Hare-haren sarkar samar da manhajoji na ƙara zama ruwan dare da kuma ɓarna. Misali, Gartner ya yi hasashen cewa kashi 45% na dukkan kasuwanci za su fuskanci matsalar karya doka nan da shekarar 2025. Bugu da ƙari, Harkokin Tsaro na Yanar Gizo yana nuna girman wannan barazanar, yana mai hasashen asarar da za ta kai dala biliyan 138 a kowace shekara nan da shekarar 2031. Gabaɗaya, waɗannan hasashen sun nuna buƙatar gaggawa ga ƙungiyoyi su ba da fifiko software supply chain security da kuma aiwatar da tsauraran matakai don kare bayanai masu mahimmanci, ayyuka, da kuma suna.
Saboda na zamani pipelines sun dogara sosai akan abubuwan waje, ƙaruwar ɗakunan karatu na ɓangare na uku, saurin zagayowar haɓaka software, sarƙoƙi masu rikitarwa, rashin gani, sabbin dabarun kai hari, ɗaukar SaaS, da ƙarancin albarkatu duk suna haifar da ƙaruwar a cikin Hare-haren sarkar samar da softwareSaboda haka, ƙungiyoyi dole ne su ɗauki cikakkiyar hanya mai aiki don magance waɗannan ƙalubalen da kuma kare hanyoyin samar da software ɗinsu.
Menene Harin Sarkar Samar da Manhaja?
ENISA ya bayyana a Harin Sarkar Samar da Manhaja as "yin sulhu kan wani kadara ta musamman, misali kayayyakin more rayuwa na mai samar da manhaja da manhajojin kasuwanci, don lalata wani takamaiman manufa ko manufa, misali abokan cinikin mai samar da manhaja." A wata ma'anar, Harin Sarkar Samar da Manhaja wani aiki ne na mugunta wanda ke kai hari ga sarkar samar da manhaja, da nufin yin sulhu da kuma saka rauni ko malware a cikin tsarin haɓakawa da rarrabawa. Sakamakon haka, wannan nau'in harin yana amfani da hanyar sadarwa mai alaƙa da juna kuma galibi mai rikitarwa ta hanyoyin aiki, kayan aiki, da ƙungiyoyi da ke da hannu wajen ginawa da isar da manhaja.
Mahimman abubuwa da ra'ayoyi da suka shafi Harin Sarkar Samar da Manhaja
Bayanan sirri game da barazanar yanar gizo da kuma bayanan sirri galibi suna lalacewa Hare-haren sarkar samar da software cikin rukunoni daban-daban domin ingantaccen bincike da kariya. Saboda haka, wannan sashe yana gabatar da muhimman ra'ayoyi guda biyar da aka bayyana ta hanyar da aka bayyana ta hanyar da aka bayyana ta hanyar da aka bayyana ta hanyar da ba ta dace ba. Katalog ɗin Tsarin Harin MITREWannan kundin yana tsara tsarin hare-haren sarka don sauƙaƙe bincike ta amfani da majiyoyi daban-daban, gami da barazanar gaba da NIST ta tattara.
Dokar Hari: Abin da
Wannan harin wani aiki ne na musamman da ke kawo mummunan aiki ko niyya ga tsarin. Sakamakon haka, yana haifar da lahani kai tsaye.
- Misali na 1: An saka malware a cikin software na tsarin yayin aikin ginawa.
- Misali na 2: Bukatun tsarin ko takardun ƙira sun canza ta hanyar mugunta.
Vector na Hari: Yadda
Hanyar kai hari ita ce hanyar da abokan gaba ke amfani da ita don amfani da rauni ko sarrafa raunin da ke tattare da shi. Saboda haka, yana nuna yadda maharan ke shiga da kuma cin zarafin wurin harin.
- Misali na 1: Mai hari yana canza lambar tushe a cikin ma'ajiyar da aka lalata.
- Misali na 2: Mai hari yana samun damar shiga takardun fasaha na ciki ba tare da izini ba.
Bincika ƙarin bayani a cikin shirinmu na Kamus na Vector Kai hari don ƙarin fahimta.
