Ezinsukwini ezimbalwa ezedlule, kwamenyezelwa ukuthi amaphakheji ayi-11 aqukethe ikhodi enonya atholakale ku-PyPI directory (Python package index).
Ngaphambi kokuba kutholakale izinkinga, amaphakheji alandwe cishe izikhathi ezingu-38 sezizonke , futhi kubalulekile ukuqaphela ukuthi amaphakheji anonya atholakele ahlukile ngokusebenzisa kwawo izindlela eziyinkimbinkimbi zokufihla iziteshi zokuxhumana namaseva abahlaseli.
Amaphakheji atholakele yilawa alandelayo:
- iphakheji ebalulekile (6305 okulandwayo) e okubalulekile-iphakheji (12897): la maphakheji sungula uxhumano kwiseva yangaphandle ngaphansi kwesithunzi sokuxhuma ku-pypi.python.org ukunikeza ukufinyelela kwegobolondo ohlelweni (reverse shell) bese usebenzisa uhlelo lwe-trevorc2 ukufihla ishaneli yokuxhumana.
- i-pptest (10001) no ama-ipboards (946): isebenzise i-DNS njengesiteshi sokuxhumana ukudlulisa ulwazi mayelana nesistimu (ephaketheni lokuqala, igama lomethuleli, uhla lwemibhalo olusebenzayo, i-IP yangaphakathi nengaphandle, kwesibili, igama lomsebenzisi kanye negama lomethuleli).
- isikhova (3285), I-DiscordSafety (557) futhi yiffparty (1859) - Khomba ithokheni yesevisi ye-Discord kusistimu bese uyithumela kumsingathi wangaphandle.
- trrfab (287): Ithumela isihlonzi, igama lomethuleli, nokuqukethwe kokuthi / njll / passwd, / njll / abasingathi, / ekhaya kumsingathi wangaphandle.
- 10cent10 (490) - Isungule uxhumano lwegobolondo lokuhlehla kumsingathi wangaphandle.
yandex-yt (4183): ibonise umlayezo omayelana nesistimu eyonakalisiwe futhi iqondiswe kabusha ekhasini elinolwazi olwengeziwe mayelana nezenzo ezengeziwe, ezikhishwe nge-nda.ya.ru (api.ya.cc).
Ngakho-ke, kushiwo ukuthi kufanele kuqashelwe ngokukhethekile indlela yokufinyelela ama-host angaphandle asetshenziswa kumaphakethe e-importantpackage namaphakethe e-important-package, asebenzisa inethiwekhi yokulethwa kokuqukethwe okusheshayo esetshenziswa kukhathalogi ye-PyPI ukufihla umsebenzi wawo.
Eqinisweni, izicelo zithunyelwe kuseva ye-pypi.python.org (okuhlanganisa nokucacisa igama le-python.org ku-SNI ngaphakathi kwesicelo se-HTTPS), kodwa igama leseva elilawulwa umhlaseli labekwa kusihloko se-HTTP esithi "Host ». Inethiwekhi yokulethwa kokuqukethwe ithumele isicelo esifanayo kuseva yomhlaseli, isebenzisa imingcele yoxhumano lwe-TLS ku-pypi.python.org lapho ithumela idatha.
Ingqalasizinda ye- PyPI inikwe amandla yi-Fastly Content Delivery Network, esebenzisa i-proxy esobala ye-Varnish ukugcina izicelo ezijwayelekile futhi isebenzisa ukucutshungulwa kwesitifiketi se-TLS sezinga le-CDN, esikhundleni samaseva e-endpoint, ukudlulisa izicelo ze-HTTPS nge-proxy. Kungakhathaliseki ukuthi iyiphi i-host yendawo, izicelo zithunyelwa ku-proxy, ekhomba i-host efiselekayo ngesihloko se-HTTP "Host", futhi amagama e-hostname esizinda aboshwe kumakheli e-IP ajwayelekile e-CDN load balancer atholakala kuwo wonke amaklayenti e-Fastly.
Iseva yabahlaseli ibhaliswe ne-CDN Fastly , enikeza izinhlelo zamahhala futhi ivumela nokubhaliswa okungaziwa. Kubalulekile ukuqaphela ukuthi uhlelo olufanayo lusetshenziswa ukuthumela izicelo kumuntu ohlukunyeziwe lapho kudalwa "igobolondo elingemuva", kodwa eliqalwa ngumnikazi womhlaseli. Ngaphandle, ukusebenzisana neseva yomhlaseli kubonakala kuyiseshini esemthethweni nesiqondisi se-PyPI, esibethelwe ngesitifiketi se-PyPI TLS. Indlela efanayo, eyaziwa ngokuthi "ukuqondisa isizinda," yayisetshenziswa ngaphambilini ukufihla ngenkuthalo igama lomphathi ngokudlula amabhlogo. Lokhu kwakuhilela ukusebenzisa inketho ye-HTTPS enikezwe amanye ama-CDN, ukucacisa i-dummy host ku-SNI, nokudlulisa igama lomphathi eliceliwe kusihloko se-HTTP host ngaphakathi kweseshini ye-TLS.
Ukufihla umsebenzi omubi, iphakheji ye-TrevorC2 iphinde yasetshenziswa, okwenza ukuxhumana neseva kufane nokuphequlula iwebhu okuvamile.
Amaphakethe we-pptest nama-ipboards asebenzise indlela ehlukile yokufihla umsebenzi wenethiwekhi, ngokusekelwe ekubhaleni ngekhodi ulwazi oluwusizo ezicelweni zeseva ye-DNS. Isofthiwe enobungozi idlulisa ulwazi ngokwenza imibuzo ye-DNS, lapho idatha idluliswa kumyalo kanye neseva yokulawula ibhalwa ngekhodi kusetshenziswa ifomethi ye-base64 egameni lesizinda esincane. Umhlaseli wamukela le milayezo ngokulawula iseva ye-DNS yesizinda.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.