Qhov no yog ntu thib peb hauv ib qho series ntawm cov khoom txog hom kev tawm tsam software uas muaj ntau tshaj plaws: cov uas siv tsis raug cai rau kev sau npe pej xeem ntawm Qhib qhov chaw cov khoom siv software. Tom qab kev tshuaj xyuas hauv ntu dhau los "Kev piav qhia ntawm Cov Pob Khoom Phem: Cov Qauv Yog Dab Tsi?"Yog li cov neeg ua phem txhaj cov cwj pwm phem rau hauv cov khoom tshiab lossis cov khoom uas twb muaj lawm, peb npaj txhij los hnav peb lub tsho tua hluav taws thiab tshuaj xyuas seb peb tuaj yeem thaiv cov software phem uas xa tuaj li no li cas, lossis lwm txoj hauv kev, daws qhov teeb meem loj hauv cyber vim peb tau siv txoj hauv kev tsis raug."
Feem ntau cov kws tshaj lij uas paub txog kev ruaj ntseg muaj lub tswv yim txog yuav ua li cas los daws qhov kev hem thawj no. Peb tau hnov cov thawj coj kev ruaj ntseg hais yam tsis muaj kev yig tias SCA cov cuab yeej twb qhia koj thaum twg ib pob version yog malware. Los yog tias lawv vam khom cov khoom siv software uas paub zoo, tau tshuaj xyuas zoo, qhov twg txhua yam malware yuav raug kuaj pom thiab tshem tawm sai sai. Lawv siv cov version me me/patch rau kev kho qhov tsis muaj zog, thiab qhov ntawd yog txoj hauv kev zoo, pom zoo kom txo qhov kev pheej hmoo ntawm kev vam khom qhib, ua raws li "kho thaum ntxov, kho ntau zaus”Lub hauv paus ntsiab lus.
Hauv zaj no, peb yuav los saib seb vim li cas cov tswv yim no thiaj tsis yog, thiab qhov kev nkag siab yuam kev no ua rau muaj kev nyiam ntawm txoj kev tawm tsam no li cas, thiab ua rau muaj kev pheej hmoo loj heev uas cov koom haum tab tom ntsib. Peb yuav xaus nrog qhov ua haujlwm, thiab qhov twg yog kev siv zog thiab cov peev txheej koom nrog.
Kev Ntseeg Tsis Zoo
Thaum peb taug kev nrog kev ruaj ntseg software, peb pom cov txheej txheem tawm tsam hloov zuj zus thiab ntau lub tswv yim los ntawm cov neeg uas paub txog kev ruaj ntseg. Cov koom haum feem ntau nkag siab yuam kev dab tsi ua haujlwm tawm tsam qhov kev hem thawj no, yog li ua ntej peb yuav tshuaj xyuas dab tsi tsis ua haujlwm, uas tau muab sau ua ke hauv qab no, tsis yog tag nrho, daim ntawv teev cov kev nkag siab yuam kev.
Kev nkag siab yuam kev #1: SCA cov cuab yeej twb tshaj tawm cov khoom phem lawm
Tseeb! Tab sis tom qab qhov tseeb... Thaum tej zaum nws lig dhau lawm yog tias lub ntsiab lus tau siv rau hauv kev tsim software, thiab cov neeg ua phem twb tau txais kev txhawb nqa hauv tus tsim tawm lossis CI/CD tus tswv tsev. Tej zaum cov lus zais tau raug tshem tawm, ntxiv cov malware rub tawm thiab ntsia, thiab tej zaum tus yeeb ncuab tau tsiv mus rau sab nraud thiab twb tau nkag mus rau lwm qhov lawm.
Kev Tshawb Fawb Txog Kev Tsim Kho Software (SCA) cov cuab yeej tau tsim los txheeb xyuas cov teeb meem uas paub tias muaj. Cov cuab yeej niaj hnub ua haujlwm zoo heev los ntawm kev txhim kho qhov sib piv ntawm lub teeb liab-suab nrov, txiav txim siab seb qhov tsis muaj zog puas tuaj yeem ncav cuag lossis siv tau. Tab sis lawv tsis muaj txiaj ntsig tawm tsam cov malware tshiab. Xav txog ib qho khoom phem ua qhov tsis muaj zog xoom hnub: Tsuas yog thaum nws tus cwj pwm phem raug kuaj pom, qhov khoom ntawd raug tshaj tawm rau lub chaw sau npe, uas tom qab kev tshuaj xyuas los ntawm pab pawg kev ruaj ntseg tau lees paub tias yog qhov tsis zoo thiab raug tshem tawm ntawm lub chaw sau npe. [1].