Asalin Hari: Wanda
Asalin ya gano tushen harin. Saboda haka, yana fayyace rawar da maharin ya taka, matsayinsa, ko alaƙarsa da tsarin.
- Misali na 1: Mai shiga ciki wanda ke da damar yin amfani da sabar ginawa yana gyara rubutun.
- Misali na 2: Wani mai barazanar waje ya loda wani kunshin trojanized zuwa rajistar jama'a.
Manufar Hari: Dalilin
Manufar ta bayyana dalilin harin. Fiye da komai, tana nuna abin da abokan gaba ke son cimmawa.
- Rushewa: dakatar da ayyuka ko gine-gine.
- Cin hanci da rashawa: rage aminci ta hanyar canza kayan tarihi ko lambar tushe.
- Bayyanawa: fallasa sirrin sirri ko kadarorin ilimi.
Tasirin Hari: Sakamakon
A ƙarshe, tasirin ya bayyana sakamakon hari, yana nuna sakamakon masu samar da software da abokan ciniki.
- Misali na 1: Duk wani aiki da ya yi amfani da mummunan shiri zai lalace daga baya.
- Misali na 2: Mutane suna shigar da manhajoji marasa kyau a cikin tsarin aikinsu ba tare da sun sani ba.
Hare-haren Sarkar Samar da Manhaja Mafi Yawa
Nau'o'i da yawa Hare-haren sarkar samar da software akwai, kuma dole ne ƙungiyoyi su san nau'ikan masu haifar da barazana a kowane mataki na zagayowar rayuwa. Dangane da tsarin SLSA, Cibiyar Nazarin Ƙasa ta Amurka StandardFasaha da Fasaha (NIST), Da kuma Hukumar Tsaron Yanar Gizo da Kayayyakin more rayuwa (CISA), waɗannan barazanar za a iya raba su zuwa rukuni huɗu: tushen, ginawa, kunshin, da haɗarin dogaro.
Hare-haren Sarkar Samar da Manhaja a Matakin Tushe
- Aika lambar da ba ta da kyau → duba yadda Buƙatar Flask. sami rashin amfani or kurakuran rashin tsaro na cire kayan tarihi ƙirƙirar saman kai hari kai tsaye.
- Ma'ajiyar tushen sulhu
- Gina daga tushen da aka gyara
- Rubuta lambar da ba ta da tsaro
- Rage mahimman fayiloli → kamar yadda aka bayyana a cikin Binciken ƙofar baya na chmod 777.
Hare-haren Sarkar Samar da Manhaja a Matakin Ginawa
a cikin Matakin Ginawa, masu haɓaka suna tattarawa da haɗa lambar zuwa sigar aiki. saboda wannan matakin yana da matuƙar muhimmanci, haɗari sun haɗa da tsallake binciken tsaro a cikin CI/CD pipeline, canza lambar bayan sarrafa sigar, ko kuma yin katsalandan ga tsarin ginawa. Sakamakon haka, lambar mugunta na iya shiga cikin kayan tarihi ba tare da an sani ba.
- Tazarar CI/CD → an haɗa shi zuwa GitHub ya riga ya gina malware.
- Gyara lambar bayan sarrafa tushe
- Tsarin gina sulhu → An rage shi da Gano gargaɗin da wuri na DevSecOps.
- Ma'ajiyar kayan tarihi ta Compromise
Hare-haren Sarkar Samar da Manhaja a Matakin Kunshin
The Matakin Kunshin shine lokacin da muka haɗa dukkan lambar don yin samfurin ƙarshe. Wannan ɓangaren yana da haɗari saboda wani zai iya amfani da fakiti mara kyau ko canza wuraren kan layi inda muka same su. Masu kai hari ma za su iya loda nau'ikan fakiti masu cutarwa zuwa waɗannan gidajen yanar gizo.
- Yi amfani da fakitin da aka lalata → an rufe shi kimantawa na'urar daukar hoton malware.
- Rijistar fakitin sulhu
- Loda fakitin da aka gyara → an yi nazari a ciki Namso-gen jabun janareta malware.
