Gabatarwa: Tashin Hankalin Wasannin GitHub da Haɗarin da ke Bayan Nishaɗin
Idan kun taba nema Wasannin GitHub, wataƙila kun ci karo da komai, tun daga masu harbi da aka gina a burauza zuwa tsoffin kwafi da aka gina da JavaScript ko Python. Waɗannan ayyukan suna da daɗi a gwada, suna da sauƙin gudanarwa, kuma galibi suna bayyana a cikin koyaswar YouTube ko dandali. Sakamakon haka, sun shahara musamman a makarantu, inda masu haɓakawa da ɗalibai galibi ke samun damar yin amfani da su ta hanyar. Wasannin GitHub da aka cire ba tare da an buɗe su ba ko kuma a cire su daga Wasannin GitHub io shafuka.
Saboda wannan shahararriyar, masu haɓaka software da ɗalibai duk suna yin kwafin waɗannan ma'ajiyar, suna gudanar da lambar, kuma suna ci gaba ba tare da tunani sosai ba. Amma ga matsalar: ba duk waɗannan wasannin ne suka yi kama da su ba.
Wasu wuraren ajiye wasanni suna gudanar da rubutun shigarwa mara kyau. Wasu kuma suna jawo tsoffin abubuwan dogaro ko masu rauni. Wasu ma suna ɓoye malware a cikin kadarori, kwantena, ko fayilolin turawa. Tunda masu haɓaka wasanni da yawa suna ɗaukar nauyin waɗannan ayyukan ta hanyar Wasannin GitHub io, haɗarin ya bazu cikin sauri kuma sau da yawa ba a lura da shi ba.
A cikin wannan rubutun, za mu binciki yadda wuraren ajiye wasanni za su iya zama babbar barazana ga tsaro. Za mu kuma nuna muku yadda za ku zauna lafiya ba tare da barin sha'awarku ko sha'awarku ba. CI/CD.
Dalilin da yasa Masu Kai Hare-hare ke kai hari ga Wasannin GitHub da Ma'ajiyar da ba a Katange ba
Da farko kallo, wuraren ajiye wasanni a GitHub ba su da lahani. Bayan haka, galibi ƙananan gwaje-gwaje ne ko ayyukan ilimi da aka gina don nishaɗi. Duk da haka, masu kai hari suna ganin waɗannan daban. A zahiri, da yawa irin waɗannan Ana amfani da wuraren ajiya azaman dandamali na isar da malware, sau da yawa ana ɓoye shi kamar Wasannin GitHub or wasannin github da ba a buɗe ba.
Misali, wani mai barazana da aka sani da Stargazer Goblin yana aiki akan hanyar sadarwa ta sama Asusun GitHub na fatalwa 3,000, wanda aka yi wa lakabi da "Stargazers Ghost Network." Wannan rukunin yana nuna, yana yaɗawa, da kuma kallon abubuwan ɓoye don ƙara haɓɓaka gani da sahihancinsu, yawanci yana kai hari ga masu amfani da ke neman kayan aiki ko yaudarar wasanni. An yi amfani da waɗannan ma'ajiyar bayanai don rarraba masu satar bayanai da kayan fansa kamar Atlantida Stealer, Rhadamanthys, Lumma Stealer, da RedLine.
Bugu da ƙari, wani kamfen mai sarkakiya da ake kira La'anar Ruwa ya yi amfani da makamai aƙalla Asusun GitHub 76, saka malware a cikin abin da ya zama kayan aiki na gaskiya. Ana ɓoye nauyin da aka ɗauka a cikin fayilolin aikin Visual Studio (PreBuildEvent), ana amfani da rubutun da aka ɓoye da kuma binary na tushen Electron don satar bayanai, cire bayanan burauza, da kuma dagewa na dogon lokaci. Manufofin sun haɗa da masu haɓakawa, ƙungiyoyin DevOps, da masu ƙirƙirar wasanni.
Masu kai hari suna amfani da gaskiyar cewa masu haɓaka wasan kwaikwayo da yawa suna yin kwafin wasannin github don gwadawa ko koyo daga gare su ba tare da sake duba lambar ba. Hakazalika, wasannin github io, wuraren ajiyewa da aka yi amfani da su ta hanyar GitHub Pages, na iya ɗaukar nauyin JavaScript mai cutarwa, hotuna, ko rubutun juyawa waɗanda ke aiki lokacin da aka ɗora su a cikin mai bincike. Tunda yawancin wasannin github io ana yin su ne da kuma sake amfani da su ba tare da zurfafa bincike ba, masu kai hari suna amfani da su don satar lambar da aka ɓoye, masu bin diddigin ɓoyayye, ko abubuwan da ke haifar da zazzagewa. Waɗannan dabarun suna amfani da amincin da masu haɓaka wasan kwaikwayo ke da shi a cikin ayyukan buɗaɗɗen tushe.