Thaum ntawd, lub ntiaj teb (xws li SCAs) paub tias kev txhim kho lossis siv cov khoom (lossis qee qhov version (s) ntawm cov khoom uas twb muaj lawm) tsis yog ib qho zoo. Tab sis qhov no yog thaum cov khoom tsis muaj los ntawm kev sau npePaub tias kuv muaj qhov tsis zoo hauv cov khoom sab nraud, lossis txawm tias cov khoom uas tau raug cais ua qhov phem los ntawm kev sau npe yog qhov zoo, tab sis hmoov tsis zoo SCA lossis cov cuab yeej tshuaj xyuas feem ntau tsis pab tau hauv qhov no. Ntshe cov SCA/audit cuab yeej tuaj yeem paub ua ntej tias ib qho khoom muaj kev phom sij ua ntej nws siv rau ntawm koj lub koom haum.
Nco ntsoov, txhua txoj kev daws teeb meem tawm tsam cov khoom qhib qhov chaw phem yuav tsum nrhiav pom lawv ntawm-tus-fly, ntawm thaum lub Cheebtsam tau tshaj tawm hauv kev sau npe thiab thaum lub Cheebtsam (version) thawj zaug siv ntawm koj lub koom haum. Thiab qhov ntawd suav nrog cov khoom sib hloov.
Kev Nkag Siab Yuam Kev #2: Kev tswj cov ntawv sau thaum lub sijhawm tsim khoom tiv thaiv kev coj cwj pwm phem los ntawm cov khoom qhib-qhov chaw
Ntau tus thawj tswj pob khoom muaj peev xwm khiav cov ntawv sau (suav nrog hauv cov khoom tarball [2]), rau cov laj thawj raug cai, xws li kev sau cov khoom tsim nyog ntawm ntau lub platform, tsim cov lej, lossis khiav kev sim, thiab peb txhua tus yuav tsum paub tias lawv tuaj yeem raug siv tsis raug los ntawm cov neeg ua phem yog tias cov ntawv sau phem suav nrog hauv tarball, lossis yog tias tus neeg tawm tsam tuaj yeem ua rau cov ntawv sau phem khiav es tsis yog qhov zoo.
Paub qhov no, peb tuaj yeem teeb tsa tus thawj tswj pob khoom kom tsis txhob quav ntsej cov ntawv sau. Piv txwv li, nrog NPM tus –tsis quav ntsej cov ntawv sau chij (los yog ib qho khoom teeb tsa hauv .npmrc cov ntaub ntawv) hla cov ntawv sau thaum lub sijhawm teeb tsa. Qhov no yuav tsim qee qhov teeb meem vim tias kev khiav cov ntawv sau yog qhov tshwm sim hauv ntau lub ecosystem: Qee cov thawj tswj hwm pob khoom tsis tso cai rau kev kaw cov ntawv sau ua haujlwm (lus qhia: prompt "Cov thawj tswj hwm pob twg tsis tso cai rau kev kaw qhov kev ua haujlwm ntawm cov ntawv teeb tsa?"hauv koj tus AI nyiam). Tab sis qhov no tsis tiv thaiv feem ntau (peb yuav tsum ua kom qhov kev teeb tsa hla mus rau qhov tsis ua haujlwm nyob txhua qhov chaw).
Thiab thaum tus cwj pwm phem tsis nyob hauv cov ntawv sau teeb tsa tab sis nyob hauv software kom ua tiav thaum lub sijhawm khiav, qhov kev xaiv no ib leeg tsis tiv thaiv peb.
Kev nkag siab yuam kev #3: Kev pinning version tiv thaiv cov khoom phem kom tsis txhob raug ntsia
Muaj kev pauv pauv ntawm kev kho thaum ntxov thiab feem ntau nrog qhib cov qauv (cia tus thawj tswj pob khoom nruab rau cov hloov tshiab tshiab thaum muaj rau kev kho kev ruaj ntseg) thiab kev txuas version (muaj txhua qhov kev vam khom ncaj qha thiab kev hloov pauv rau software ntawm qhov version kho). Cov ntsiab cai kev ruaj ntseg yog tawv ncauj thiab qee zaum tsis sib haum, zoo li tshwm sim nrog "patch thaum ntxov, patch feem ntau" thiab "Kev txhim kho tshiab yuav tsum tsis txhob raug saib yooj yim"Qee cov thawj tswj pob khoom ua qhov hloov tshiab tsis siv neeg nrog cov server ranges raws li txoj kev pom zoo. Zoo heev yog tias koj kuj xav tau txais cov hloov tshiab phem! Yog lawm, cov khoom yuav tsum tau hloov kho kom tau txais kev kho kev ruaj ntseg uas kaw qhov tsis muaj zog sai li sai tau, tab sis ... tsis txhob cia tus thawj tswj pob khoom ua qhov no tau.
Kev nkag siab yuam kev #4: Kev siv cov khoom uas ntseeg tau muaj kev nyab xeeb. Txhua yam khoom phem yuav raug nrhiav pom, qhia tawm thiab tshem tawm tam sim ntawd.