Hare-haren Sarkar Samar da Manhaja a Matakin Dogaro da Kai
a cikin Matakin Dogaro, muna ƙara ɗakunan karatu da fakiti na ɓangare na uku zuwa ga manhajarmu. Wannan matakin yana da haɗari domin duk wata matsala a waɗannan sassan na iya yaɗuwa cikin sauƙi da a hankali zuwa sauran ayyukan.
- Yi amfani da Amincewa Mai Sauƙi → an yi bayani da Haɗarin DoS a cikin dogaro da aka ɓoye.
- Dogara Mai Tsawo Ko Mai Rauni
- Hadarin Dogaro da Kai na Canji
- Rijistar Kunshin Mummunan → An rage shi da Kayan aikin tsaro na DevOps da kuma ɓangare na uku haɗarin haɗari.
Hadarin Sarkar Samar da Kayayyaki na Yau da Kullum a Kowane Mataki na SDLC
| horo | Barazana na yau da kullun | Example |
|---|---|---|
| source | • Aika lambar da ba ta da kyau ko mara tsaro • Gyaran fayiloli masu mahimmanci • Rashin daidaita ma'ajiyar tushen | XcodeGhost (2015): An saka lambar sirri mai cutarwa a cikin na'urar tattara Xcode ta Apple, wadda ta bazu a cikin manhajojin iOS. |
| Gina | • Kewaya CI/CD jami'in tsaro • Gyara lambar bayan sarrafa tushe • Ma'ajiyar kayan tarihi masu rikitarwa | SolarWinds Orion (2020): maharan sun kutsa kai cikin ginin pipeline, saka ƙofar baya cikin sabunta manhajojin da aka sanya hannu. |
| Package | • Ana loda fakitin da aka gyara • Rijistar fakitin guba • Rarraba kayan tarihi da aka lalata | NPM na EventStream (2018): maharin ya saka ƙofar baya a cikin wani sanannen fakitin NPM da aka sauke sau dubbai. |
| dogara | • Amfani da tsofaffin abubuwan dogaro ko masu rauni • Amfani da dogaro na wucin gadi • Buga fakiti masu kama da na mugunta | Ƙofar Baya ta XZ (2024): wani ɗakin karatu na trojanized compression ya kusan jigilar shi zuwa rarrabawar Linux. |
Dabaru na Hare-haren Sarkar Samar da Manhajoji na Musamman
Bisa ga CISRahoton A da NIST, hare-haren sarkar samar da software galibi suna cikin manyan rukuni uku.
Duk da haka, abubuwan da suka faru kwanan nan sun nuna ƙarin ƙwayoyin cuta waɗanda masu haɓaka fasaha dole ne su fahimta.
A ƙasa za mu faɗaɗa dabarun da suka fi dacewa tare da misalai masu amfani.
Sabuntawar Sace Kaya
Masu kai hari suna lalata ingantattun hanyoyin sabuntawa don rarraba malware.
Misali, harin NotPetya a shekarar 2017 ya yi amfani da sabar sabunta manhajar harajin MEDoc ta Ukraine, yana isar da sako ga
malware mai lalata gogewa da aka ɓoye a matsayin faci. Domin kare kai daga wannan haɗarin, ya kamata ƙungiyoyi su yi amfani da shi Gano barazana da kuma mayar da martani ga DevOps ayyukan da ke nuna halayen da ba su dace ba a cikin sabuntawar kwararar.
Rage Sa hannun Lamba
Wannan dabarar ta ƙunshi cin zarafi ko satar takaddun sa hannu masu inganci don sanya lambar ɓarna ta zama halal.
Wani abin lura shi ne yarjejeniyar CCleaner a shekarar 2017, inda maharan suka rarraba manhajojin trojan da aka sanya wa hannu tare da takaddun shaida masu inganci.
Saboda haka, ƙungiyoyi suna buƙatar haɗin gwiwar sarrafa aminci kamar waɗanda aka bayyana a cikin dabarun dandamalin yanar gizo na tsaro
Lambar Buɗaɗɗiyar Tushe Mai Rarrabawa
Masu adawa suna shigar da ƙofofin baya cikin shahararrun fakitin buɗe tushen bayanai, waɗanda daga baya aka jawo su cikin dubban ayyuka.
