Mu gawo lapitalo, Ma phukusi owopsa a Open Source: Vuto, tinakambirana chifukwa chake anthu owopseza anali otero okonda kufalitsa zinthu zatsopano zoyipa kapena kuyika pulogalamu yaumbanda m'mitundu yatsopano ya zinthu zomwe zilipo: Maziko otseguka amalola aliyense kulikonse kupanga akaunti yanthawi yochepa mu kaundula wa zigawo (monga NPM, PyPI, Docker Hub kapena Visual Studio Marketplace) kapena nsanja yolumikizirana yopangira mapulogalamu (monga GitHub). Palibe mtengo, ndipo pali mwayi wambiri wopezera chidaliro chochulukirapo chomwe magulu a mapulogalamu nthawi zambiri amakhala nacho pa zigawo za chipani chachitatu.
Kusiyana pakati pa momwe zimakhalira zosavuta kwa owukira kufalitsa pulogalamu yaumbanda pogwiritsa ntchito zomangamanga zomwe zilipo kuti zigwiritsidwe ntchito poyera, komanso momwe zimakhalira zovuta kwa mabungwe omwe amapanga mapulogalamu (aliyense?) kupewa kutenga kachilombo ka pulogalamu yaumbanda (ndi kupereka pulogalamu yaumbanda mu mapulogalamu omwe amafalitsa kwa ena), kunapangitsa kuti chiwerengero cha mapaketi oipa chifike pafupifupi kotala miliyoni chaka chatha.
Vutoli ndi lalikulu kwambiri moti palibe bungwe limodzi lomwe lingathe kulithetsa, ndipo anthu ammudzi akusintha njira yopezera gwero lotseguka yokhudzana ndi kudalirika, mfundo zotetezeka ndi zokhazikika komanso zotetezeka, komanso moyo wa zigawo. Tidzayang'ana malingaliro otere mu gawo lotsatira. Kuteteza Maphukusi Oyipa Otseguka: Kodi (Osagwira Ntchito) Ndi Chiyani?.
Kumbukirani kuti tikulankhula za zigawo za mapulogalamu zomwe nthawi zambiri zimagwirizana nazo mapulogalamu phukusi: zigawo zomwe zingagwiritsidwenso ntchito zopakidwa kuti zitha kutchulidwa ngati zodalira mu pulogalamu ya pulogalamu, ndikuyikidwa ndi woyang'anira phukusi kapena chida chomangira. Dziwani kuti nkhaniyi ikhoza kukulitsidwa kuti iphatikizepo public zithunzi za chidebe (yogwiritsidwa ntchito ndi nthawi yogwiritsira ntchito ziwiya ndi nsanja zoyimbira monga Kubernetes), ndi zowonjezera ku zida zamapulogalamu (zomanga, zodzichitira zokha, ndi zotumizira).
Apa tikuwunika momwe izi njira yowukira yochokera ku zinthu zoyipa imagwira ntchito, malinga ndi zitsanzo zakale ndi zomwe tawona pa nsanja yathu ya Malware Early Warning (MEW). Tidzasanthula zigawo zoyipa m'njira zosiyanasiyana:
(1) njira yosankhidwa yogawira (kaundula wogwiritsidwa ntchito, mu gawo latsopano kapena lomwe lilipo, ndi njira yogwiritsidwa ntchito poyambitsa mtundu wa gawo lomwe lafalitsidwa), (2) momwe pulogalamu yaumbanda imayatsidwa kapena kuyatsidwa, (3) khalidwe loipa mwachitsanzo zochita zovulaza zomwe zimawonedwa komanso zomwe zimapangitsa wowukirayo, (4) njira zomwe zimagwiritsidwa ntchito pobisalira, kubisala kuti asadziwike, kuyenda mbali, kulumikizana ndi olamulira ndi olamulira (C2), ndi zina zotero; ndi (5) njira zopezera kutchuka kokwanira ndi chidaliro kuti ozunzidwawo athe kuyika gawolo.
