{"id":115126,"date":"2024-04-17T14:30:08","date_gmt":"2024-04-17T12:30:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz"},"modified":"2024-04-17T14:30:08","modified_gmt":"2024-04-17T12:30:08","slug":"popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz","title":{"rendered":"F\u00f6rs\u00f6k att f\u00e5 kontroll \u00f6ver \u00f6ppna projekt, liknande fallet med paketet xz.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

OpenSSF (Open Source Security Foundation), som har skapats under Linux Foundation f\u00f6r att \u00f6ka s\u00e4kerheten f\u00f6r \u00f6ppen k\u00e4llkod, har varnat gemenskapen om att det har uppt\u00e4ckts aktiviteter kopplade till f\u00f6rs\u00f6k att f\u00e5 kontroll \u00f6ver popul\u00e4ra \u00f6ppna projekt, vilket p\u00e5minner om angriparnas stil i processen av att f\u00f6rbereda f\u00f6r att inf\u00f6ra en baksida i projektet xz. Precis som i attacken mot xz f\u00f6rs\u00f6ker misst\u00e4nkta individer, som tidigare inte har varit djupt involverade i utvecklingen, anv\u00e4nda social ingenj\u00f6rskonst f\u00f6r att n\u00e5 sina m\u00e5l. <\/p>\n

Angriparna har kommunicerat med medlemmar av styrelsen f\u00f6r OpenJS Foundation, som fungerar som en neutral plattform f\u00f6r gemensam utveckling av \u00f6ppna JavaScript-projekt s\u00e5som Node.js, jQuery, Appium, Dojo, PEP, Mocha och webpack. I korrespondensen, d\u00e4r flera externa utvecklare med tveksam historia inom utvecklingen av \u00f6ppen k\u00e4llkod deltog, gjordes f\u00f6rs\u00f6k att \u00f6vertyga ledningen om behovet av att uppdatera ett av de popul\u00e4ra JavaScript-projekten som st\u00f6ds av OpenJS. <\/p>\n

\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u0447\u0438\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u043e\u0441\u044c \u043d\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f «\u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043b\u044e\u0431\u044b\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439». \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e \u0441\u0443\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0435 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e\u0441\u044c. \u0414\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0435\u0433\u043e \u0432 \u0447\u0438\u0441\u043b\u043e \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442, \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u043d \u0440\u0430\u043d\u0435\u0435 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043b\u0438\u0448\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u0443\u0447\u0430\u0441\u0442\u0438\u0435. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0435\u0449\u0451 \u0432 \u0434\u0432\u0443\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 JavaScript-\u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445, \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0435\u0439 OpenJS. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0441\u043b\u0443\u0447\u0430\u0438 \u043d\u0435 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b \u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u044b \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043d\u0435 \u0442\u0435\u0440\u044f\u0442\u044c \u0431\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438 \u043f\u0440\u0438\u0451\u043c\u0435 \u043a\u043e\u0434\u0430 \u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u044b\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. <\/p>\n

Bland tecken som kan indikera illasinnad aktivitet inkluderar v\u00e4nligt men samtidigt aggressivt och p\u00e5tr\u00e4ngande beteende fr\u00e5n mindre k\u00e4nda medlemmar i samh\u00e4llet som n\u00e4rmar sig projektledare eller handledare med avsikt att fr\u00e4mja sin kod eller erbjuda status som handledare. Det \u00e4r ocks\u00e5 v\u00e4rt att notera bildandet av en st\u00f6df\u00f6rening kring de fr\u00e4mjade id\u00e9erna, best\u00e5ende av p\u00e5hittade personligheter som tidigare inte deltagit i utvecklingen eller nyligen anslutit sig till gemenskapen. <\/p>\n

N\u00e4r man tar emot \u00e4ndringar b\u00f6r man se som tecken p\u00e5 potentiellt skadliga handlingar f\u00f6rs\u00f6k att inkludera bin\u00e4ra data i f\u00f6rfr\u00e5gningar om sammanslagning (till exempel i xz-bakd\u00f6rren \u00f6verf\u00f6rdes via arkiv f\u00f6r att testa avskiljaren) eller invecklad eller sv\u00e5rf\u00f6rst\u00e5elig kod. Man b\u00f6r vara uppm\u00e4rksam p\u00e5 provf\u00f6rs\u00f6k att g\u00f6ra f\u00f6r\u00e4ndringar som n\u00e5got minskar s\u00e4kerheten, skickade f\u00f6r att bed\u00f6ma gemenskapens reaktion och kontrollera om det finns personer som f\u00f6ljer f\u00f6r\u00e4ndringarna (till exempel i xz-funktionen Safe_fprintf ersattes med fprintf). Ovanliga f\u00f6r\u00e4ndringar i kompilerings-, bygg- och distributionsmetoder, involvering av tredjepartsartefakter och en k\u00e4nsla av br\u00e5dska f\u00f6r att acceptera \u00e4ndringar b\u00f6r ocks\u00e5 v\u00e4cka misstankar.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OpenSSF (Open Source Security Foundation), \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u043e\u043a\u0440\u043e\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c Linux Foundation \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u044e\u0449\u0435\u0439 \u043f\u043e \u0441\u0432\u043e\u0435\u043c\u0443 \u0441\u0442\u0438\u043b\u044e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438 \u043a \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442 xz. \u041f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0430\u0442\u0430\u043a\u043e\u0439 \u043d\u0430 xz \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043b\u0438\u0447\u043d\u043e\u0441\u0442\u0438, \u0440\u0430\u043d\u0435\u0435 \u0433\u043b\u0443\u0431\u043e\u043a\u043e \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115126","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47F\u00f6rs\u00f6k att f\u00e5 kontroll \u00f6ver \u00f6ppna projekt, liknande fallet med paketet xz | ProHoster","description":"Organisationen OpenSSF (Open Source Security Foundation), skapad under Linux Foundations beskydd f\u00f6r att \u00f6ka s\u00e4kerheten f\u00f6r \u00f6ppen k\u00e4llkod, har varnat gemenskapen om att aktiviteter har uppt\u00e4ckts kopplade till f\u00f6rs\u00f6k.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u043c\u0438, \u043f\u043e\u0445\u043e\u0436\u0438\u0435 \u043d\u0430 \u0441\u043b\u0443\u0447\u0430\u0439 \u0441 \u043f\u0430\u043a\u0435\u0442\u043e\u043c xz | ProHoster","og:description":"\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f OpenSSF (Open Source Security Foundation), \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u043e\u043a\u0440\u043e\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c Linux Foundation \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u041f\u041e, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/popytki-polucheniya-kontrolya-nad-otkrytymi-proektami-pohozhie-na-sluchaj-s-paketom-xz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-17T12:30:08+00:00","article:modified_time":"2024-04-17T12:30:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115126","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 22:31:19","updated":"2026-01-22 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/115126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=115126"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/115126\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=115126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=115126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=115126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}