{"id":1641,"date":"2026-06-14T07:15:50","date_gmt":"2026-06-14T00:15:50","guid":{"rendered":"https:\/\/vncybers.vn\/hon-400-goi-phan-mem-arch-linux-aur-bi-chiem-quyen-de-phat-tan-ma-doc-danh-cap-du-lieu-va-rootkit\/"},"modified":"2026-06-14T07:15:50","modified_gmt":"2026-06-14T00:15:50","slug":"hon-400-goi-phan-mem-arch-linux-aur-bi-chiem-quyen-de-phat-tan-ma-doc-danh-cap-du-lieu-va-rootkit","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hon-400-goi-phan-mem-arch-linux-aur-bi-chiem-quyen-de-phat-tan-ma-doc-danh-cap-du-lieu-va-rootkit\/","title":{"rendered":"H\u01a1n 400 g\u00f3i ph\u1ea7n m\u1ec1m Arch Linux (AUR) b\u1ecb chi\u1ebfm quy\u1ec1n \u0111\u1ec3 ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u v\u00e0 Rootkit"},"content":{"rendered":"

C\u1ed9ng \u0111\u1ed3ng ng\u01b0\u1eddi d\u00f9ng Arch Linux \u0111ang \u0111\u1ed1i m\u1eb7t v\u1edbi m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng quy m\u00f4 l\u1edbn nh\u1eafm v\u00e0o kho l\u01b0u tr\u1eef c\u1ed9ng \u0111\u1ed3ng AUR (Arch User Repository). Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t h\u01a1n 400 g\u00f3i ph\u1ea7n m\u1ec1m, s\u1eeda \u0111\u1ed5i k\u1ecbch b\u1ea3n c\u00e0i \u0111\u1eb7t \u0111\u1ec3 l\u00e2y nhi\u1ec5m m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp th\u00f4ng tin (infostealer) v\u00e0 m\u1ed9t rootkit eBPF tinh vi tr\u00ean m\u00e1y t\u00ednh c\u1ee7a n\u1ea1n nh\u00e2n.<\/p>\n

\"H\u01a1n<\/p>\n

Chi\u1ebfn thu\u1eadt chi\u1ebfm quy\u1ec1n c\u00e1c d\u1ef1 \u00e1n “m\u1ed3 c\u00f4i”<\/h2>\n

Thay v\u00ec khai th\u00e1c l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 nh\u1eafm v\u00e0o m\u00f4 h\u00ecnh l\u00f2ng tin c\u1ee7a AUR. Ch\u00fang t\u00ecm ki\u1ebfm c\u00e1c g\u00f3i ph\u1ea7n m\u1ec1m b\u1ecb b\u1ecf r\u01a1i (orphaned) – nh\u1eefng d\u1ef1 \u00e1n m\u00e0 ng\u01b0\u1eddi duy tr\u00ec c\u0169 \u0111\u00e3 ng\u1eebng ho\u1ea1t \u0111\u1ed9ng – v\u00e0 ti\u1ebfn h\u00e0nh “nh\u1eadn nu\u00f4i” ch\u00fang. Sau khi c\u00f3 quy\u1ec1n ki\u1ec3m so\u00e1t, ch\u00fang ch\u1ec9nh s\u1eeda t\u1ec7p PKGBUILD<\/code> ho\u1eb7c k\u1ecbch b\u1ea3n .install<\/code> \u0111\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh \u0111\u1ed9c h\u1ea1i trong qu\u00e1 tr\u00ecnh bi\u00ean d\u1ecbch ph\u1ea7n m\u1ec1m.<\/p>\n

Chi\u1ebfn d\u1ecbch n\u00e0y, \u0111\u01b0\u1ee3c Sonatype \u0111\u1eb7t t\u00ean l\u00e0 Atomic Arch<\/strong>, s\u1eed d\u1ee5ng c\u00e1c l\u1ec7nh npm install atomic-lockfile<\/code> ho\u1eb7c bun install js-digest<\/code> \u0111\u1ec3 t\u1ea3i v\u1ec1 c\u00e1c g\u00f3i npm \u0111\u1ed9c h\u1ea1i. C\u00e1c g\u00f3i n\u00e0y ch\u1ee9a m\u1ed9t t\u1ec7p th\u1ef1c thi ELF vi\u1ebft b\u1eb1ng ng\u00f4n ng\u1eef Rust, s\u1ebd t\u1ef1 \u0111\u1ed9ng ch\u1ea1y ngay khi ng\u01b0\u1eddi d\u00f9ng b\u1eaft \u0111\u1ea7u c\u00e0i \u0111\u1eb7t ho\u1eb7c c\u1eadp nh\u1eadt ph\u1ea7n m\u1ec1m t\u1eeb AUR.<\/p>\n

