Rashin lafiya guda ɗaya, wato wani nau'in cuta da aka ɓoye tsakanin miliyoyin mutane, zai iya kawo cikas ga tsaron aikace-aikacen da ba a iya lissafawa ba, yana jefa ayyukan kasuwanci da sirrin masu amfani cikin haɗari. A cikin wannan yanayi mai haɗari ne ƙungiyarmu a Xygeni ta fara wani aikin tsaro, wanda ya bayyana wani abu mai ban tsoro wanda mutane da yawa ke jin tsoro amma kaɗan ne za su iya tabbatarwa: kasancewar ƙwayoyin npm masu cutarwa a cikin tushen tsarin dijital ɗinmu.
Daga ranar 13 zuwa 15 ga Janairu, 2024, na'urar binciken mu ta gano ƙwayoyin cuta ta hanyar amfani da ...
A lokacin, wannan kundin ya kasance abin lura. A shekarar 2026, ba haka yake ba. Bugun kwanan nan na mu Tsarin Lambobin Mugunta tabbatar da cewa akwai fakiti 100-200+ na ɓarna a kowane mako a cikin npm da PyPI kaɗai, wannan taga ta kwana uku a yau za ta bayyana da yawa. Dabaru na fitar da ruwa da gujewa abubuwan da aka rubuta a ƙasa ba su ɓace ba; an ƙara musu masana'antu ne kawai a matakin da babu wanda ya zata a farkon 2024.
A matsayinmu na majagaba a fannin tsaron yanar gizo, hangen nesa na musamman na Xygeni ba wai kawai yana ba mu damar gano waɗannan barazanar ba, har ma da fahimtar ma'anarsu sosai. Wannan rahoto shaida ne ga yanayinmu. commitdon kare iyakokin dijital na gano shaidun da ba su da tushe a cikin lambar don guje wa juyawa a cikin hare-hare na gaba.
Ku biyo mu yayin da muke zurfafa bincike kan muhimman bayanai game da waɗannan kamfen ɗin, muna gano hanyoyin da maharan ke bi, kuma mafi mahimmanci, muna ba da haske kan yadda kamfanoni za su iya ƙarfafa tsaronsu daga irin waɗannan barazanar da ba ta dace ba.
Ganowa ta Farko: Rashin Amincewa da Aurora Webmail Pro
Ganowar farko a cikin bincikenmu ita ce kunshin da aka sanya wa suna aurora-webmail-pro, wanda aka ɗora zuwa rajistar NPM ta hanyar mai amfani da sunan barkwanci 0x379c kuBa da daɗewa ba aka gano wannan gano tare da gano ƙarin fakiti huɗu, duk wanda marubucin ya ɗora kafin matakan tsaro na rajistar su dakatar da ayyukansu.
Waɗannan fakitin sun haɗa blog_2021@1.1.1, walat ɗin zafi@10.1.1, sabonbooking@1.1.1, Da kuma pecko@1.0.1Bayan an duba kowace fakiti, an gano cewa tana ɗauke da wata lambar mugunta iri ɗaya da aka yi niyya don fitar da bayanan mai amfani masu mahimmanci.
Shirin yana dawo da bayanai masu mahimmanci game da tsarin da ya shafi mai amfani da tsarin kuma yana ƙirƙirar hexdump tare da irin waɗannan bayanai. Sannan ana maimaita bayanan kuma ga kowane yanki, ana yin buƙatar GET zuwa wani shafin waje, inda hanyar da aka shiga ita ce kowanne daga cikin sassan da aka gina.
Bayyanawa Na Biyu: Dabaru Iri-iri a Yaɗuwar Lambobin Mugaye
A lokaci guda da gano rukunin farko, bincikenmu ya gano ƙarin fakitin NPM guda huɗu, waɗanda masu amfani uku daban-daban suka rarraba a cikin rajistar.