Vim li cas ib feem thiaj ntseeg tau? Tej zaum vim nws nrov heev, nrog ntau lub qhov muag nrhiav qhov tsis muaj zog, ntau tus neeg pab txhawb rau kev saib xyuas, nrog ntau tus neeg saib xyuas tseem ceeb uas saib xyuas txhua yam. pull requestsQhov tseeb tiag txawv heev. Qee yam tseem ceeb yog tswj los ntawm ib tus neeg tsim khoom uas tsis tau them nqi. Cov qauv siv dav dav tau ob peb tus neeg pab txhawb nqa tsis tu ncua, nrog rau tus lej ntawm cov neeg uas poob qis sai sai commits ib tus neeg saib xyuas (cov haujlwm nrov muaj tus Tsov tus tw ntev ntawm cov neeg pab txhawb nqa uas ua qee qhov tsav tsheb-los ntawm commit thiab tsis txhob rov qab los). Thiab cov haujlwm nrov nrog ib tus neeg saib xyuas muaj ntau heev.
Xav txog koj tus kheej hais tias "Auj, peb siv Spring Boot / Angular / React / PyTorch / cov duab Docker official, yog li qhov kev pheej hmoo koj tab tom tham txog yog qis heev." Tej zaum qhov ntawd yog qhov tseeb, peb cov neeg muag khoom kev ruaj ntseg ua rau neeg ntshai txhua lub sijhawm, thiab cuam tshuam nrog cov pab pawg tsim kho kom txo qhov kev pheej hmoo uas tsis sib cav yog qhov tsis muaj tseeb. Tej zaum koj yuav raug ntxias kom dhia mus rau kab lus lees txais kev pheej hmoo (hauv ntu tom ntej) thiab txhua yam ua tiav. Hmoov tsis zoo, cov khoom nrov tshaj plaws yog cov hom phiaj rau cov neeg ua phem, thiab piv txwv li, cov neeg nrov Tsev qiv ntawv PyTorch raug tawm tsam hauv yav dhau los.
"Nrhiav tau sai sai, qhia tawm, thiab tshem tawm". Yuav siv sijhawm ntau hnub rau ib qho khoom tshiab uas phem kom raug tshem tawm ntawm daim ntawv teev npe pej xeem. Cov chaw sau npe ceev faj txog kev tshem tawm ib qho khoom, rau qhov zoo. Peb qhov kev paub yog tias thaum peb tau tshaj tawm los ntawm peb sab, lub sijhawm nruab nrab rau daim ntawv teev npe kom tshem tawm qhov version cuam tshuam yog 39 teev, ntau dua ib hnub thiab ib nrab. Muaj cov khoom phem uas yog ib lub lim tiam tom qab peb thawj qhov kev tshaj tawm hauv daim ntawv teev npe ua ntej tshem tawm. Thiab qee zaum, cov khoom raug tshem tawm tsuas yog tom qab tus neeg raug tsim txom lossis lub tuam txhab teb rau qhov xwm txheej tshaj tawm qhov xwm txheej uas cuam tshuam nrog cov khoom.
Dab Tsi TSIS UA HAUJ LWM TIV THAIV COV Cheebtsam Phem
Txhua txoj kev uas tsis meej yuav ua tsis tau zoo. Qhov no yog qhov tseeb, koj tsis muab cov kev tiv thaiv zoo rau qhov kev pheej hmoo uas cuam tshuam nrog qhov kev hem thawj no.
tsoos SCA Cov cuab yeej qhia koj txog cov malware uas paub tab sis muaj lub sijhawm loj heev uas yuav raug tshuaj xyuas. Tshwj tsis yog tias lawv ua haujlwm nrhiav cov malware ua ntej nrog kev txwv tsis pub muaj cov khoom phem, lawv yuav tsis ua haujlwm tawm tsam qhov kev hem thawj no.
Kev kaw cov ntawv sau rau kev teeb tsa yuav pab tau tab sis yuav tsum tau ua kom tiav txhua qhov chaw uas yuav tsum tau teeb tsa ib feem. Ib yam li qhov kev pinning version, vim tias cov versions tsis tuaj yeem raug pinned los ntawm lub xeev pib nyab xeeb mus ib txhis.
Xav tias cov khoom siv nrov tau txais kev saib xyuas txaus kom lawv tsis tuaj yeem raug txhaj nrog tus cwj pwm tsis xav tau hauv kev tawm tsam ntawm cov khoom xa tuaj yam tsis muaj kev kuaj pom tam sim ntawd kom tiv thaiv kev puas tsuaj yog qhov ruam thiab muaj kev pheej hmoo. Koj tsis xav nyob ntawm ntug, puas yog?