Njira Yogawa Yasankhidwa
Timaona “phokoso lakumbuyo"za ma phukusi oipa osazolowereka omwe amagwiritsa ntchito typosquatting kuti apeze opanga mapulogalamu osadziwa omwe ali ndi typo mu dzina la phukusi chifukwa chodalira. Ma phukusi ambiri otchuka amalandira ma phukusi ambiri otchulidwa mofanana omwe ali ndi typos, ndi chiyembekezo chakuti apeza mapulogalamu ena osadziwa.
Amagwiritsa ntchito akaunti yosakhalitsa, amafalitsa gulu la ma phukusi a zilembo, amapanga lina, ndikufalitsa gulu lina… Pogwiritsa ntchito njira zina zodziwira okha komanso luso lawo amatha kupeza luso, koma nthawi zambiri amakhala osafunikira kwenikweni. Timawatcha mkati mwawo kuti “anchovies"Kuba ziphaso ndiye cholinga chachikulu, koma nthawi zina timapeza mapulogalamu aukazitape akutulutsa ma source code kapena deta yachinsinsi monga chidziwitso chodziwika bwino (PII), kujambula clipboard, ndi zina zokayikira.
Mwadzidzidzi timaona zinthu zoopsa kwambiri, "shaki". Ochepa amaloza magulu kapena mabungwe enaake, nthawi zambiri okhala ndi ma crypto drainers kapena ma web skimmers omwe amayatsidwa motsatira malamulo, mwina motsatira njira yomwe yawonedwa mu chochitika choyambira pa chochitika Kuchotsa kubisa kwa chiwembucho pokhapokha ngati phukusilo latchulidwa kuchokera ku phukusi lomwe mukufuna.
Njira yogawa idasanthulidwa mu pepala labwino kwambiri lomwe tsopano ndi lachikale, "Kusonkhanitsa Mpeni wa Backstabber: Kuwunikanso kwa Kuukira kwa Open Source Software Supply Chain", zomwe ndi zofunika kuziwerenga. Ndithudi munawonapo tchati chabwino ichi kale:
Njira zonse zinafufuzidwa, kuphatikizapo ma phukusi atsopano ndi omwe alipo kale; kukhudza code yoyambira, makina omangira, kapena gawo lopakidwa palokha; kugwiritsa ntchito ziphaso zobedwa kapena uinjiniya wa anthu; kuba maakaunti osiyidwa ndi malo osungiramo zinthu kapena kupha poizoni omwe adasungidwa. Ziwopsezo zina zidapatsidwa mayina (Kujambula typosquatting, Kusokonezeka kwa Kudalira, Kusokonezeka Kowonekera, Kubwezanso ndalama. ndi zina zotero) ndipo zidakambidwa kale kwina.
Nanga bwanji za malo olembetsera omwe asankhidwa?
NPM ikupitilizabe kutsogolera pa kuchuluka kwa ma phukusi onse oipa, koma tawona kuwonjezeka kwakukulu kuyambira chaka chino pa PyPI. Python ndi njira yotchuka yophunzirira za data ndi makina. Ndipotu, kuchuluka kwa mapulogalamu oyipa tsopano kuli kwakukulu mu PyPI kuposa mu NPM.
Momwe pulogalamu yaumbanda imayambitsidwira
Maphukusi oipa amayamba panthawi yokhazikitsa m'magawo anayi okha mwa khumi (m'zaka zaposachedwapa anali pafupifupi 6 mwa khumi). Ena onse amachita zinthu zoipa panthawi yokhazikitsa, ndipo 1 mwa 100 amayamba pamene akuyesa. Adaniwo akuwoneka kuti akudziwa kuti kugwiritsa ntchito mosalamulirika zolemba zokhazikitsa kunalepheretsedwa m'malo ambiri.
Kodi anthu oipa akupeza chiyani?
