{"id":83274,"date":"2020-05-30T01:42:33","date_gmt":"2020-05-29T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty"},"modified":"2020-05-30T01:42:33","modified_gmt":"2020-05-29T23:42:33","slug":"vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vredonosnoe-po-porazhayushhee-netbeans-dlya-vnedreniya-bekdorov-v-sobiraemye-proekty","title":{"rendered":"K\u00ebrc\u00ebnim i softuerit t\u00eb d\u00ebmsh\u00ebm q\u00eb godet NetBeans p\u00ebr t\u00eb futur backdoor n\u00eb projektet q\u00eb ndodhen n\u00eb p\u00ebrpunim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub identifikuar<\/a><\/noindex> softueri i d\u00ebmsh\u00ebm q\u00eb ndikon projektet n\u00eb mjedisin e integruar t\u00eb zhvillimit NetBeans dhe p\u00ebrdor procesin e nd\u00ebrtimit p\u00ebr shp\u00ebrndarjen e tij. Hetimi zbuloi se me ndihm\u00ebn e k\u00ebtij softueri t\u00eb d\u00ebmsh\u00ebm, i cili ka emrin Octopus Scanner, ishin fshehur backdoor n\u00eb 26 projekte t\u00eb hapura, t\u00eb cilat kan\u00eb depo n\u00eb GitHub. Shk\u00ebmbimet e para t\u00eb shfaqjes s\u00eb Octopus Scanner datojn\u00eb nga gushti i vitit 2018.<\/p>\n

Softueri i d\u00ebmsh\u00ebm \u00ebsht\u00eb n\u00eb gjendje t\u00eb identifikoj\u00eb skedar\u00ebt me projekte NetBeans dhe t\u00eb shtoj\u00eb kodin e tij n\u00eb skedar\u00ebt e projektit dhe skedar\u00ebt JAR q\u00eb nd\u00ebrtohen. Algoritmi i funksionimit p\u00ebrfshin identifikimin e drejtoris\u00eb NetBeans me projektet e p\u00ebrdoruesit, p\u00ebrzgjedhjen e t\u00eb gjitha projekteve n\u00eb k\u00ebt\u00eb drejtorin\u00eb, kopjimin e skenarit t\u00eb d\u00ebmsh\u00ebm n\u00eb nbproject\/cache.dat<\/a><\/noindex> dhe ndryshimin e skedarit nbproject\/build-impl.xml<\/a><\/noindex> p\u00ebr t\u00eb thirrur k\u00ebt\u00eb skenar gjat\u00eb \u00e7do nd\u00ebrtimi t\u00eb projektit. Gjat\u00eb nd\u00ebrtimit, nj\u00eb kopje e softuerit t\u00eb d\u00ebmsh\u00ebm p\u00ebrfshihet n\u00eb skedar\u00ebt e rezultatit JAR, t\u00eb cil\u00ebt b\u00ebhen burim p\u00ebr shp\u00ebrndarje t\u00eb m\u00ebtejshme. P\u00ebr shembull, skedar\u00ebt e d\u00ebmsh\u00ebm u publikuan n\u00eb depo t\u00eb projekteve t\u00eb sip\u00ebrp\u00ebrmendura 26 t\u00eb hapura, si dhe n\u00eb projekte t\u00eb tjera gjat\u00eb publikimit t\u00eb nd\u00ebrtimeve t\u00eb versione t\u00eb reja.<\/p>\n

Kur d\u00ebshohet dhe niset nj\u00eb skedar JAR i prekur nga nj\u00eb p\u00ebrdorues tjet\u00ebr, n\u00eb sistemin e tij fillonte nj\u00eb cik\u00ebl tjet\u00ebr k\u00ebrkimi NetBeans dhe inkorporimi i kodit t\u00eb d\u00ebmsh\u00ebm, q\u00eb p\u00ebrputhet me modelin e pun\u00ebs s\u00eb viruseve kompjuterik\u00eb q\u00eb vet\u00ebshp\u00ebrndahet. P\u00ebrve\u00e7 funksionalitetit p\u00ebr vet\u00ebshp\u00ebrndarje, kodi i d\u00ebmsh\u00ebm p\u00ebrfshin gjithashtu funksione shpine (backdoor) p\u00ebr t\u00eb ofruar akses t\u00eb larg\u00ebt n\u00eb sistem. N\u00eb momentin e shqyrtimit t\u00eb incidentit, server\u00ebt q\u00eb kontrollonin backdoor-in (C&C) nuk ishin aktiv\u00eb.
\n

\"K\u00ebrc\u00ebnim<\/a><\/noindex><\/center><\/p>\n

Gjat\u00eb studimit t\u00eb projekteve t\u00eb prekur, u identifikuan gjithsej 4 variante infektimi. N\u00eb nj\u00eb prej varianteve, p\u00ebr t\u00eb aktivizuar backdoor-in n\u00eb Linux krijohej nj\u00eb skedar autoloje \"$HOME\/.config\/autostart\/octo.desktop\", nd\u00ebrsa n\u00eb Windows p\u00ebrdorej ekzekutimi i detyrave p\u00ebrmes schtasks. Mes skedar\u00ebve t\u00eb tjer\u00eb t\u00eb krijuar: <\/p>\n