Yog koj nres ntawm qhov no, ces kev lees txais kev pheej hmoo yog tib yam koj ua tau: Qhov no yog ib qho decisqhov uas yuav tsum tau sau tseg rau hauv koj tus qauv kev hem thawj / kev ntsuam xyuas kev pheej hmoo, suav nrog qhov laj thawj rau kev lees txais qhov kev pheej hmoo thiab nws cov teeb meem uas yuav tshwm sim. Ua kom paub txog los ntawm kev sib txuas lus rau cov thawj coj thiab lwm tus neeg koom nrog. Qee qhov sib cav sib ceg tej zaum yuav npaj tau thaum muaj ib feem phem raug ntsia lossis suav nrog hauv koj cov software, tab sis qhov no nyuaj vim tias cov neeg tawm tsam muaj ntau txoj kev ua raws. Cov ntsiab lus ntawm kev tawm tsam ntawm cov khoom xa tuaj raws li kev siv cov khoom phem yuav hloov pauv qhov kev tshaj tawm rau pej xeem ntawm qhov xwm txheej, uas tej zaum yuav tsum tau ua raws li koj lub koom haum txoj cai tswjfwm. Koj kuj tseem tuaj yeem hais txog kev tswj hwm kev them nyiaj or kev pheej hmoo hloov pauv piv txwv li nrog kev pov hwm.
Txawm li cas los xij, muaj cov kev tswj hwm uas daws qhov teeb meem thiab yuav tsum tau xav txog yog tias koj tsis txaus siab rau kev lees txais kev pheej hmoo. Thov nyeem ntxiv.
Dab Tsi Ua Haujlwm Tiv Thaiv Kev Tawm Tsam Siv Cov Cheebtsam Phem
Kev Tswj Xyuas Cov Qauv Khoom Siv
Kev pinning version nrog kev tswj hwm thiab kev qhia txog version bumps yog txoj hauv kev zoo tshaj plaws, los sib npaug qhov xav tau kev tshem tawm qhov tsis muaj zog yam tsis tau txais malware. Tab sis nco ntsoov qhov kev nkag siab yuam kev #3: Kev pinning version ib leeg tsis txaus los thaiv cov code phem los ntawm cov version tshiab, vim tias koj yuav tsum tau hloov kho cov version yav tom ntej hauv txhua qhov kev vam khom ncaj qha lossis tsis ncaj qha. Lub sijhawm ntawd koj xav tau pov thawj muaj zog txaus tias txhua qhov version hloov kho tsis muaj malware.
Ceeb toom ntxov
Ib txoj hauv kev los daws qhov teeb meem ntawm cov khoom phem yog lub kaw lus ceeb toom ntxov (hu ua ntawm no Kev Ceeb Toom Ua Ntej Txog Malware lossis MEW), qhov twg cov qauv tshiab luam tawm (rau cov khoom tshiab lossis cov khoom uas twb muaj lawm) raug tshuaj xyuas los ntawm lub tshuab nrhiav, uas thaum pom muaj pov thawj txaus yuav faib cov qauv tshiab ua qhov phem.
Kev ua haujlwm tsis siv neeg yog qhov tseem ceeb ntawm no, vim tias nws tsis yooj yim sua kom rov xyuas txhua yam khoom tshiab ntawm tus nqi tshaj tawm tam sim no. Yog li lub tshuab nrhiav pom yuav tsum tau muab ntau yam txheej txheem sib xyaw ua ke, tej zaum suav nrog kev tshuaj xyuas static, dynamic, thiab kev muaj peev xwm, lub koob npe nrov ntawm tus neeg siv, thiab cov pov thawj los ntawm kev tsis sib xws ntawm cov metadata ntawm cov khoom thiab cov ntsiab lus ntawm tarball, lossis ntawm tarball thiab qhov chaw khaws cia qhov twg cov khoom ntawd xav tias yog los ntawm.
Muaj yog ib tug thaj chaw tsaus ntuj ntawm lub sijhawm luam tawm thiab thaum lub cav tshuaj xyuas cov ntsiab lus ntawm cov khoom, tab sis nws yuav tsum tsis pub dhau ob peb feeb. Cov qauv no tuaj yeem hloov kho, piv txwv li los ntawm kev tos cov khoom tshiab kom raug tshuaj xyuas ua ntej tso cai rau lawv kom raug ntsia thiab siv hauv software tsim. pipelines, lossis tshuaj xyuas lawv thaum xav tau. Ib feem ntawm ib qho version yog immutable [3], yog li nws yuav tsum tau soj ntsuam ib zaug xwb.