Lamarin EventStream NPM da kuma XZ Utils backdoor (2024) sun nuna yadda wannan vector ya zama mai matuƙar muhimmanci.
Masu haɓakawa ya kamata su sake duba albarkatu kamar Tambayoyin da Ake Yawan Yi Game da Tsaron NPM da kuma abubuwan da suka faru na kunshin da ba a rubuta ba don koyon yadda ake guje wa dogaro da guba.
Ruɗani game da Dogaro
Alex Birsan ne ya fara bayyana hakan a shekarar 2021, inda ya yi amfani da wannan harin wajen sanya suna a tsakanin rajistar kunshin na ciki da na jama'a, yana yaudarar tsarin ginawa don jawo nau'ikan malware maimakon amintattun fakitin ciki.
Yin amfani da na'urar buga rubutu da kuma miyagun fakiti
Masu kai hari suna buga fakitin mugunta masu sunaye iri ɗaya da shahararrun ɗakunan karatu (misali, "buƙatu" maimakon "buƙatu").
Masu haɓaka manhajoji suna shigar da waɗannan ba da gangan ba, suna shigar da malware a cikin ayyukansu.
An yi nazarin misali na gaske a cikin Namso-gen malware kuma a cikin jerinmu na na'urorin na'urorin bincike na malware na bude-tushe.
Gina Pipeline Cin zarafi
Kamar yadda aka gani a cikin yarjejeniyar SolarWinds Orion, masu kai hari na iya kutsa kai cikin sabar ginawa don shigar da lambar mugunta yayin tattarawa.
Wannan ya sa dukkan sarkar kayan tarihi da aka sanya hannu ba za a iya amincewa da ita ba. Dabaru don rigakafi sun haɗa da sa ido CI/CD mutunci tare da gano gargadin da wuri da nazari
GitHub ya riga ya gina kamfen ɗin malware.
Yadda Harin Sarkar Samar da Manhaja Ya Kamata: Shari'ar SolarWinds
Fiye da komai, harin SolarWinds Orion shine mafi shaharar misali na keta sarkar samar da kayan software. Yana nuna yadda masu hari za su iya tafiya mataki-mataki a cikin tsarin ginawa kuma, sakamakon haka, yada lambar cutarwa ga dubban masu amfani.
Da farko, maharan sun shiga cikin sabar ginin SolarWinds.
Bayan haka, sun ƙara lambar mugunta a cikin sabuntawar Orion a hankali.
Saboda an sanya hannu aka kuma aika waɗannan sabuntawa a matsayin manhaja mai aminci, kamfanoni da yawa sun shigar da su ba tare da sanin haɗarin ba.
Gabaɗaya, ƙungiyoyi sama da 18,000 ne abin ya shafa, kuma maharan sun sami damar shiga tsarin da ke da matuƙar muhimmanci.
Daga ra'ayin mai haɓakawa, wannan harin yana ba da darussa guda uku masu sauƙi:
- Karewar kewaye bai isa ba: maharan sun canza ginin pipeline kanta.
- Ci gaba da bincike yana da matuƙar muhimmanci: amintacce build attestations, duba daidaito, da gano abubuwan da ba su dace ba suna taimakawa wajen hana yin kuskure.
- Guba ɗaya zai iya zama ruwan dare gama gari: guda ɗaya pipeline sulhu zai iya haifar da rikicin tsaro a duniya.
Xygeni: Babban Tsarin AppSec Mai Cika-Ciki Ɗaya
Domin hare-haren sarkar samar da software na iya kaiwa ga kowane mataki SDLC,
dandamalin AppSec mai cikakken-cikin-ɗaya, Xygeni, yana kare matakan tushe, gini, kunshin, da dogaro. Yana ba wa masu haɓakawa da ƙungiyoyin tsaro wuri ɗaya don hana, gano, da gyara haɗari ta hanya mai sauƙi. Sakamakon haka, ba kwa buƙatar sake haɗa kayan aiki da yawa, Xygeni yana rufe cikakken zagayowar rayuwa.
