{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"Softueri i d\u00ebmsh\u00ebm q\u00eb godet NetBeans p\u00ebr t\u00eb futur backdoor n\u00eb projektet e nd\u00ebrtuara","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub identifikuar<\/a><\/noindex> softuer t\u00eb d\u00ebmsh\u00ebm q\u00eb godet projektet n\u00eb mjedisin e integruar t\u00eb zhvillimit NetBeans dhe p\u00ebrdor procesin e nd\u00ebrtimit p\u00ebr shp\u00ebrndarjen e tij. Hetimi tregoi se me ndihm\u00ebn e k\u00ebtij softueri t\u00eb d\u00ebmsh\u00ebm, i quajtur Octopus Scanner, jan\u00eb futur fshehurazi backdoor n\u00eb 26 projekte t\u00eb hapura me repository n\u00eb GitHub. Gjurm\u00ebt e para t\u00eb shfaqjes s\u00eb Octopus Scanner datojn\u00eb nga gushti 2018.<\/p>\n

Softueri i d\u00ebmsh\u00ebm \u00ebsht\u00eb i aft\u00eb t\u00eb identifikoj\u00eb skedar\u00ebt me projekte NetBeans dhe t\u00eb shtoj\u00eb kodin e tij n\u00eb skedar\u00ebt e projektit dhe n\u00eb skedar\u00ebt JAR t\u00eb nd\u00ebrtuar. Algoritmi i funksionimit reduktohet n\u00eb gjetjen e katalogut NetBeans me projektet e p\u00ebrdoruesit, p\u00ebrshkrimin e t\u00eb gjitha projekteve n\u00eb k\u00ebt\u00eb katalog, kopjimin e skenarit t\u00eb d\u00ebmsh\u00ebm n\u00eb nbproject\/cache.dat<\/a><\/noindex> dhe b\u00ebj ndryshime n\u00eb skedarin nbproject\/build-impl.xml<\/a><\/noindex> p\u00ebr t\u00eb thirrur k\u00ebt\u00eb skenar n\u00eb \u00e7do nd\u00ebrtim t\u00eb projektit. Gjat\u00eb nd\u00ebrtimit, nj\u00eb kopje e softuerit t\u00eb d\u00ebmsh\u00ebm p\u00ebrfshihet n\u00eb skedar\u00ebt p\u00ebrfundimtar\u00eb JAR, t\u00eb cilat b\u00ebhen burim p\u00ebr shp\u00ebrndarje t\u00eb m\u00ebtejshme. P\u00ebr shembull, skedar\u00ebt e d\u00ebmsh\u00ebm jan\u00eb publikuar n\u00eb repository t\u00eb atyre 26 projekteve t\u00eb hapura, si dhe n\u00eb projekte t\u00eb ndryshme t\u00eb tjera gjat\u00eb publikimit t\u00eb nd\u00ebrtimeve t\u00eb versione t\u00eb reja.<\/p>\n

Kur gjat\u00eb ngarkimit dhe nisjes s\u00eb nj\u00eb JAR-fajlli t\u00eb prekur nga nj\u00eb p\u00ebrdorues tjet\u00ebr, n\u00eb sistemin e tij fillonte nj\u00eb cik\u00ebl i ri k\u00ebrkimi p\u00ebr NetBeans dhe inserimi i kodit t\u00eb d\u00ebmsh\u00ebm, q\u00eb p\u00ebrkon me modelin e funksionimit t\u00eb viruseve kompjuterik\u00eb q\u00eb p\u00ebrhapen vetvetiu. P\u00ebrve\u00e7 funksionalitetit p\u00ebr p\u00ebrhapjen vetjake, kodi i d\u00ebmsh\u00ebm gjithashtu p\u00ebrfshin funksione backdoor p\u00ebr t\u00eb ofruar akses t\u00eb larg\u00ebt n\u00eb sistem. N\u00eb momentin e analiz\u00ebs s\u00eb ngjarjes, server\u00ebt q\u00eb kontrollonin backdoor-in (C&C) nuk ishin aktiv.
\n

\"Softueri<\/a><\/noindex><\/center><\/p>\n

Gjat\u00eb studimit t\u00eb projekteve t\u00eb prekur, u identifikuan 4 variante infektimi. N\u00eb nj\u00eb nga variantet, p\u00ebr aktivizimin e backdoor-it n\u00eb Linux krijohej nj\u00eb sked\u00eb automatikisht e nisjes \" $HOME\/.config\/autostart\/octo.desktop \", nd\u00ebrsa n\u00eb Windows p\u00ebrdorej ekzekutimi i detyrave p\u00ebrmes schtasks. Mes skedave t\u00eb tjera t\u00eb krijuara: <\/p>\n