Waɗannan fakitin, an jera su kamar haka anyone-deps@1.0.0, shoponline.epiroc.com@1.0.1, shoponline.epiroc.com@1.0.2, Da kuma synology-cft@10.0.0, sun raba wani zaren da aka saba amfani da shi a cikin tushen lambar su - kowannensu an ƙera shi ne don ɓoye bayanan mai amfani. Abin lura shi ne, hanyar da aka yi amfani da ita don fitar da bayanai a waɗannan misalan ta bambanta da ta rukunin farko, tana nuna wani kamfen daban, kodayake ba shi da kyau.
Wannan dabarar kamfen na biyu ta ƙunshi hanyar da ta fi dacewa ta tattara bayanai masu mahimmanci. Bayan kunnawa, lambar ɓarna da ke cikin waɗannan fakitin ta fara aikin leƙen asiri mai zurfi, tana fitar da cikakkun bayanai game da tsarin mai amfani, bayanan sirri na mai amfani, da kuma musamman, adireshin IP na tsarin. Wannan cikakken tattara bayanai yana da nufin tattara cikakken fayil akan wanda aka azabtar, yana shirya matakin yiwuwar yin kutse ko hare-hare masu zurfi.
Yana da matuƙar muhimmanci a jaddada cewa duk da yuwuwar waɗannan fakitin su ɓoye a matsayin wani ɓangare na ayyukan bincike na tsaro na halal, kamar waɗanda ke da nufin fallasa rauni ta hanyar dabarun rikicewar dogaro, gaskiyar lamarin ba ta canza ba. Waɗannan fakitin za a iya tsara su da niyyar mugunta, ta hanyar tattarawa da aika bayanai masu mahimmanci ga ƙungiyoyin waje marasa izini a ɓoye.
Faɗakarwa ta Musamman: Abubuwan da ke haifar da djs13 da kuma illolinsa ga tsaron yanar gizo
A tsakiyar binciken da aka yi kan fakitin da aka ambata a sama, dandalinmu ya yi alamar wani sabon abu: fakiti mai suna djs13-fetcherWannan gano na musamman ya bambanta da na baya, ba kawai a cikin hanyar aikinsa ba har ma a cikin yanayin barazanar da yake haifarwa. djs13-fetcher an gano shi azaman fara saukarwa da aiwatar da jerin abubuwan da aka makala daga Discord, musamman fayil ɗin binary mai suna astroia.exeBayan an yi bincike sosai ta hanyar sabis na bincike mai sarrafa kansa, wannan binary ya sami Maki na Barazana na 85/100, wani ƙima da ke rarraba shi a matsayin malware ba tare da wata shakka ba.
Aikin djs13-fetcher da kuma aiwatar da astroia.exe daga baya sun nuna wani tsari mai sarkakiya da kuma fuskoki da dama na barazana. An tsara binary ɗin da ake magana a kai don yin jerin ayyuka da ke nuna wani mummunan nufi:
- Tsarin Tsarin Haihuwa: Malware yana fara aiwatar da tsare-tsare da yawa bayan an aiwatar da shi, wata dabara da ake amfani da ita don aiwatar da ƙarin rubutun mugunta ko kuma don kafa tushe a kan tsarin da ya kamu da cutar don ƙarin nauyin da ake buƙata.
- Bayanin Tsarin Tambaya: Yana gudanar da tambayoyi masu yawa game da bayanai game da tsarin. Wannan aikin yawanci ana nufin tattara bayanai game da yanayin tsarin, wanda za'a iya amfani da shi don daidaita hare-haren da ke gaba zuwa takamaiman raunin tsarin.
- Yin Ayyukan Dabaru Masu Gujewa: Wataƙila mafi mahimmanci, an tsara astroia.exe don aiwatar da tambayoyin Windows Management Instrumentation (WMI) don gano ko yana gudana a cikin injin kama-da-wane (VM). Wannan ɗabi'a wani aiki ne na gujewa, wanda aka yi niyya don guje wa ganowa da bincike daga ƙwararrun masu amfani da yanar gizo da tsarin sarrafa kansa waɗanda galibi ke amfani da VM don nazarin malware.
