Chiyambi: Kukwera kwa Masewera a GitHub ndi Zoopsa Zomwe Zimabweretsa Zosangalatsa
Ngati munayamba mwafufuzapo Masewera a GitHub, mwina mwakumanapo ndi chilichonse kuyambira ma shooter opangidwa ndi msakatuli mpaka ma retro clones opangidwa ndi JavaScript kapena Python. Mapulojekiti awa ndi osangalatsa kuyesa, osavuta kuyendetsa, ndipo nthawi zambiri amaonekera mu maphunziro a YouTube kapena ma forum. Zotsatira zake, akhala otchuka kwambiri m'masukulu, komwe opanga mapulogalamu ndi ophunzira nthawi zambiri amawapeza kudzera mu Masewera otsegulidwa a GitHub kapena kuwapanga kuchokera ku Masewera a GitHub io masamba.
Chifukwa cha kutchuka kumeneku, opanga mapulogalamu ndi ophunzira amajambula ma repo awa, amayendetsa code, ndikupita patsogolo osaganizira kwambiri. Koma nayi vuto: si masewera onsewa omwe ali momwe amaonekera.
Ma repo ena amasewera amakhala ndi zolemba zosakhazikika. Ena amaika zinthu zakale kapena zosatetezeka. Ena amabisa pulogalamu yaumbanda mkati mwa zinthu, makontena, kapena mafayilo oyendetsera. Popeza opanga mapulogalamu ambiri amasunga mapulojekitiwa kudzera mu Masewera a GitHub io, chiopsezocho chimafalikira mofulumira ndipo nthawi zambiri sichidziwika.
Mu positi iyi, tifufuza momwe malo osungiramo masewera angakhalire chiwopsezo chachikulu cha chitetezo. Tikuwonetsaninso momwe mungakhalire otetezeka popanda kutaya chidwi chanu kapena chidwi chanu. CI/CD.
Chifukwa Chake Owukira Akuyang'ana Masewera a GitHub ndi Malo Osungiramo Zinthu Osatsekedwa
Poyamba, ma repos amasewera pa GitHub amawoneka ngati opanda vuto. Kupatula apo, nthawi zambiri amakhala mayeso ang'onoang'ono kapena mapulojekiti ophunzitsira omangidwa kuti azisangalatsa. Komabe, owukira amawona izi mosiyana. Zoona zake n'zakuti, ambiri oterewa ma repos amagwiritsidwa ntchito ngati nsanja zotumizira ma malware, nthawi zambiri zimabisika ngati Masewera a GitHub or masewera otsegulidwa a github.
Mwachitsanzo, munthu woopsa wotchedwa Stargazer Goblin imagwiritsa ntchito netiweki yoposa Maakaunti 3,000 a GitHub a mizimu, yotchedwa "Stargazers Ghost Network." Gululi limagwiritsa ntchito mwadala ma repo oipa kuti liwoneke bwino komanso kuti likhale lovomerezeka, nthawi zambiri limayang'ana ogwiritsa ntchito omwe akufunafuna zida kapena masewera achinyengo. Malo osungiramo zinthu awa agwiritsidwa ntchito kugawa ma info-stealers ndi ransomware monga Atlantida Stealer, Rhadamanthys, Lumma Stealer, ndi RedLine.
Komanso, kampeni ina yapamwamba yotchedwa Temberero la Madzi wagwiritsa ntchito zida zankhondo Maakaunti 76 a GitHub, kuyika pulogalamu yaumbanda ya magawo ambiri mu zomwe zikuwoneka ngati zida zovomerezeka. Malipiro amabisidwa mu mafayilo a pulojekiti ya Visual Studio (PreBuildEvent), kugwiritsa ntchito zolemba zosamveka bwino ndi ma binaries ochokera ku Electron kuti abere ziphaso, kuchotsa deta ya msakatuli, komanso kupitilira kwa nthawi yayitali. Zolinga zikuphatikizapo opanga mapulogalamu, magulu a DevOps, ndi opanga masewera.
Owukira amagwiritsa ntchito mwayi wakuti opanga mapulogalamu ambiri amajambula masewera a github kuti ayesere kapena kuphunzira kuchokera kwa iwo popanda kuwonanso code. Mofananamo, masewera a github io, ma repos omwe amaperekedwa kudzera pa GitHub Pages, amatha kusunga zolemba zoyipa za JavaScript, zithunzi, kapena redirection zomwe zimayikidwa mu msakatuli. Popeza masewera ambiri a github io amaikidwa pa foloko ndikugwiritsidwanso ntchito popanda kuyang'anitsitsa mozama, owukira amawagwiritsa ntchito kuti abise ma code obisika, ma tracker obisika, kapena kutsitsa zoyambitsa. Njira izi zimapezerapo mwayi pa chidaliro chomwe opanga mapulogalamuwa amapereka m'mapulojekiti otseguka.