A takaice dai, shaharar wuraren ajiye wasanni da ayyukan wasan da ba a buɗe ba sun sa su zama wuri mai kyau ga masu kai hari. Ba tare da tantancewa mai kyau ba, mai haɓaka wasan mai son sani zai iya shigar da malware cikin muhallinsa ta hanyar yin kwafin ko ɗaukar nauyin wurin ajiye wasanni.
Kuna son tabbatar da duk ayyukan GitHub ɗinku?
Idan kuna mamakin yadda za ku kare ma'ajiyar GitHub ɗinku fiye da gyare-gyaren wasa, kada ku rasa rubutunmu mai zurfi game da izini, pull requests, CI/CD haɗin kai, da ƙari.
Tsarin Malware a cikin Wasannin GitHub da aka Katange da Wasannin GitHub IO
Lokacin da masu haɓaka suka bincika ayyukan da aka yiwa alama kamar github unblocked games, da yawa suna kama da marasa lahani. Duk da haka, wasu alamu da ke sake faruwa suna nuna manyan barazanar da za a iya rasa su cikin sauƙi.
Yaƙin neman zaɓe: La'anar Ruwa
Trend Micro ta gano wani kamfe mai suna La'anar Ruwa, wanda aƙalla Asusun GitHub 76 Ma'ajiyar kayan tarihi da aka yi amfani da su wajen adana makamai, waɗanda ke ɓoye a matsayin kayan aikin haɓakawa ko gyare-gyaren wasanni. Waɗannan ma'ajiyar suna ƙunshe da munanan ayyuka ta amfani da <PreBuildEvent> Alamu a cikin fayilolin aikin Visual Studio. A lokacin ginawa, rubutun PowerShell ko VBS da aka ɓoye suna sauke fayilolin ZIP da aka ɓoye, shigar da binary na tushen Electron, da kuma fitar da takaddun shaida, bayanan burauza, da alamun zaman. Malware kuma yana aiwatar da juriya ta hanyar ayyukan da aka tsara da canje-canjen rajista.
Lambar sirri a cikin Wasannin GitHub: Ƙugiya
<PropertyGroup>
<PreBuildEvent>
powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "download ZIP from GitHub → extract payload → run installer"
</PreBuildEvent>
</PropertyGroup>
Lambar Zamba: Aiwatar da PowerShell Mai Rufewa
# decode base64 payload
payload = decode_base64('...')
# run in memory
execute_in_memory(payload)
Wannan misali mai sauƙi yana nuna yadda lambar mugunta ke guje wa rubuta faifai ta hanyar ɓoyewa da aiwatarwa kai tsaye a cikin ƙwaƙwalwar ajiya.
Yaƙin neman zaɓe: La'anar Ruwa
Trend Micro ta gano wani aiki na barazana da aka sani da La'anar Ruwa, inda maharan suka yi amfani da aƙalla Asusun GitHub 76 don ɗaukar nauyin ma'ajiyar makamai. Waɗannan ayyukan sun bayyana a matsayin kayan aikin haɓakawa ko gyare-gyaren wasanni. A ciki, sun saka dabaru masu cutarwa a cikin fayilolin ginawa, musamman ta hanyar <PreBuildEvent> alama a cikin Visual Studio .csproj fayiloli.
Kayan aikin sun haɗa da rubutun matakai da yawa waɗanda suka sauke fayilolin ZIP da aka ɓoye, suka cire fayiloli, sannan suka aiwatar da ayyukan baya. Bugu da ƙari, maharan sun ƙara hanyoyin da suka dace ta amfani da gyare-gyaren rajista na Windows da ayyukan da aka tsara.
Misalin Lambar Zamba: Ƙungiya Gina Kayan Aikin Visual Studio
<PropertyGroup>
<PreBuildEvent>
powershell -Command "download ZIP from GitHub, extract payload, and run installer"
</PreBuildEvent>
</PropertyGroup>
Lambar Zamba: Aiwatar da Cikin Ƙwaƙwalwa ta hanyar PowerShell
# Decode and run base64 payload in memory
payload = decode_base64('...')
execute_in_memory(payload)
Wannan dabarar tana hana rubutu zuwa faifai, wanda ke taimaka wa masu hari su kauce wa gano ƙwayoyin cuta da kuma samun ɓoye.
