Fasahar software ta bunƙasa, kuma masu kutse sun bunƙasa da ita. Gasar makamai tare da miyagun mutane galibi ta takaita ne ga rauni da hare-haren da aka kai wa manhajar da aka tura. Kai hari kan sarkar samar da software, kodayake ba a gani ba, ba shine babban abin da miyagun mutane ke hari ba…
Harin da mutane da yawa suka yi magana a kai a matsayin farkon sauyi a tsarin aikin Advanced Persistent Terrames (APTs) shine Harin SolarWindsBa na farko ba ne, amma da irin wannan tasirin da ya jawo hankalin jama'a kuma ya mamaye harkokin IT.
Misalai: SolarWinds, Codecov, Kaseya
SolarWinds babban mai sayar da manhajoji ne wanda ke samar da kayan aiki don sa ido kan hanyoyin sadarwa da ababen more rayuwa. Ɗaya daga cikin kayayyakin kamfanin shine Orion, wani dandamali na sa ido kan kayayyakin more rayuwa da kuma kula da su. Ƙungiyoyi sama da 30,000 na gwamnati da masu zaman kansu ne ke amfani da shi don sarrafa albarkatun IT ɗin su. Orion yana samun damar shiga tsarin IT don samun bayanan aiki da tsarin.
A watan Disamba na shekarar 2019, masu kutse sun shiga hanyoyin sadarwa, tsarin da bayanai na dubban abokan cinikin SolarWinds. Sun kai hari kan tsarin samar da manhajarsu ta hanyar saka lambar sirri a cikin dandamalin. Daga baya, SolarWinds ta aika da malware a bayan gida a matsayin sabuntawa ga manhajar Orion, wacce masu kutse za su iya shiga da kuma kwaikwayon masu amfani da asusun kungiyoyin da abin ya shafa. Kutsen SolarWinds ya yi kama da farkawar tsaro ta yanar gizo ga dukkan kungiyoyi da ke aiki a duniyar girgije.
Wannan harin sarkar samar da kayayyaki ya biyo bayan wasu kamar Codecov, wani kayan aiki na kare lambar software. A watan Janairun 2021, wani maharin ya fitar da takardar shaidar aiki an adana shi bisa kuskure a cikin hoton Docker na Codecov, wanda ɗan wasan ya yi amfani da shi don gyara rubutun mai lodawa a cikin kayan aikin. Ɗan wasan ya saka layi ɗaya na lambar da ke aika duk masu canjin yanayin CI zuwa sabar da mai kai hari ke sarrafawa lokacin da aka aiwatar da rubutun. Tsawon watanni, miyagun masu aikata laifuka sun sami damar shiga tsarin da suka yi amfani da rubutun Codecov da aka gyara.
Daga baya, a ranar 2 ga Yuli, 2021, hari a Kaseya An yi amfani da dandamalin VSA ɗinsa ta hanyar MSPs da yawa waɗanda ke ba da ayyukan IT ga wasu kamfanoni don gudanar da ayyukan gyara da sa ido kan abokan ciniki. Masu kutse sun kai hari kan sarkar samar da kayayyaki ta Kaseya VSA, suna lalata kayayyakin more rayuwa sannan daga baya suka fitar da sabbin bayanai marasa kyau akan sabar VSA na gida don cutar da tsarin kamfanonin da ake gudanarwa, suna ɓoye bayanan su da kuma neman fansa. Ransomware ta hanyar kayan aiki mai ɓoye da MSPs ke amfani da su akan kamfanonin da ake gudanarwa, waɗanda sune maƙasudin ƙarshe. Abin mamaki!
Tun bayan afkuwar SolarWinds, an samu karuwar hare-hare kan tsarin samar da manhajoji, wanda hakan ya shafi hoton kamfanoni da tattalin arzikin kamfanoni kamar Samsung, Uber, Nissan, Nvidia, da sauransu. A cewar Gartner, "nan da shekarar 2025, kashi 45% na kungiyoyi a duk duniya za su fuskanci hare-hare kan tsarin samar da manhajoji, wanda hakan ya ninka sau uku tun daga shekarar 2021."
Sabuwar Tsari ta Hare-haren Sarkar Samar da Manhaja
Kai hari ga aikace-aikacen kamfani ko yanayin samarwa yana haifar da wanda aka zalunta kawai. Wannan, tare da gaskiyar cewa yawancin kamfanoni sun riga sun aiwatar da kariyar AppSec kamar AST, SCA ko kayan aikin WAF, ya haifar da fitowar sabuwar tsararrun masu kai hari da nufin haɓaka software pipelineHare-haren sarkar samar da kayayyaki na iya shafar dubban kamfanoni da hari ɗaya kawai: ingantaccen amplifier.