Tidzalemba magulu a makhalidwe oipa, ndipo otchuka kwambiri ndi oyamba. Dziwani kuti zotsatira zake zingakhale zosiyana kwambiri: a chofufutira ndi yowononga kwambiri, koma si yofala ndipo imawoneka m'malo ochepa okha, okhudzana ndi nkhondo ya pa intaneti kapena hacktivism yankhanza. Magulu otsatirawa ndi ofala kwambiri:
- Infostealer / Credentials Drainer. Kuchuluka kwa ziwopsezo zosazolowereka, zopitilira 90% za ziwopsezo zosazolowereka ndi zakuba wamba makamaka omwe amafunafuna ziphaso monga mawu achinsinsi, ma tokeni olowera, makiyi a API, ndi makiyi achinsinsi (a SSH ndi zina zotero). Mwina ndi yosavuta kulemba (pamodzi ndi ma wipers?). Amalemba mafayilo/ma directory odziwika bwino ndi magwero ena (monga makiyi a registry), amakonza zomwe zili mkati, ndikutumiza detayo ku seva ya C2. Lingaliro ndi losavuta: "Ndimafalitsa stealer ya ziphaso za phishing, kotero nditha kugwiritsa ntchito ziphasozo pambuyo pake poyambitsa kuukira kolunjika".
Ma network a C2 omwe amawonedwa nthawi zambiri amakhala otsika mtengo komanso odetsedwa, monga njira za Telegram kapena zida zolumikizira ngalande ngati ngrok (nthawi zambiri mu mawonekedwe a ma proxies obwerera m'mbuyo omwe amawululidwa kudzera mu ma IP a VPN egress). Pali mazana ambiri (!) a mwayi, ndi mapulojekiti ambiri a GitHub pansi pa mutu wobera mawu achinsinsi. Maluso apadera monga ma keylogger ndi osowa kwambiri pamaphukusi oyipa ndi zithunzi za ziwiya, koma amapezeka kwambiri m'ma extension a zida, komwe ogwiritsa ntchito amayembekezeredwa kuyanjana.
- Wotsitsa / Wotsitsa. Yachiwiri kutchuka, nthawi zambiri imabwera koyamba mu ziwopsezo zambiri. Zoposa chimodzi mwa zitatu mwa zinthu zoyipa zimakhala ndi ma dropper (ngati katundu woipa abwera mkati mwa phukusi) kapena otsitsa (malipiro amatsitsidwa kuchokera kumapeto omwe akulamulidwa ndi wowukira). Malipiro nthawi zambiri ndi mtundu wodziwika bwino wa pulogalamu yaumbanda ya binary, ndipo imayendetsedwa ndipo nthawi zina imapitilira, poyika zitseko zakumbuyo, mapulogalamu aukazitape, ma drainage a crypto, ndi zina zogwiritsidwa ntchito. Malipiro otsitsidwa kapena kutumizidwa amayamba kuukira kwa gawo lachiwiri ndi mphamvu zonse zoperekedwa ndi ma malware binaries omwe alipo. Ma binaries amatha kugawidwa mkati mwa phukusi, nthawi zambiri amawonetsedwa ngati zithunzi kapena mitundu ya mafayilo osavulaza, kuti apewe kuzindikirika pamene akulumikizana ndi masamba osayembekezereka.
- Oba Ndalama Za Dijitali / Ogwira Ntchito ZamigodiAdani omwe ali ndi chidwi ndi zachuma ali okonzeka kugwiritsa ntchito chuma chanu cha mtambo poyendetsa ma cryptominers (amazindikira ngakhale ngati akuyenda mu VM ya mtambo). Sasamala za chiŵerengero cha phindu lochepa ya $1 pa $53 iliyonse yomwe imalipidwa kwa wozunzidwayo chifukwa cha zinthu zomwe zabedwa mumtambo. Ozunzidwawo sangadziwe izi mpaka atalandira bilu yosayembekezereka. Mwamwayi, izi zimabwera ndikutha. Cryptojacking Ma kampeni m'maphukusi oipa nthawi zina amabuka kenako n’kuzimiririka, kuwononga ndalama kwa ogwiritsa ntchito ma wallet kapena potsirizira pake kulunjika kwa wopereka ma wallet, monga momwe zilili mu Kuukira kwa Ledger.