Mwachidule, kutchuka kwa ma repos amasewera ndi mapulojekiti osatsekedwa kumapangitsa kuti zikhale malo abwino kwa owukira. Popanda kufufuza bwino, wopanga mapulogalamu wodziwa zambiri amatha kuyambitsa pulogalamu yaumbanda m'malo mwake mwa kungopanga kapena kuchititsa repo yamasewera.
Mukufuna Kuteteza Mapulojekiti Anu Onse a GitHub?
Ngati mukudabwa momwe mungatetezere ma repo anu a GitHub kupitirira ma mods amasewera, musaphonye positi yathu yozama yokhudza zilolezo, pull requests, CI/CD kuphatikizana, ndi zina zambiri.
Mawonekedwe a Malware mu Masewera Osatsekedwa a GitHub ndi Masewera a GitHub IO
Pamene opanga mapulogalamu amafufuza mapulojekiti olembedwa kuti github unblocked games, zambiri zimaoneka ngati zopanda vuto. Komabe, njira zingapo zobwerezabwereza zimavumbula zoopsa zazikulu zomwe zingagwiritsidwe ntchito mosavuta.
Kampeni: Temberero la Madzi
Trend Micro yavumbulutsa kampeni yotchedwa Temberero la Madzi, momwe osachepera Maakaunti 76 a GitHub malo osungiramo zida okhala ndi zida zomwe zimaoneka ngati zida zopangira mapulogalamu kapena ma mod amasewera. Ma repo awa amaika zinthu zoyipa pogwiritsa ntchito <PreBuildEvent> Ma tag mu mafayilo a pulojekiti ya Visual Studio. Pa nthawi yomanga, PowerShell kapena ma script a VBS obisika amatsitsa zolemba za ZIP zobisika, kukhazikitsa ma binaries ochokera ku Electron, ndikutulutsa ziphaso, deta ya msakatuli, ndi ma tokeni a gawo. Pulogalamu yaumbanda imagwiritsanso ntchito kupitilira kudzera mu ntchito zomwe zakonzedwa komanso kusintha kwa registry.
Khodi yabodza mu Masewera a GitHub: mbedza
<PropertyGroup> <PreBuildEvent> powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "download ZIP from GitHub → extract payload → run installer" </PreBuildEvent> </PropertyGroup> Khodi yachinyengo: Kugwira Ntchito kwa PowerShell Yobisika
# decode base64 payload payload = decode_base64('...') # run in memory execute_in_memory(payload) Chitsanzo chosavuta ichi chikuwonetsa momwe ma code oyipa amapewera kulemba ma disk mwa kusanthula ndikugwiritsa ntchito mwachindunji mu kukumbukira.
Kampeni: Temberero la Madzi
Trend Micro yapeza ntchito yoopsa yotchedwa Temberero la Madzi, kumene owukira adagwiritsa ntchito osachepera Maakaunti 76 a GitHub kuti azisunga malo osungiramo zida. Mapulojekitiwa ankaoneka ngati zida zopangira mapulogalamu kapena ma mod amasewera. Mkati mwake, adayika malingaliro oyipa m'mafayilo omanga, makamaka kudzera mu <PreBuildEvent> chizindikiro mu Visual Studio .csproj Mafayilo.
Zolipirazo zinali ndi zolemba zambiri zomwe zidatsitsa ma ZIP obisika, kutulutsa mafayilo, ndikugwiritsa ntchito zitseko zakumbuyo. Kuphatikiza apo, owukira adawonjezera njira zolimbikitsira pogwiritsa ntchito kusintha kwa registry ya Windows ndi ntchito zomwe zidakonzedwa.
Chitsanzo cha Pseudocode: Visual Studio Build Hook
<PropertyGroup> <PreBuildEvent> powershell -Command "download ZIP from GitHub, extract payload, and run installer" </PreBuildEvent> </PropertyGroup>Khodi Yabodza: Kugwiritsa Ntchito Mu Memory kudzera pa PowerShell
# Decode and run base64 payload in memory payload = decode_base64('...') execute_in_memory(payload) Njira imeneyi imapewa kulemba ku disk, zomwe zimathandiza owukira kuti asazindikire ma antivirus ndikupeza njira yobisika.