Tsis muaj peev xwm ua haujlwm tag nrho, thiab yuav tsum muaj kev tshuaj xyuas kev ruaj ntseg rau cov khoom uas muaj peev xwm ua phem. Ceev faj cov neeg txhawb nqa kev kho mob digital: AI thiab Machine Learning tsis tau tsim txaus los ua qhov kawg thaum nws los txog rau kev lees paub seb ib feem twg muaj malware. Tseeb tiag, kev kawm tshuab ua lub luag haujlwm tseem ceeb hauv lub tshuab nrhiav pom hauv kev faib cov khoom nkag los ntawm cov pov thawj raw uas tau ntes tau, tab sis thaum cov khoom ntawd raug "cais tawm" lo lus kawg yog nyob rau ntawm kev tshuaj xyuas phau ntawv los ntawm pab pawg kev ruaj ntseg uas muaj kev paub dhau los hauv cov khoom phem. Qhov no lees paub txhua yam malware lossis rov faib nws ua kev nyab xeeb. Thiab lub sijhawm yog nyob rau hauv cov sijhawm teev.
Lub chaw sau npe tshaj tawm txog qhov version/component phem; lub chaw sau npe mam li ua nws qhov kev tshuaj xyuas kom paub meej thiab txuas ntxiv mus rau kev tshaj tawm rau pej xeem thiab tshem tawm ntawm lub chaw sau npe. Qee lub chaw sau npe khaws cov pob khoom ruaj ntseg. Lub sijhawm ntawm no yog hnub lossis lub lis piam txij li thaum tshaj tawm, uas yog 'nyob lub sijhawm'los yog'qhov rais qhib qhov muag' rau feem ntau cov khoom phem.
Puas muaj peev xwm paub yog tias ib qho khoom siv puas yog qhov phem?
Yog li ntawd, rau kev ceeb toom ua ntej, peb yuav tsum muab cov lus teb txaus siab rau lo lus nug no: Kuv yuav paub li cas tias lub tsev qiv ntawv lossis pob khoom tsis yog (tsis yog) phem? Yuav ua li cas sau cov pov thawj txaus ntawm kev coj cwj pwm phem? Ua tau, tab sis nyuaj, vim tias cov yeeb ncuab siv ntau lub tswv yim kom tsis txhob raug kuaj pom. Muaj ntau txoj hauv kev sib txawv, txhua tus muaj qhov zoo thiab qhov tsis zoo.
Kev soj ntsuam zoo li qub tuaj yeem tshuaj xyuas txhua txoj kev ua haujlwm xyuas seb puas muaj cov txheej txheem siv los ntawm cov neeg tawm tsam yam tsis tau khiav lub Cheebtsam, thiab ua cov haujlwm ua ntej xws li de-obfuscation lossis deciphering. Thaum cov neeg tawm tsam sim zais lawv qhov kev ua phem, kev sim obfuscation yog qhov pov thawj ntawm malware (tab sis nco ntsoov tias cov khoom raug cai obfuscate code rau kev khaws cia cov cuab yeej cuab tam ntawm kev txawj ntse, tsis sib haum xeeb "Qhib qhov chaw"). Tsuas yog ib feem tsawg ntawm cov kev tawm tsam uas muaj kev txawj ntse heev nrog kev ua kom pom tseeb muaj zog xav tau sandboxing, tab sis kev ua kom pom tseeb muaj zog zoo li no yog ib qho cim qhia txog kev ua phem. Thov nco ntsoov tias kev coj ua ib txwm muaj SAST cov cuab yeej tau tsim los rau qhov tsis muaj zog tsis xav tau, tsis yog rau lub siab phem zoo li backdoors.
Dynamic tsom xam khiav cov khoom thiab tshuaj xyuas cov lus teb los ntawm kev siv lub sijhawm khiav, feem ntau los ntawm kev muab ib puag ncig sandboxed. Kev coj cwj pwm phem uas tshwm sim hauv qee qhov xwm txheej yuav dhau mus tsis pom: thov nco ntsoov tias malware yuav siv cov txheej txheem zam xws li Kev zam virtualization / Sandbox kom tsuas yog qhib thaum tsis raug tshuaj xyuas, thiab tseem yog ib qho cim qhia txog kev ua phem rau txhua lub cav tshuaj xyuas static.
Kev tshuaj xyuas peev xwm xav txog yam uas lub Cheebtsam ua: qhov twg nws txuas mus rau, cov ntaub ntawv twg nws nkag mus, cov lus txib lossis cov kev pab cuam twg khiav, lub davhlau ya nyob twg lossis lub cuab yeej I / O ua, lossis cov kev hu xov tooj twg raug hu. Qhov kev ntaus cim ntawm tus cwj pwm no tuaj yeem sib piv (rau ib qho khoom uas twb muaj lawm) thoob plaws cov qauv, yog li thaum pom tus cwj pwm tsis tau xav txog, cov pov thawj ntawd tuaj yeem ua rau muaj kev ua xyem xyav txog kev ua phem uas tau txhaj rau hauv cov qauv tshiab. Txoj hauv kev no ua raws li cov kauj ruam triage uas cov kws tshuaj ntsuam kev ruaj ntseg ua raws thaum ntsib nrog cov malware muaj peev xwm: kev tshuaj xyuas siv cov hlua lossis cov cuab yeej zoo sib xws. Txoj hauv kev no nrhiav pom tus cwj pwm phem txawm tias muaj xwm txheej dab tsi los xij thiab ua haujlwm thaum tsis muaj cov lej qhov chaw muaj.