Makhalidwe ena, monga kutumiza backdoor Kugwiritsa ntchito ma code akutali potsegula chipolopolo chosinthira sikukuchitika kawirikawiri tsopano kuposa kale. Mwachitsanzo, 123rf_contributor_web phukusi (lomwe lachotsedwa mu registry) limatsegulidwa popanda kubisa chilichonse, chipolopolo chotsutsana chomwe chakopedwa ndikunamatidwa kuchokera ku Pepala Lonyenga la Reverse Shell:
Kuwonjezera pa zinthu zovomerezeka komanso zoyipa, taona zinthu zingapo zosayenera, kuphatikizapo:
Maphukusi a sipamu
Pali ma phukusi ang'onoang'ono ambirimbiri, makamaka mu NPM, opanda pulogalamu yaumbanda koma yolonjeza kupeza ndalama mosavuta, mafuta a njoka, maulalo opita ku Viagra, ndi zina zotero. Ogwiritsa ntchito ena amafalitsa spam yotereyi ndipo amatenga bandwidth yambiri kuchokera ku registry. Wosewera wina (osewera) mwina wochokera ku Indonesia anayesa kupeza phindu ndi kugwiritsa ntchito molakwika teaRank cholinga chake ndi kubwezera opanga mapulogalamu otseguka, mwa kupanga ma phukusi a NPM ogwirizana ndi malo osungiramo zinthu zodziwika bwino a GitHub. Uku ndi kuphwanya malamulo ogwiritsira ntchito.
Bodza lokhudza kafukufuku wa zachinyengo ndi chitetezo
Pamene phukusi limadzitcha lokha ngati likutulutsa deta pazifukwa zabwino, monga kuzindikira zolakwika zachitetezo cha mapulogalamu opatsa bug bounty kapena kufufuza mbali zina za chilengedwe. Tawona ma phukusi ambirimbiri m'gululi, omwe amatenga chidziwitso koma osati deta yovuta kwambiri ku adilesi ya Burp Collaborator kuchokera ku PortSwigger (monga host mu oastify.com domain). Nthawi zambiri tawona makope a Kusokonezeka kwa Kudalira umboni wa lingaliro lolembedwa ndi Alex Birsan, monga aurora-webmail-pro phukusi (lochotsedwa mu registry), lomwe limangoyendetsa khodi yoyipa iyi mu script yoyikiratu:
Ndipo adaphatikizaponso "Uwu ndi Umboni Wosavuta wa Kudalira Kusokoneza Maganizo"Kufotokozera kotsutsa mu phukusi.jsonUku ndi kuphwanya malamulo ogwiritsira ntchito, ngakhale popanda cholinga choipa.
Nkhani yabwino? Sitinaone (pakadali pano) ziwopsezo za ransomware zomwe zimaperekedwa kudzera muzinthu zoyipa. Pazifukwa zosadziwika, zigawenga za pa intaneti zikuwoneka kuti zimakonda njira zachikhalidwe zotumizira mauthenga achinyengo, njira zopezera ma dawunilodi pogwiritsa ntchito RDP, komanso njira zotumizira ma dawunilodi kudzera pa drive-by.
Njira Zina Zowonedwa
Njira zambiri zinagwiritsidwa ntchito polimbikira, kupewa chitetezo, kusonkhanitsa chidziwitso, kulankhulana ndi olamulira ndi oyang'anira, komanso kutulutsa zinthu m'njira yosayenera.
Kulimbikira Mu zinthu zoyipa zimapezeka pogwiritsa ntchito mawonekedwe okhazikika mu pulogalamu yaumbanda ya binary ya gawo lachiwiri, koma nthawi zina khalidweli limapezeka mu code ya phukusi, ndipo ntchito zokonzedweratu ndi kusintha mu registry ya Windows ndizofala kwambiri.
Kuthamangitsidwa ndi yofala, koma yosamveka bwino. Ma phukusi ambiri olembera (kumbukirani "anchovies"?") sagwiritsa ntchito mawu obisika konse; ambiri amagwiritsa ntchito mawu osafunikira (base64/hex encoding kapena ma ciphers osinthira monga rot13) kapena amagwiritsa ntchito ma code obisika ndi minification omwe alipo, omwe amasinthidwa mosavuta ndi zida zoyenera. "Shark" okha ndi omwe amachita ma real, hard-core, obfuscation, hard to reverse-engineer.