M\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u v\u00e0 kh\u1ea3 n\u0103ng \u1ea9n m\u00ecnh b\u1eb1ng Rootkit<\/h2>\n

Theo ph\u00e2n t\u00edch t\u1eeb c\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt, m\u00e3 \u0111\u1ed9c Rust n\u00e0y \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 thu th\u1eadp m\u1ed9t l\u01b0\u1ee3ng l\u1edbn d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m t\u1eeb c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n v\u00e0 h\u1ec7 th\u1ed1ng build, bao g\u1ed3m:<\/p>\n

    \n
  • Cookie, token v\u00e0 d\u1eef li\u1ec7u l\u01b0u tr\u1eef c\u1ee5c b\u1ed9 t\u1eeb c\u00e1c tr\u00ecnh duy\u1ec7t d\u1ef1a tr\u00ean Chromium (Chrome, Edge, Brave…).<\/li>\n
  • D\u1eef li\u1ec7u phi\u00ean l\u00e0m vi\u1ec7c t\u1eeb c\u00e1c \u1ee9ng d\u1ee5ng Electron nh\u01b0 Slack, Discord v\u00e0 Microsoft Teams.<\/li>\n
  • Token GitHub, npm, HashiCorp Vault v\u00e0 c\u1ea3 th\u00f4ng tin t\u00e0i kho\u1ea3n OpenAI\/ChatGPT.<\/li>\n
  • Kh\u00f3a SSH, l\u1ecbch s\u1eed l\u1ec7nh shell (bash history) v\u00e0 c\u1ea5u h\u00ecnh VPN.<\/li>\n<\/ul>\n

    \u0110\u00e1ng ch\u00fa \u00fd, n\u1ebfu m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ch\u1ea1y v\u1edbi quy\u1ec1n root, n\u00f3 s\u1ebd t\u1ea3i m\u1ed9t rootkit eBPF \u0111\u1ec3 \u1ea9n gi\u1ea5u c\u00e1c ti\u1ebfn tr\u00ecnh, t\u00ean ti\u1ebfn tr\u00ecnh v\u00e0 c\u00e1c c\u1ed5ng m\u1ea1ng (socket) kh\u1ecfi c\u00e1c c\u00f4ng c\u1ee5 ki\u1ec3m tra h\u1ec7 th\u1ed1ng th\u00f4ng th\u01b0\u1eddng. \u0110i\u1ec1u n\u00e0y khi\u1ebfn vi\u1ec7c ph\u00e1t hi\u1ec7n v\u00e0 g\u1ee1 b\u1ecf m\u00e3 \u0111\u1ed9c tr\u1edf n\u00ean c\u1ef1c k\u1ef3 kh\u00f3 kh\u0103n n\u1ebfu ch\u1ec9 d\u00f9ng c\u00e1c l\u1ec7nh qu\u1ea3n l\u00fd g\u00f3i th\u00f4ng th\u01b0\u1eddng.<\/p>\n

    \"Ph\u00e2n<\/p>\n

    Khuy\u1ebfn c\u00e1o cho ng\u01b0\u1eddi d\u00f9ng Arch Linux<\/h2>\n

    C\u00e1c nh\u00e0 qu\u1ea3n tr\u1ecb Arch Linux \u0111\u00e3 b\u1eaft \u0111\u1ea7u thu h\u1ed3i c\u00e1c b\u1ea3n cam k\u1ebft (commit) \u0111\u1ed9c h\u1ea1i v\u00e0 c\u1ea5m c\u00e1c t\u00e0i kho\u1ea3n li\u00ean quan. Tuy nhi\u00ean, do s\u1ed1 l\u01b0\u1ee3ng g\u00f3i b\u1ecb \u1ea3nh h\u01b0\u1edfng qu\u00e1 l\u1edbn (h\u01a1n 400 g\u00f3i), ng\u01b0\u1eddi d\u00f9ng c\u1ea7n th\u1ef1c hi\u1ec7n c\u00e1c b\u01b0\u1edbc sau \u0111\u1ec3 t\u1ef1 b\u1ea3o v\u1ec7:<\/p>\n