Kayayyakin ci gaba abu ne mai sauƙi ga masu kai hari. Babban saman harinsa yana ba da damar shiga yanayin samarwa da bayanansa. Duk kayan aikin DevOps: ma'ajiyar bayanai, tsarin sarrafa tushen bayanai, kayan aikin gini, kayan aikin turawa, samfuran Kayan Aiki kamar Lambobi, kwantena, fayilolin rubutun bayanai, da sauransu, suna da girma kuma suna da rauni. Bugu da ƙari, duk waɗannan kayan aikin ba su da ikon sarrafa yankin tsaro kuma ƙungiyoyin haɓakawa da samarwa ne ke sarrafa su. Masu satar bayanai sun san wannan kuma suna amfani da waɗannan raunin.
Sabuwar Manufa
Sau da yawa masu haɓaka suna rubuta sirri a cikin lambar tushe kamar takardun shaida da maɓallan gwaji yayin haɓakawa. Ana adana waɗannan a cikin fayiloli galibi a ƙarƙashin ikon sigar, kuma masu kai hari za su iya gano su a nan gaba, koda kuwa an cire fayilolin ko sirrin. Wannan zai ba masu kai hari damar shigar da ƙofofin baya, karanta lambar tushe, saka lambar ɓarna, cire bayanai masu mahimmanci, da sauransu… Da zarar masu aikata mugunta sun sami inganci login takardun shaidar da za su iya motsawa a gefe ta hanyar SDLCWaɗannan takardun shaida suna ba su damar komawa zuwa wasu kayan aiki da kuma samun damar amfani na zamani don neman bayanai masu daraja.
Hackers na iya amfani da bayanan sirri don keta haƙƙin mallaka SDLC, amma kuma suna iya shiga cikin rumbunan ajiya ko kayan aiki waɗanda ba a daidaita su daidai ba ko kuma su bar su cikin rashin tsaro, wanda ke sanya tsarin da bayanai cikin haɗari.
Harin kuma yana kai hari ga fakitin bude tushen. Duk mun san labaran ban tsoro game da hare-haren da ke amfani da raunin da aka sani, kamar Log4j. A gefe guda kuma, hare-haren sarkar samar da kayayyaki sun bambanta: masu kai hari suna saka lambar mugunta a cikin shahararrun fakitin bude tushen don amfani da su daga baya a cikin tsarin ginawa ta ƙungiyoyi da yawa a duniya.
A takaice: Masu kutse za su iya amfani da damar shiga ta musamman, rashin daidaito da rauni a cikin CI/CD pipeline kayayyakin more rayuwa a matsayin vector don saka malware a cikin software wanda mutane da yawa zasu iya amfani da shi.
Yadda za a kare namu SDLC daga Harin Sarkar Samar da Manhaja?
Adadin hare-haren sarkar samar da kayayyaki yana ƙaruwa akai-akai, kuma kasuwa tana mayar da martani ga wannan yanayi. Wasu ƙungiyoyi sun kafa tsare-tsare don magance matsalar. software supply chain security, kamar Tsarin Haɓaka Software na NIST Secure (SSDF) da Matakan Sarkar Kayayyakin Kayayyaki na Google (SLSA). Duk da haka, babu kamfanoni da yawa da suka ba shi fifiko wajen kare kayan aikin DevOps da kayayyakin more rayuwa don guje wa hare-hare kan sarkar samar da kayayyaki. A gaskiya ma, Kashi 82% na CIOs suna tunanin za su kasance masu rauni a gare su.
Kamfanoni ba wai kawai ya kamata su damu da kare aikace-aikacen su ba, har ma da kayayyakin more rayuwa na software da kayan tarihi waɗanda suke ɓangare na tsarin aikinsu SDLC yayin da miyagun masu aikata laifuka ke kai hari kan tsarin samar da kayayyaki. Faɗin harin, rashin wayar da kan ƙungiyoyin ci gaba na wannan nau'in harin da kuma rashin kayan aikin tsaro na musamman yana bawa maharan damar mai da hankali kan tsarin samar da software.
Ƙarshen Magana
Kare namu pipeline yana ƙara zama da gaggawa kowace rana, kuma fifiko ga CISOs, wanda dole ne ya tabbatar da cewa ƙungiyoyin tsaro sun mai da hankali kan tsarin samar da kayayyaki kuma su yi aiki tare da ƙungiyoyin Devops don karewa SDLC daga irin wannan harin.
Amfani da kayan aikin da zasu taimaka mana wajen tabbatar da tsaronmu SDLC, gano ƙofofin baya, halayen da ake zargi, da kuma dakatar da hare-haren sarkar samar da kayayyaki ya zama dole don kiyaye muhallin DevOps na sirri da tsaro. Kayan aikin farko don karewa software supply chain security sun fara bayyana. Wasu sun fi mai da hankali kan ɓangaren Dev wasu kuma a ɓangaren Ops. Wasu kuma, kamar Xygeni, suna da manufar kare mutunci da tsaron tsarin software a duk faɗin DevOps.
Domin karantawa |
|
|
|
|