Kubisa zinthu kungabise kuukirako, koma n’chifukwa chiyani ma code mu gawo lotseguka ayenera kubisika? Kodi pali umboni wakuti chinachake chiyenera kubisika kuti chisawonekere? Tapeza zitsanzo zambiri za ma phukusi osavulaza omwe amagwiritsa ntchito kubisa zinthu kuti ateteze katundu wanzeru, zomwe zimatsutsana ndi "open source". Kubisa zinthu kungagwiritsidwe ntchito ngati umboni wa pulogalamu yaumbanda, koma sizotsimikizika. N’kovutanso kuchotsa kubisa zinthu.
kuzemba kuchokera ku zida zodzitetezera amagwiritsa ntchito njira zosavuta. Ma code oipa nthawi zambiri amatetezedwa mu yesani ... kugwira Ma block omwe amanyalanyaza zosiyana zilizonse, kotero kuti zochitika zachilendo siziwonetsedwa m'ma log. Kutsimikizira chilengedwe (chomwe chikuyenda mu VM kapena chidebe) n'kosowa, pokhapokha ngati pulogalamu yaumbanda ikuyang'ana bungwe kapena chilengedwe china.
Kubisa zithunzi za binary muzithunzi ndi mafayilo a PDF (mtundu wa steganography) inali njira ina yomwe inkaoneka kuti ingathandize kupewa kupezeka.
Popeza zinthu zoyipa zomwe zimafala kwambiri ndi zinthu zobera anthu, kusonkhanitsa deta ndikofunikira. Zinsinsi (mawu achinsinsi, ma tokeni olowera, makiyi a API, makiyi a cryptographic) zimasanthulidwa nthawi zonse m'mafayilo a log, zosintha zachilengedwe, komanso clipboard (yomwe imawoneka ndi ma banki trojans ndi obera ma crypto). Kutulutsa ma code a source nakonso n'kofala, chifukwa kuyika phukusi nthawi zambiri kumachitika mu node yopangira komwe malo osungiramo ma git amkati amatha kupangidwa. Tawona mapaketi akulemba ma directories pofunafuna malo osungiramo ma git. Kufunafuna malo monga .env, private.pem, settings.py, app.js, kapena application.properties ndikofala kwambiri.
Kuchotsa deta ndi njira ina yomwe imagwiritsidwa ntchito kwambiri. Ma phukusi ochepa okha oipa amayesa kubisa komwe deta yotengedwa ikupita. Njira za telegram ndi ngalande zofanana ndi za ngorok amagwiritsidwa ntchito nthawi zambiri. Ndipo pali zambiri nthawi zambiri ma domain omwe ali pamndandanda wovomerezeka amagwiritsidwa ntchito pochotsa zinthu.
Njira zina, monga kukwera kwa mwayi kapena kuyenda kwa mbali, sizinali zofala.
Kutchuka ndi Kudalirika
Tangoganizirani wakuba waukadaulo wokhala ndi chinthu choopsa chopangidwa kale chomwe chikudzifunsa kuti: “Ndingapange bwanji kuti chidutswa ichi cha s#$! chikhale chodalirika kwa zitsiru zosazindikira?”.
Zimenezo zikutanthauza momwe mungapangire cholowera cha gawo loipa kuti liwonetse nyenyezi / mafoloko ambiri (kuti lidziwike), kuphatikiza mitundu / mavuto ndi pull requests (pa ntchito). Lingaliro ndi kupeza kutchuka kongopeka (nyenyezi) ndi anthu odalira, komanso mawonekedwe okhutiritsa okhudza kufunika ndi kusamalira.
Kaundula sayang'ana ngati zomwe zili mu pulojekiti ya GitHub ndi zomwe zili mu phukusi zikugwirizana. Ili ndi vuto lodziwika bwino mu unyolo wopereka mapulogalamu. Ma registry a anthu onse ndi mabowo akuluakulu omwe amameza chilichonse chomwe amaponyedwa. Mutha kulumikiza malo aliwonse osungiramo zinthu.