Kampeni: Stargazer Goblin ndi Maakaunti a Ghost
Kuukira kwina kwakukulu kunalembedwa ndi Check Point Research, yomwe idavumbulutsa kuti Stargazers Ghost NetworkKampeni iyi idagwiritsidwa ntchito kale Maakaunti 3,000 abodza a GitHub kudzaza nyenyezi, mafoloko, ndi owonera m'malo osungira zinthu zoipa. Cholinga chake chinali kupanga lingaliro labodza loti ndi lovomerezeka.
Maakaunti a mizimu awa adathandiza kufalitsa pulogalamu yaumbanda monga Atlantic Stealer, Lumma, Rhadamanthysndipo RedLine, makamaka ikuyang'ana opanga mapulogalamu ndi osewera. M'masiku anayi okha, chiwopsezo chimodzi chinakhudza anthu oposa Otsutsa a 1,300 pofalitsa ma mod pack a masewera osinthidwa kudzera mu maulalo a Discord ndi README.
Chitsanzo cha Pseudocode: Malicious README
# Ultimate Game Mod Pack 🕹️ Download and run the installer here: [Download Now](https://github[dot]com/ghost/repo/releases/latest/modpack.zip) Mawonekedwe Ofala a Malware mu GitHub Games Repositories
| chitsanzo | Kufotokozera |
|---|---|
| Kukhazikitsa pasadakhale / Kumanga Malemba | Zolemba zomwe zimagwira ntchito zokha panthawi yokhazikitsa kapena kumanga kuti zitenge ndikugwiritsa ntchito zolipira zakutali, nthawi zambiri popanda kudziwa kwa ogwiritsa ntchito. |
| Kulemba ndi Mafoloko Onyenga | Mapulojekiti oipa omwe amatsanzira mayina kapena kapangidwe ka zida zodziwika bwino kapena ma repos amasewera kuti anyenge opanga mapulogalamu kuti awayike. |
| Kugwiritsira Ntchito Molakwika Masamba a GitHub | JavaScript, zithunzi, kapena ma redirects obisika m'masamba a `github io games` omwe amachititsa kuti zolemba zoyipa zichitike pa tsamba lotsegula. |
| Zizindikiro Zotchuka Zabodza | Maakaunti a mizimu amadzaza nyenyezi, mafoloko, ndi owonera mwachinyengo kuti malo osungiramo zinthu zoipa azioneka odalirika. |
Njira zimenezi sizongopeka. Zawonedwa kale mu vidiyo kampeni ya pulogalamu yaumbanda, ambiri mwa iwo adayang'ana opanga mapulogalamu omwe amagwiritsa ntchito ma repos amasewera ngati malo olowera.
Mwamwayi, nsanja zina zachitetezo zimatha kugwira machitidwe awa asanawononge. Mu gawo lotsatira, tikuwonetsa momwe Xygeni imazindikira, kuletsa, ndikukonzanso ziwopsezo izi pa intaneti yanu yonse. SDLC.
Momwe Xygeni Imatetezera Masewera a GitHub, Mapulojekiti Osatsekedwa, ndi CI/CD Pipelines
Pamene njira zoopsa mu ma repos amasewera a GitHub zikuwonekera, Xygeni imapereka chitetezo chokwanira kuti aletse ziwopsezo zisanawononge makina anu kapena unyolo wogulira.
1. Chenjezo Loyambirira: Kuzindikira Malware Pa Nthawi Yeniyeni mu Masewera a GitHub ndi Zodalira
Xygeni imasanthula maphukusi atsopano nthawi zonse kudzera mu NPM, Maven, PyPI, ndi zina zambiri. Izi zikuphatikizapo maphukusi omwe ali m'malo osayembekezereka, monga ma repos amasewera kapena mapulojekiti a masewera osatsekedwa a github omwe amagawidwa m'ma forum kapena ma netiweki asukulu. Ngati gawo lokayikitsa lapezeka, Xygeni imachiyika yokha, imaletsa kugwiritsidwa ntchito kwake m'madongosolo anu, ndikutumiza machenjezo nthawi yeniyeni ku gulu lanu. Izi zimaletsa kuti zolipira zoyipa zisalowe m'ma codebase anu kapena CI/CD pipeline.