Kev tshuaj xyuas cov ntsiab lus sau cov ntaub ntawv hais txog seb cov khoom ntawd tau tshaj tawm li cas thiab los ntawm leej twg. Cov phiaj xwm ua phem feem ntau siv tus account tshiab uas tsis raug kev tshuaj xyuas nruj. Kev taug qab cov haujlwm yav dhau los yuav muab kev nkag siab rau tus neeg siv hauv qab, feem ntau yog rau qhov tsis zoo uas yuav qhia txog kev cuam tshuam. Lub koob npe nrov nyuaj heev rau khwv tau thiab yooj yim poob! Tus neeg siv uas tsis muaj kev ua ub no yav dhau los yog tus neeg nruab nrab, tab sis karma caum tus neeg phem. Hacktivists, lossis cov neeg siv ib txwm uas muaj lawv cov ntaub ntawv tshaj tawm raug nyiag yuav tsum tau taug qab zoo.
Lwm cov ntaub ntawv tseem ceeb yog qhov tsis sib xws ntawm qhov chaw khaws ntaub ntawv uas siv los tsim cov khoom tarball thiab cov ntsiab lus ntawm tarball nws tus kheej. Thiab kuj ua raws li cov kev coj ua zoo, xws li tsim cov cim npe lossis cov ntawv tso tawm hauv qhov chaw khaws ntaub ntawv uas phim cov qauv ntawm cov khoom luam tawm hauv cov npe pej xeem. Thaum qhov chaw khaws ntaub ntawv ntawm ib qho tshwj xeeb commit yog cim nrog kev tso tawm, thiab tom qab ntawd mam li nco dheev ib qho version tsis ua raws li nws, qhov ntawd ib leeg yog pov thawj muaj zog tias qhov khoom ntawd yuav raug qias neeg: tus neeg ua phem yuav tau ua rau tus account siv rau kev tshaj tawm cov khoom ntawd, tab sis tsis muaj kev tso cai sau hauv qhov chaw khaws cia code). Ntau qhov kev tawm tsam raug pom tsis tu ncua siv cov cai no: piv txwv li, Kev tawm tsam ntawm Ledger yuav yooj yim nrhiav tau raws li cov kab no. Yog li ntawd, kev tshuaj xyuas cov ntsiab lus txheeb xyuas cov teeb meem zoo li no hauv cov txheej txheem luam tawm.
Kev Tiv Thaiv Hluav Taws Xob
Ib txoj hauv kev sib txawv yog kom muaj daim ntawv teev npe dawb ntawm cov khoom rau txhua daim duab qhia kev vam khom siv hauv koj cov software, yog li hauv txhua qhov kev tsim kho pipeline khiav hauv koj lub koom haum tsuas yog cov qauv khoom uas tau pom zoo thiaj li tuaj yeem ntsia thiab siv tau. Lub "firewall” raug siv los ntawm kev siv lub npe sau npe sab hauv uas cov tarballs rau cov qauv khoom uas tau tso cai tau txais kev pabcuam (cached lossis proxied). Thov nco ntsoov tias txhua daim ntawv teev dawb yuav tsis ua haujlwm tshwj tsis yog tias koj muaj cov thev naus laus zis rau kev faib tawm txhua qhov version tshiab raws li kev nyab xeeb tsim nyog kom nws tuaj yeem ntxiv rau daim ntawv teev dawb.
Thov nco ntsoov tias kev ceeb toom thaum ntxov (kev tshawb pom sai li sai tau tom qab tshaj tawm cov version tshiab) yuav tsum tau ua ke nrog qee txoj hauv kev los siv cov ntaub ntawv ntawd kom tiv thaiv cov khoom cuam tshuam rau kev tsim kho. pipelines lossis cov tshuab tsim tawm [4]Peb hu qhov no ua "kev tiv thaiv hluav taws xob”: ib txoj kev cais tawm rau kev tiv thaiv cov khoom tsim los ntawm cov pob khoom phem. Cov pob khoom sab hauv thiab cov ntaub ntawv sau npe duab zoo rau kev tiv thaiv cov koom haum los ntawm kev phem sab nraud, tab sis cov pov thawj muaj zog txaus yog qhov tsim nyog los ua kom kev cais tawm zoo.