Ngati typo-squats ya phukusi loipa ikugwira ntchito yotchuka, ndizosavuta: ingoyang'anani malo osungira a GitHub omwe alipo mu manifest omwe amagwiritsidwa ntchito popanga phukusi ndikulifalitsa mu registry. Pa maphukusi atsopano pa repo yabodza ya GitHub, mungafunike luso lapadera, mwina kupanga zabodza. kuyang'ana nyenyezi/kudula Maakaunti a GitHub kudzera pa scripting.
Ndipo ngati zomwe zili mu phukusi lanu zikufanana ndi zomwe zalembedwa kale, sinthani zosintha zingapo zomwe zakonzedwa bwino apa ndi apo… Mutha kuyika pulogalamu yanu yaumbanda mu phukusi latsopano lofanana ndi lodziwika bwino lomwe likuwonetsa malo omwe alipo kale, ndikudikirira zolakwika. Ngati wina angayerekeze kuyerekeza zomwe zili mu phukusi la tarball ndi zomwe zili kuchokera ku GitHub repository, kusiyana komwe kuli pa malo olowetsa pulogalamu yaumbanda kumatha kuphonya mosavuta. Tawona njira iyi kangapo kale.
Njira yoti gawo lipereke mawu osasinthika okhudza chiyambi chake, momwe phukusili linapangidwira, kuchokera ku magwero ati, ndi ndani, omwe angalandiridwe. Koma imeneyo ndi nkhani ina.
Kodi gawo la X ndi pulogalamu yaumbanda?
Kodi pali database (yathunthu) ya ma phukusi oipa? Ayi. Zofooka zotseguka zimakhala ndi CVE ID yoperekedwa, koma ma phukusi oipa ochepa okha (makamaka omwe amapanga mitu yankhani) ndi omwe amapatsidwa. CWE ya ma phukusi oipa ndi CWE-506 (khodi yoipa yoikidwa).
Zida zachizolowezi zogwiritsira ntchito pulogalamu yaumbanda (VirusTotal, MalwareBazaar, SOREL-20M…) sizipereka malangizo enieni okhudza zinthu zoyipa. Zimenezo zingakhale zabwino!
Pali zitsanzo za kafukufuku ndi ma datasets oti tiwunike (timagwiritsa ntchito zingapo mwa izo), koma zolemba zimasinthidwa pokhapokha ngati phukusi loipa ladziwika, zomwe nthawi zambiri zimakhala mochedwa. Ngati mukufuna, OpenSSF Maphukusi Oyipa ndi chiyambi chabwino.
Mu positi yotsatira, tidzakambirana momwe mungadziwire ngati phukusi linalake ndi loipa. Spoiler: inde, pali njira zowunikira zigawo zoyipa kumayambiriro kwa nthawi yowonekera, musanachotse registry chinthu chodziwika bwino choipa.
Kuwerenga kwina
Mu gawo lotsatira “Kuteteza Maphukusi Oyipa Otseguka: Kodi (Osagwira Ntchito) Ndi Chiyani?" Tikambirana zoyenera kuchita ndi zosayenera kuchita pa chitetezo cha open-source. Akatswiri ambiri odziwa za chitetezo ali ndi nzeru za momwe angathanirane ndi chiwopsezochi, koma malingaliro olakwika ambiri.
Tidzawunikanso chifukwa chake malingaliro awa ndi olakwika, ndi momwe malingaliro olakwika otere akuthandizire kutchuka kwa njira yowukira iyi, komanso ku chiopsezo chachikulu chomwe mabungwe akukumana nacho. Kenako tipitiliza ndi zomwe zikugwira ntchito, komanso zomwe ndi khama ndi zinthu zomwe zikuphatikizidwa.
Komanso, tilemba za kusintha kwa ma phukusi oipa malinga ndi cholinga chawo, njira yojambulira, ndi njira zowukira.
Dzimvetserani!