Key takeaways
Gano waɗannan fakitin npm guda 10 masu cutarwa, tare da shari'ar musamman ta djs13-fetcher, alama ce ta farko ta wani tsari da tun daga lokacin ya wuce abin da kowa ya zata a watan Janairun 2024.
Wannan gaskiyar ta nuna, duk da haka, muhimmiyar rawar da Sabis na Gargaɗi na Farko na XygeniAn tsara shi don yin nazari da kuma faɗakar da jama'a game da barazanar da ka iya tasowa a cikin sabbin fakitin npm da zarar an buga su, sabis ɗinmu ya wakilci babban ci gaba a cikin kariyar tsaro ta yanar gizo a lokacin, kuma dabarunsa sun zama dole ne kawai yayin da ƙarar ke ƙaruwa. Ta hanyar bayar da gano alamun cutarwa da wuri, tun kafin standard bin hanyoyin da aka bi, muna ba abokan cinikinmu damar kare tsarin manhajojinsu daga barazanar shigar malware kafin ya iya haifar da lahani. Wannan nau'in ganowa yanzu yana ci gaba da gudana: duba binciken da aka tabbatar a wannan makon a cikin namu Tsarin Lambobin Mugunta.
Dole ne ƙungiyoyi su ba da fifiko ga aiwatar da ingantattun ka'idojin tsaro, tun daga binciken lambobi na yau da kullun zuwa kayan aikin gano abubuwa masu inganci, don kare kansu daga dabarun zamani da maƙiyan yanar gizo ke amfani da su. Xygeni, muna nan commitYa jagoranci wannan yaƙin da ake ci gaba da yi, yana bai wa abokan hulɗarmu da kuma al'umma baki ɗaya ilimi da kayan aikin da ake buƙata don tunkarar waɗannan barazanar masu ban tsoro.
FAQ
Shin fakitin npm masu cutarwa har yanzu suna ƙara zama matsala a 2026?
Eh, abin mamaki ne. Wannan rubutun ya tattara fakitin npm guda 10 masu cutarwa da aka samu a cikin kwanaki uku a watan Janairun 2024. Xygeni's Malcious Code Digest yanzu ya tabbatar da fakitin cutarwa sama da 100-200 a kowane mako a fadin npm da PyPI, shaida ce da ke nuna cewa dabarun fitar da bayanai da kaucewa bayanai da aka gano a nan sun yi girma sosai maimakon ɓacewa.
Ta yaya zan iya duba idan kunshin npm yana da mugunta kafin in shigar da shi?
Tabbatar da tarihin mai kula da shi, duba kwanakin bugawa da kuma adadin saukewa don abubuwan da ba su dace ba, kuma yi amfani da na'urar daukar hoto ta atomatik wadda ke nuna alamun fitar da bayanai da kuma halayen gujewa, ba kawai abubuwan da aka sani ba-CVE, tunda yawancin fakitin cutarwa, gami da dukkan 10 da aka tattauna a nan, ba su da kyau a lokacin gano su.
Ta yaya zan iya duba idan kunshin npm yana da mugunta kafin in shigar da shi?
Tabbatar da tarihin mai kula da shi, duba kwanakin bugawa da kuma adadin saukewa don abubuwan da ba su dace ba, kuma yi amfani da na'urar daukar hoto ta atomatik wadda ke nuna alamun fitar da ruwa da kuma halayen gujewa, ba kawai abubuwan da aka sani ba-CVE, tunda yawancin fakitin cutarwa kamar waɗanda ke cikin wannan rahoton ba su da kyau a lokacin gano su.
Shin har yanzu ana samun sabbin fakitin npm marasa kyau akai-akai?
Eh. Xygeni's Tsarin Lambobin Mugunta yana wallafa sabbin fakitin npm da PyPI masu cutarwa da aka tabbatar kowace mako; dabarun fitar da ruwa da kuma kaucewa VM da aka rubuta a cikin wannan rahoton na 2024 sun kasance ruwan dare a cikin fakitin da aka gano a yau.