Kev Siv Sandboxing Thaum Khiav
Lwm txoj hauv kev los nrhiav thaum lub sijhawm tshaj tawm yog los tshuaj xyuas tus cwj pwm thaum lub sijhawm khiav. Lub tswv yim yog los ntes tus cwj pwm xav tau los ntawm software thiab nrhiav (lossis thaiv) txhua qhov tsis zoo uas pom. Cov kab kev ua no muaj teeb meem ntawm kev yuav tsum tau siv lub sijhawm khiav rau kev saib xyuas lossis thaiv, thiab nws yog lub tswv yim zoo uas yuav raug ntxiv rau hauv cov khoom siv tiv thaiv tiv thaiv cov kab tsuag phem.
Teem Ib Lub Tswv Yim Kom Muaj Txhua Yam
Lub tswv yim pom zoo yuav tsum tau muab ntau txoj kev sib txawv los sib xyaw ua ke hauv cov txheej txheem tsim software, tswj hwm cov kev hloov kho tshiab kom thaiv cov khoom phem uas tuaj txog. Peb yuav tsum tau ua raws li qhov pinning version kom tsis txhob muaj kev kis kab mob nrog kev hloov kho version kom tau txais kev kho rau qhov tsis muaj zog uas tseem ceeb; kev ntsuam xyuas sai thiab ua tau zoo ntawm kev vam khom ncaj qha thiab tsis ncaj qha thaum lub sijhawm hloov kho version kom muaj pov thawj txaus tias lawv tsis muaj malware. Cov software uas vam khom cov khoom phem uas paub yuav tsum raug thaiv. Thiab txhua yam yuav tsum tau ua kom raug.
Siv qhov pinning version, thaum twg ua tau, vim nws ua rau cov qauv tsim tau dua. Kev txuas cov version nrog kev tswj hwm, kev pom zoo ntawm tes rau cov version bumps, Thiab kev pab los ntawm kev siv tshuab pabcuam, yuav tsum ntsuam xyuas seb qhov hloov tshiab puas coj malware lossis ua rau software puas tsuaj, thiab sib haum xeeb qhov hloov tshiab rau kev kho qhov tsis muaj zog nrog kev zam kev kis kab mob malware. Cov cuab yeej tuaj yeem pab tau ntawm no, los ntawm (1) txiav txim siab qhov tsis muaj zog twg tseem ceeb (nkag tau thiab siv tau, nrog rau kev pheej hmoo siab ntawm kev raug tsom los ntawm cov neeg tawm tsam), (2) xaiv cov qauv phiaj xwm uas sib xws nrog cov khoom siv tam sim no thiab tsis ua rau software puas tsuaj, (3) xaiv cov qauv phiaj xwm uas tsis muaj tus cwj pwm phem, thiab (4) ua qhov hloov tshiab version rau kev vam khom ncaj qha thiab tsis ncaj qha, los ntawm kev qhia cov kev hloov pauv hauv cov ntaub ntawv qhia uas tuaj yeem pom zoo sai sai. Kauj ruam (3) xav tau cov ntaub ntawv tshwj xeeb txog cov khoom phem ze rau lawv lub sijhawm tshaj tawm li sai tau.
Cov txheej txheem ntawm kev hloov kho cov kev vam khom no yuav tsum yog tswj thiab xyuas tau tseeb nyob rau txhua qhov chaw. Cov txheej txheem yuav tsum tau sau tseg, thiab txhua tus neeg koom nrog yuav tsum tau kawm, vim tias feem ntau kev tsim kho thiab kev tsim kho / xa tawm software yog xa mus rau sab nraud. CI/CD pipelines yuav tsum tau hloov kho raws li, yog li ntawd automation tsis tso cai rau qhov kev vam khom tsis ncaj qha kom plam rau hauv kev tsim kho: guardrails thaiv qhov kev tsim kho yog tias muaj pov thawj txaus ntawm cov malware uas muaj peev xwm ua tau nyob rau hauv kev vam khom yog txoj hauv kev pom zoo kom mus.
Yog tias koj lub koom haum muaj ib qho chaw sau npe sab hauv ua tus sawv cev kev ruaj ntseg rau kev tuav cov qauv khoom uas tau tso cai, koj yuav tsum tau txais cov ntaub ntawv txog cov khoom phem (dhau li lwm cov qauv) rau kev tshuaj xyuas cov khoom thov ua ntej ntxiv rau daim ntawv teev npe tso cai.
Kev siv cov software qhib rau pej xeem nrog kev nyab xeeb tsis yooj yim, thiab qhov teeb meem ntawm malware yuav tsum tau coj los xav txog tag nrho, nrog rau kev siv zog zoo sib xws rau kev tswj qhov tsis muaj zog.