Kariyar Matakin Tushe
A matakin tushe, haɗari sun haɗa da rashin aminci commits, wuraren adana bayanai masu guba, ko fayilolin da aka canza. Xygeni yana duba lambar a ainihin lokaci da zurfi SAST da kuma gano sirri.
Hakanan yana toshe masu cutarwa commits ta hanyar CI/CD guardrails.
Ta wannan hanyar, ana magance matsalar kafin a sake kunna kwamfutar.
Kariyar Matakan Ginawa
A lokacin aikin ginawa, maharan na iya ƙoƙarin ketare hanya pipelineko canza kayan tarihi.
Xygeni ya tabbatar da tsarin ginawa tare da duba masu bin ka'idojin SLSA, tabbatar da inganci, da sa hannu marasa maɓalli. Hakanan yana lura da halaye marasa kyau a ciki CI/CD Ayyuka. Sakamakon haka, ana yi wa ginin da aka lalata alama nan take kuma a toshe shi kafin a sake shi.
Kariyar Matakin Kunshin
A matakin kunshin, rajistar da aka lalace ko ɗakunan karatu da aka gyara galibi suna gabatar da malware. Gano ƙwayoyin cuta da kuma duba lasisin Xygeni duba duk wani kayan tarihi, yayin da AutoFix yana ba da shawarar hanyoyin haɓakawa lafiya tare da nazarin Haɗarin Gyara. Kunshin da aka tabbatar kuma masu bin ƙa'idodi ne kawai ke ci gaba a cikin pipeline.
Kariyar Matakin Dogaro
Lambar ɓangare na uku ita ce babbar hanyar kai hari. Binciken Tsarin Software na Xygeni (SCA) Yana yin fiye da jerin CVEs, yana duba ko za a iya amfani da lambar haɗari a zahiri. Hakanan yana nuna ɓoye malware da dogaro mai haɗari na wucin gadi. Fiye da komai, wannan yana tabbatar da cewa masu haɓakawa suna jigilar dogaro mai aminci kawai.
Sirri da Tsaron Kayayyakin more rayuwa
Bayan lambar sirri da fakiti, hare-hare kan yi amfani da sirrin da aka fallasa ko kuma rashin kyawun tsarin aiki. Xygeni yana duba maɓallan da aka fallasa, alamun, da takardun shaida a cikin lambar, saitunan, da kuma matakan Docker. Hakanan yana iya tabbatarwa da soke sirrin da aka fallasa ta atomatik tare da Gyaran AutoFix. A lokaci guda, IaC dubawa yana hana kuskuren tsari da maharan za su iya yi wa illa daga baya.
Ganowa da Gyaran Hannu Mafi Wayo
Yawancin kayan aiki suna tsayawa a lokacin faɗakarwa. Xygeni ya ci gaba. Injin AutoFix ɗinsa yana ƙirƙirar faci masu tsaro, pull requests, ko kuma jagorar mataki-mataki dangane da matsalar. Ra'ayinta na Haɗarin Gyara shi ma yana nuna wace sigar faci ce mafi aminci, don haka ƙungiyoyi suna gyara matsaloli ba tare da ƙara sababbi ba.
Dandalin Haɗaɗɗiya Ɗaya
Domin Xygeni yana haɗuwa SAST, SCA, gano malware, sarrafa sirri, IaC dubawa, gano abubuwan da ba su dace ba, da kuma ingantattun hanyoyin ginawa a cikin dandamali ɗaya na AppSec,
yana ba da cikakken kariya a duk faɗin ƙasar SDLCDuk masu haɓaka da ƙungiyoyin tsaro suna samun tushe ɗaya na gaskiya tare da bayyananniyar gani, gyare-gyare masu amfani, da kuma kariya mai ƙarfi daga hare-haren sarkar samar da kayayyaki.
Dukkan abubuwa an duba, Xygeni, babban dandamalin AppSec mai cikakken-cikin-ɗaya, yana taimaka wa ƙungiyoyi su gina da sauri kuma su kasance cikin aminci. Ta hanyar kare tushe, gini, kunshin, da matakan dogaro, da kuma ƙara gyare-gyare ta atomatik a kowane mataki, yana tabbatar da cewa an dakatar da hare-haren sarkar samar da software kafin su kai ga samarwa.
