skedar\u00eb p\u00ebr t\u00eb vjedhur fjal\u00ebkalime. M\u00eb par\u00eb, ky backdoor ishte gjet<\/a><\/noindex> n var\u00ebsi t\u00eb paket\u00ebs NPM event-stream dhe kodi i d\u00ebmsh\u00ebm ishte shkarkuar rreth 8 milion her\u00eb. Paketat e d\u00ebmshme gjithashtu shfaqen<\/a><\/noindex> nga her\u00eb pas here<\/a><\/noindex> n repositorin PyPI.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78968","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Paketat e d\u00ebmshme n\u00eb RubyGems identifikohen 724 | ProHoster","description":"Kompania ReversingLabs publikoi rezultatet e analiz\u00ebs mbi p\u00ebrdorimin e typosquatting n\u00eb repositorin RubyGems. N\u00eb p\u00ebrgjith\u00ebsi, typosquatting p\u00ebrdoret p\u00ebr shp\u00ebrndarjen e paketave t\u00eb d\u00ebmshme, duke shpresuar se nj\u00eb zhvillues i pakujdessh\u00ebm gjat\u00eb k\u00ebrkimit do t\u00eb b\u00ebj\u00eb nj\u00eb gabim shtypjeje ose nuk do t\u00eb v\u00ebrej\u00eb dallimet. Gjat\u00eb hetimit u identifikuan m\u00eb shum\u00eb se 700 paketa, emrat e t\u00eb cilave jan\u00eb t\u00eb ngjash\u00ebm me paketat e njohura dhe ndryshojn\u00eb n\u00eb detaje t\u00eb pap\u00ebrfillshme, si\u00e7 \u00ebsht\u00eb nd\u00ebrrimi i shkronjave t\u00eb ngjashme ose p\u00ebrdorimi i","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 RubyGems \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 724 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ReversingLabs \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 RubyGems. \u041e\u0431\u044b\u0447\u043d\u043e \u0442\u0430\u0439\u043f\u0441\u043a\u0432\u043e\u0442\u0442\u0438\u043d\u0433 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0435\u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0443 \u0438\u043b\u0438 \u043d\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u0442 \u0440\u0430\u0437\u043d\u0438\u0446\u044b. \u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 700 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0445\u043e\u0436\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043c\u0435\u043d\u043e\u0439 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0431\u0443\u043a\u0432 \u0438\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-rubygems-vyyavleno-724-vredonosnyh-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-23T11:42:01+00:00","article:modified_time":"2020-04-23T11:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78968","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:47:25","updated":"2022-09-28 01:38:04"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=78968"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78968\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=78968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=78968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=78968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}