Daim ntawv kawg: Qhov chaw pib, nyob rau hauv daim ntawv ntawm software attestations, tsim thaum lub sijhawm tsim ntawm lub Cheebtsam, yog lwm qhov tseem ceeb hauv kev siv zog los taug qab cov khoom cuav (component tarball) nrog cov peev txheej thiab cov txheej txheem tsim uas tsim nws. Nco ntsoov tias qhov txuas no ntawm qhov chaw snapshot + tsim ib puag ncig thiab cov khoom cuav software cuam tshuam (kos npe los ntawm lub kaw lus tsim ntseeg siab) tsis tiv thaiv per-se tias cov khoom tsis muaj tus cwj pwm phem, tab sis ua rau nws nyuaj rau cov neeg phem txhaj tshuaj malware. Thiab ua kom qhov tseeb ntawm qhov chaw yog qhov yuav tsum tau ua rau kev siv cov khoom qhib qhov chaw yuav siv sijhawm ntev, thiab tsuas yog nyuam qhuav ntxiv rau NPMKev ua kom cov kab ke tsim thiab xa tawm uas ntseeg siab tau tsis muaj kev cuam tshuam, lossis ua kom pom kev cuam tshuam hauv kev tsim kho yog ib zaj dab neeg sib txawv, uas tsis nyob hauv qhov kev tshaj tawm no.
ntxiv mus nyeem
Zaj tom ntej Cov Pob Khoom Phem Qhib: Txoj Kev Xygeni yuav nthuav qhia lub tswv yim uas peb ua raws li ntawm Xygeni rau peb Kev Ceeb Toom Ua Ntej Txog Malware (MEW) lub kaw lus. Cov pob khoom tshiab hauv cov pob khoom pej xeem thiab cov duab sau npe raug luam theej thiab cov pov thawj tau txais los ntawm kev siv kev sib xyaw ua ke ntawm static, dynamic, peev xwm, thiab kev tshuaj xyuas cov ntsiab lus. Cov pov thawj, ua ke nrog lub koob npe nrov ntawm tus neeg siv thiab keeb kwm ntawm kev hloov pauv hauv cov chaw khaws cia code, tso cai rau kev faib tawm tag nrho ntawm ib feem mus rau hauv cov pawg muaj kev pheej hmoo siab thiab tej zaum yuav phem. Lub kaw lus kawm los ntawm cov pov thawj yav dhau los sau los ntawm cov pob khoom kom txo qhov cuav zoo kom tsawg kawg nkaus.
Cov koom haum uas tau sau npe yuav tau txais kev ceeb toom rau cov khoom uas lawv siv, ncaj qha lossis tsis ncaj qha, thaum muaj ib qho version phem raug cais tawm. Tom qab ntawd peb cov kws tshuaj ntsuam xyuas yuav ua qhov kev tshuaj xyuas tes, uas lees paub lossis tsis lees txais qhov kev faib tawm. Rau cov malware uas tau lees paub, cov npe pej xeem yuav raug ceeb toom kom nws tuaj yeem ua nws qhov kev tshuaj xyuas thiab feem ntau tshem tawm cov version phem lossis ua lwm yam haujlwm, xws li thaiv lossis tshem tawm tus account neeg siv uas muaj lus nug.
Peb yuav piav qhia txog peb pab NPM, PyPI, GitHub, thiab lwm yam tseem ceeb hauv lub ecosystem qhib kom txo lub sijhawm nyob uas ib qho khoom phem tshiab luam tawm tseem ua haujlwm kom txog thaum nws tau lees paub tias yog malware thiab tshem tawm ntawm lub npe sau npe. Thiab yuav ua li cas cov koom haum yuav tau txais txiaj ntsig los ntawm MEW system kom muaj kev tiv thaiv zoo dua tiv thaiv kev tawm tsam software xa khoom uas cuam tshuam nrog cov khoom qhib.
- [1] Txawm li cas los xij, cov neeg siv ntawm cov khoom yuav tsum tau xyuas seb cov khoom tarball puas tau cached lossis sau npe rau qhov twg, piv txwv li hauv kev sau npe sab hauv, yog li ntawd tus kab mob raug tshem tawm.
- [2] Cov khoom ntim khoom muaj xws li daim ntawv qhia uas tshaj tawm nws cov ntsiab lus thiab metadata, qhov chaw lossis cov lej sib sau ua ke, cov ntawv sau teeb tsa, thiab cov khoom ntxiv xws li cov chav kuaj, raws li hom ntawv ntim khoom thiab feem ntau yog hauv daim ntawv compressed. Qhov no hu ua "component tarball".
- [3] Txawm tias tus neeg ua phem tuaj yeem hloov kho qhov khoom uas tau tshaj tawm vim muaj kev ua txhaum cai hauv kev sau npe nws tus kheej, cov ntaub ntawv cryptographic qub tuaj yeem pom txhua qhov kev hloov pauv hauv tarball tom qab kev tshuaj xyuas tiav.
- [4] Nco ntsoov tias qee cov khoom phem khiav thaum lub sijhawm teeb tsa, yog li nws tuaj yeem cuam tshuam rau cov neeg tsim khoom uas tsis paub khiav "npm install X" nrog X ib qho khoom phem.