Yaƙin neman zaɓe: Stargazer Goblin da Asusun Fatalwa
Wani babban hari kuma an samu shi ne ta hanyar Check Point Research, wanda ya nuna cewa an kai harin ne a wani wuri mai nisa. Stargazers Ghost NetworkAn yi amfani da wannan kamfen ɗin sama da Asusun GitHub na bogi 3,000 don ƙara yawan taurari, cokali mai yatsu, da masu kallo a kan ma'ajiyar miyagun abubuwa. Manufar ita ce ƙirƙirar wata ma'anar rashin gaskiya.
Waɗannan asusun fatalwa sun taimaka wajen haɓaka malware kamar su Atlantic Stealer, Lumma, Rhadamanthys, Da kuma RedLine, galibi suna kai hari ga masu haɓaka da 'yan wasa. A cikin kwanaki huɗu kacal, raƙuman hari guda ɗaya sun kamu da cutar fiye da 1,300 wadanda ke fama da su ta hanyar yaɗa fakitin gyaran wasanni da aka gyara ta hanyar hanyoyin haɗin Discord da README.
Misalin lambar ƙarya: MULLISH README
# Ultimate Game Mod Pack 🕹️
Download and run the installer here:
[Download Now](https://github[dot]com/ghost/repo/releases/latest/modpack.zip)
Tsarin Malware na gama gari a cikin Ma'ajiyar Wasannin GitHub
| juna | description |
|---|---|
| Shigarwa / Gina Rubuce-rubucen da aka riga aka shigar | Rubuce-rubucen da ke gudana ta atomatik yayin shigarwa ko ginawa don ɗaukar da aiwatar da ayyukan da aka biya daga nesa, sau da yawa ba tare da sanin mai amfani ba. |
| Yin amfani da linzamin kwamfuta na bogi (Typosquatting) da kuma 'Freck Forks' | Ayyukan mugunta waɗanda ke kwaikwayon sunaye ko tsarin shahararrun kayan aiki ko wuraren ajiye wasanni don yaudarar masu haɓakawa su shigar da su. |
| Cin Zarafin Shafukan GitHub | JavaScript, hotuna, ko tura saƙonnin da aka ɓoye a cikin shafukan 'github io games' waɗanda ke haifar da aiwatar da rubutun da ba su da kyau yayin da ake loda shafi. |
| Siginar Shahararrun Karya | Labarin fatalwa yana ƙara taurari, cokali mai yatsu, da masu kallo ta hanyar wucin gadi don sa wuraren adana muggan abubuwa su zama abin dogaro. |
Waɗannan dabarun ba na nazari ba ne. An riga an lura da su kai tsaye kamfen ɗin malware, waɗanda da yawa daga cikinsu sun yi niyya ga masu haɓaka wasan da ke amfani da wurin ajiye wasanni a matsayin wuraren shiga.
Abin farin ciki, wasu dandamali na tsaro na iya kama waɗannan alamu kafin su haifar da lalacewa. A sashe na gaba, za mu nuna yadda Xygeni ke gano, toshewa, da kuma gyara waɗannan barazanar a cikin na'urarka. SDLC.
Yadda Xygeni Ke Tabbatar da Wasannin GitHub, Ayyukan da Ba a Katange ba, da CI/CD Pipelines
Idan akwai alamun haɗari a cikin GitHub game repos, Xygeni yana ba da cikakken kariya don dakatar da barazanar kafin su lalata tsarin ku ko sarkar samar da kayayyaki.
1. Gargaɗi da Farko: Gano Malware na Ainihin Lokaci a cikin Wasannin GitHub da Abubuwan da Suka Dogara da Shi
Xygeni ci gaba da bincika sabbin fakiti a cikin NPM, Maven, PyPI, da ƙari. Wannan ya haɗa da fakitin da aka saka a wurare da ba a zata ba, kamar wuraren ajiye wasanni ko ayyukan wasannin github da ba a buɗe ba waɗanda aka raba a cikin dandali ko hanyoyin sadarwa na makaranta. Idan aka sami wani abu da ake zargi, Xygeni yana killace shi ta atomatik, yana toshe amfaninsa a cikin abubuwan da kake dogaro da su, kuma yana aika faɗakarwa a ainihin lokaci ga ƙungiyar ku. Wannan yana hana ayyukan da ba su dace ba shiga cikin tushen lambar ku ko CI/CD pipeline.