      \n
    1. Ki\u1ec3m tra l\u1ecbch s\u1eed c\u00e0i \u0111\u1eb7t:<\/strong> R\u00e0 so\u00e1t l\u1ea1i b\u1ea5t k\u1ef3 g\u00f3i AUR n\u00e0o \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t ho\u1eb7c c\u1eadp nh\u1eadt t\u1eeb ng\u00e0y 11\/06\/2026 tr\u1edf \u0111i.<\/li>\n
    2. Qu\u00e9t m\u00e3 \u0111\u1ed9c:<\/strong> Ki\u1ec3m tra s\u1ef1 t\u1ed3n t\u1ea1i c\u1ee7a c\u00e1c d\u1ecbch v\u1ee5 systemd l\u1ea1 ho\u1eb7c c\u00e1c t\u1ec7p trong \/var\/lib\/<\/code>. \u0110\u1eb7c bi\u1ec7t, ki\u1ec3m tra th\u01b0 m\u1ee5c \/sys\/fs\/bpf\/<\/code> \u0111\u1ec3 t\u00ecm c\u00e1c b\u1ea3n \u0111\u1ed3 eBPF c\u00f3 t\u00ean hidden_pids<\/code>, hidden_names<\/code>, ho\u1eb7c hidden_inodes<\/code>.<\/li>\n
    3. \u0110\u1ed5i m\u1eadt kh\u1ea9u v\u00e0 Token:<\/strong> N\u1ebfu nghi ng\u1edd \u0111\u00e3 ch\u1ea1y g\u00f3i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i, h\u00e3y l\u1eadp t\u1ee9c thay \u0111\u1ed5i to\u00e0n b\u1ed9 m\u1eadt kh\u1ea9u, xoay v\u00f2ng (rotate) c\u00e1c token API, kh\u00f3a SSH v\u00e0 \u0111\u0103ng xu\u1ea5t c\u00e1c phi\u00ean l\u00e0m vi\u1ec7c tr\u00ean tr\u00ecnh duy\u1ec7t.<\/li>\n
    4. C\u1ea9n tr\u1ecdng khi c\u00e0i \u0111\u1eb7t:<\/strong> Lu\u00f4n \u0111\u1ecdc k\u1ef9 t\u1ec7p PKGBUILD<\/code> v\u00e0 c\u00e1c k\u1ecbch b\u1ea3n c\u00e0i \u0111\u1eb7t tr\u01b0\u1edbc khi bi\u00ean d\u1ecbch, \u0111\u1eb7c bi\u1ec7t l\u00e0 v\u1edbi c\u00e1c g\u00f3i ph\u1ea7n m\u1ec1m \u00edt ng\u01b0\u1eddi bi\u1ebft ho\u1eb7c v\u1eeba thay \u0111\u1ed5i ng\u01b0\u1eddi duy tr\u00ec.<\/li>\n<\/ol>\n

      V\u1ee5 vi\u1ec7c n\u00e0y l\u00e0 m\u1ed9t l\u1eddi nh\u1eafc nh\u1edf s\u1eafc b\u00e9n v\u1ec1 r\u1ee7i ro c\u1ee7a c\u00e1c kho l\u01b0u tr\u1eef ph\u1ea7n m\u1ec1m d\u1ef1a tr\u00ean c\u1ed9ng \u0111\u1ed3ng. Ngay c\u1ea3 khi t\u00ean ph\u1ea7n m\u1ec1m v\u00e0 l\u1ecbch s\u1eed c\u1ee7a n\u00f3 c\u00f3 v\u1ebb \u0111\u00e1ng tin c\u1eady, n\u1ed9i dung th\u1ef1c t\u1ebf b\u00ean trong v\u1eabn c\u00f3 th\u1ec3 b\u1ecb thay \u0111\u1ed5i b\u1edfi nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 \u00fd \u0111\u1ed3 x\u1ea5u.<\/p>\n

      VNCyberS<\/strong> compiled from The Hacker News and BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

      C\u1ed9ng \u0111\u1ed3ng ng\u01b0\u1eddi d\u00f9ng Arch Linux \u0111ang \u0111\u1ed1i m\u1eb7t v\u1edbi m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng quy m\u00f4 l\u1edbn nh\u1eafm v\u00e0o kho l\u01b0u tr\u1eef c\u1ed9ng \u0111\u1ed3ng AUR (Arch User Repository). Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 chi\u1ebfm quy\u1ec1n ki\u1ec3m so\u00e1t h\u01a1n 400 g\u00f3i ph\u1ea7n m\u1ec1m, s\u1eeda \u0111\u1ed5i k\u1ecbch b\u1ea3n c\u00e0i \u0111\u1eb7t \u0111\u1ec3 l\u00e2y nhi\u1ec5m […]<\/p>\n","protected":false},"author":2,"featured_media":1640,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1641"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1640"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}