2. Kudziwa Kupezeka SCA ndi Kuyika Patsogolo Mwanzeru
M'malo mopatsa gulu lanu machenjezo ambiri, Xygeni imawunika ngati vuto likugwiritsidwadi ntchito mu code yanu (kupezeka) ndipo ikuphatikizapo zigoli zoopsa (EPSS, zotsatira za bizinesi) kuti athetse mavuto ofunika kwambiri. Izi zimachepetsa phokoso kwambiri ndipo zimaonetsetsa kuti gulu lanu likuchitapo kanthu pa zomwe zili zofunikadi.
3. Kukonzanso Kokha Pogwiritsa Ntchito Pull Requests
Pamene vuto kapena kudalira koipa kwapezeka ndi njira yodziwikiratu, Xygeni imapanga yokha Pull Request kuti musinthe kapena kukonza vutoli. Izi zimathandizira nthawi yoyankha, zimachepetsa ntchito yamanja, komanso zimasunga pipeline otetezeka.
4. CI/CD Zowongolera Zachitetezo Zoletsa Nyumba Zoyipa
Xygeni imagwirizana ndi build pipelinekudzera pa GitHub Actions, Jenkins, GitLab, Azure Pipelines, ndi zina. Imasanthula zolemba zomangira, mafayilo a Docker, ndi CI/CD configs pa malamulo okayikitsa, monga ma shells obwerera m'mbuyo kapena ma script okhazikitsa, ndipo amatha kuletsa ma builds ngati ma code owopsa apezeka.
5. Pangani Umphumphu kudzera mu Umboni Wotsatira SLSA
The Build Security gawoli limapanga maumboni osainidwa motsatira SLSA ndi in-toto standards, kuyika metadata pa gwero, kudalira, SBOM, ndi mayeso. Ngati kusintha kulikonse kosaloledwa kukuchitika, kutsimikizira umboni sikukwaniritsidwa ndipo pipeline imayima yokha.
6. Kuzindikira Zolakwika mu SCM ndi CI Artifacts
Xygeni imayang'anira nthawi zonse ma source code anu ndi malo a CI kuti izindikire machitidwe osazolowereka, monga commitKudutsa chitetezo cha nthambi, ogwiritsa ntchito osadziwika, kapena zopereka zosayembekezereka za token. Kuphatikiza ndi zake SAST injini, imazindikira zitseko zakumbuyo zobisika kapena zolemba zolowetsedwa musanaphatikize kapena kuyika.
7. Kupeza Katundu Kokha ndi ASPM Kuwoneka
Xygeni imamanga katundu wamoyo wanu wonse SDLC malo osungiramo zinthu, kuphatikizapo malo osungiramo zinthu, ogwira nawo ntchito, pipelines, kudalira, ndi infra ya mtambo. Kuwoneka kumeneku kumathandiza kuyika patsogolo zoopsa, mapu otsatira malamulo (monga NIS2, DORA), ndi umboni wokonzeka kuwunikira popanda kusokoneza njira zomwe zilipo kale.
Kodi Masewera a GitHub Amatanthauza Chiyani kwa Opanga Otetezeka: Khalani Ofunitsitsa, Khalani Otetezeka
- Ngati repo ili ndi script yobisika yomwe imatsitsa khodi yoyipa (monga script ya PowerShell yoyikidwa pambuyo), Xygeni idzayiyika chizindikiro ndikuyiletsa isanayikidwe.
- Mukaphatikiza ma code omwe amasonyeza kudalira kokayikitsa, Xygeni imatseka ndipo imapereka njira yokonza yokha kudzera mu Pull Request.
- Ngati pulojekiti ya GitHub Pages, yomwe ili ndi ma script obisika, Xygeni's SCA ndipo kuzindikira pulogalamu yaumbanda kuwazindikira ngakhale atangoyamba kugwira ntchito panthawi yotsegula tsamba.
- kumanga pipelineadzakana commitNgati zinthu zakale kapena zomangika zalephera kufufuza umboni, zomwe zimaletsa zomangika kuti zisafike pakupanga.
Ndi Xygeni, mutha kupitiliza kupeza ndi kuyesa masewera a github ndi chidaliro. Gawo lililonse, kuyambira kupanga cloning mpaka kukhazikitsa, limatetezedwa. Opanga mapulogalamu amakhala ndi chidwi chofuna kudziwa zambiri, pipelineKhalani otetezeka, ndipo unyolo wanu wogulira zinthu umakhalabe woyera.