2. Sanin Isarwa SCA tare da Fifiko Mai Hankali
Maimakon ka cika ƙungiyarka da faɗakarwa, Xygeni yana tantance ko da gaske ana amfani da rauni a cikin lambar ku (iya isa gare shi) kuma ya haɗa da ƙimar haɗari (EPS, tasirin kasuwanci) don gabatar da mafi mahimmancin batutuwa. Wannan yana rage hayaniya sosai kuma yana tabbatar da cewa ƙungiyar ku tana aiki akan abin da ya fi muhimmanci.
3. Amfani da Gyaran Kai ta atomatik Pull Requests
Idan aka gano rauni ko dogaro da mugunta tare da gyara da aka sani, Xygeni yana ƙirƙirar ta atomatik Pull Request don haɓakawa ko gyara matsalar. Wannan yana hanzarta lokacin amsawa, yana iyakance aikin hannu, kuma yana kiyaye ku pipeline amintacce
4. CI/CD Sarrafa Tsaro Don Toshe Gine-gine Masu Mummunan Aiki
Xygeni yana haɗuwa da ginawa pipelines ta hanyar GitHub Actions, Jenkins, GitLab, da Azure Pipelines, da sauransu. Yana bincika rubutun ginawa, fayilolin Docker, da CI/CD saita don umarni masu tuhuma, kamar su juyewar harsashi ko shigar da rubutun, kuma yana iya toshe ginin idan an gano lambar haɗari.
5. Gina Mutunci ta hanyar Shaidar da ta Bi SLSA
The Build Security module yana ƙirƙirar takaddun shaida da aka sanya hannu bayan SLSA da in-toto standards, saka bayanai a kan tushe, abubuwan da suka dogara da su, SBOM, da gwaje-gwaje. Idan wani gyare-gyare da ba a ba da izini ba ya faru, tabbatarwar shaidar ta gaza kuma pipeline yana tsayawa ta atomatik.
6. Gano Canje-canje a cikin SCM da kayayyakin tarihi na CI
Xygeni yana ci gaba da sa ido kan lambar tushe da muhallin CI don gano halaye marasa kyau, kamar committare da kaucewa kariyar reshe, masu amfani da ba a san su ba, ko tallafin alamun da ba a zata ba. SAST injin, yana gano ɓoyayyun ƙofofin baya ko rubutattun allura kafin a haɗa ko a tura.
7. Gano Kadarorin da Aka Yi Amfani da su ta atomatik da kuma ASPM Ganuwa
Xygeni yana ginawa kaya kai tsaye na ku duka SDLC tsarin halittu, gami da ma'ajiyar bayanai, masu haɗin gwiwa, pipelines, abubuwan da suka dogara da su, da kuma hanyoyin sadarwa na girgije. Wannan ganuwa tana ba da damar fifita haɗari mai ƙarfi, taswirar bin ƙa'idodi (misali NIS2, DORA), da kuma shaidar da aka shirya don tantancewa ba tare da katse ayyukan aiki da ake da su ba.
Abin da Wasannin GitHub ke nufi ga Masu Haɓaka Tsaro: Ku Kasance Masu Son Sani, Ku Kasance Masu Tsaro
- Idan repo ya ƙunshi rubutun ginawa da aka ɓoye wanda ke saukar da lambar mugunta (misali rubutun PowerShell bayan shigarwa), Xygeni zai yi alama ya toshe shi kafin a aiwatar da shi.
- Lokacin haɗa lambar da ke nuni ga dogaro mai tuhuma, Xygeni duka yana toshe ta kuma yana ba da gyara ta atomatik ta hanyar Pull Request.
- Idan Shafukan GitHub, aikin da aka shirya ya ƙunshi ɓoyayyun rubuce-rubucen mugunta, Xygeni's SCA kuma gano ƙwayoyin cuta yana gano su koda kuwa suna aiwatarwa ne kawai yayin loda shafi.
- Gina pipelines zai ƙi commitIdan kayan tarihi ko tsare-tsare da aka gina suka gaza tabbatar da ingancinsu, hakan zai hana ginin da aka lalata samun ci gaba.
Tare da Xygeni, zaku iya ci gaba da ganowa da gwadawa wasannin github da kwarin gwiwa. Kowace mataki, daga yin kwafin bayanai zuwa tura bayanai, ana kiyaye ta. Masu haɓaka suna ci gaba da sha'awar sani, pipelines ku kasance cikin aminci, kuma tsarin samar da kayayyaki zai kasance cikin tsafta.
