Shai-Hulud: Kufotokozera kwa Phukusi la Npm la Nyongolotsi

Zotsatira za Kuukira kwa Shai-Hulud Supply Chain

Shai-Hulud akadalipobe mpaka pano. Nyongolotsi iyi imafulumizitsa nthawi yogunda. Zomwe zidatenga milungu ingapo ndi Trojan tsopano zikuwonekera m'maola ochepa. Zotsatira zake, Kufalikira kwa matendawa n'kofulumira komanso kovuta kuletsa. Imapita patsogolo ndi:

• Kuba ma tokeni a npm publish ndi zinsinsi za GitHub.
• Kudzisindikizanso m'maphukusi ena a npm.
• Kuwonjezera njira zogwirira ntchito za GitHub Actions zoipa kuti mupitirize.

Amene akukhudzidwa:

Gulu lililonse lomwe limayika ma phukusi a npm a anthu onse limawululidwa. Kuphatikiza apo, opanga mapulogalamu omwe ali ndi ma tokeni a npm kapena GitHub omwe ali ndi cached amakhala pachiwopsezo chachikulu. Oyendetsa CI omwe amagwiritsa ntchito zinsinsi zofalikira nawonso ali pachiwopsezo.

Kuopsa kwa bizinesi

Zotsatira za bizinesi zimakula mwachangu. Ma tokeni obedwa angayambitse kutenga akaunti, kubedwa kwa ma phukusi, komanso kugwiritsa ntchito molakwika ma cloud. Kuphatikiza apo, kupitilira kwa ntchito za GitHub kumapangitsa kuti zikhale zovuta kuyeretsa., magulu ayenera kuona Shai-Hulud ngati chochitika chomwe chikupitirira, osati chotsekedwa.

Momwe Shai-Hulud Supply Chain Attack Imagwirira Ntchito mu npm Packages

Zolinga ndi cholinga cha wowukira

Kampeniyi ikukonzekera zinthu zitatu:

• Cholinga choyamba ndi kuba ziphaso pamlingo waukulu kuchokera ku ma laptops opanga mapulogalamu ndi ma CI runners. Izi zikuphatikizapo ma npm publish token, ma GitHub token, ndi ma cloud credentials. Ndipotu, kusanthula kambiri kumatsimikizira kusonkhanitsa mwachinsinsi mwadongosolo, monga kuyendetsa TruffleHog ndikufunsa ma endpoints a metadata a cloud.
• Cholinga chachiwiri ndi kufalitsa zokha mwa kugwiritsa ntchito molakwika ufulu wofalitsa wa osunga zinthu molakwika. Zotsatira zake, malo amodzi amakula mofulumira kufika pa ambiri, popeza mitundu yatsopano ya mapaketi ena omwe ali ndi kachilomboka imawonekera popanda khama la anthu ena.
• Cholinga chachitatu ndi pitirizani ndikutuluka modalirika kudzera mu zomangamanga za GitHub. Oukira amapanga malo owonetsera anthu onse otchedwa "Shai-Hulud" okhala ndi maziko awiri64 data.json, ndipo kuwonjezera apo amabzala njira yogwirira ntchito yomwe imasinthasintha ${{ toJSON(zinsinsi) }} ndipo imatumizidwa ku webhook yosasinthika.

Phindu lomwe lingabwere ndi monga mwayi wopeza ma registry ndi ma source code kwa nthawi yayitali, kusuntha mwachangu m'maakaunti amtambo, komanso mwayi wogwiritsa ntchito njira yogulira zinthu. Malipoti a anthu onse akuwonetsa kuti ma repo achinsinsi aperekedwa kwa anthu onse ndi "-kusamuka" chowonjezera, chomwe chimawonjezera kuwonekera kwa data ndi mphamvu

Mkati mwa Shai-Hulud Payload: bundle.js mu npm Maphukusi

Zombo za Shai-Hulud ngati lalikulu, lopangidwa ndi Webpack komanso lopangidwa mozama kwambiri Fayilo ya JavaScript (bundle.js, pafupifupi 3–3.7 MB) zomwe zimachokera ku atakhazikitsa lowetsani phukusi.jsonZotsatira zake, Kukhazikitsa kulikonse kumayambitsa kukweza kwa fayilo yokha. Kapangidwe kameneka kamabisa zizindikiro, kumakanikiza kayendedwe ka kayendetsedwe kake, ndikukankhira malingaliro onse kukhala chinthu chimodzi chomwe chimagwira ntchito panthawi yokhazikitsa. Akatswiri nthawi zonse amatsimikiza kuphatikiza kwa Webpack, kukula kwa fayilo kosazolowereka, ndi nthawi yokhazikitsa.

Zizindikiro zobisika komanso zotsutsana ndi kusanthula zomwe mudzaziwona m'zitsanzo:

• Chithunzi cha module chochepetsedwa ndi ma ID a module a manambala, ndemanga zochepa, ndi kayendedwe ka control kosalala., Kapangidwe kameneka kamapangitsa kuti kuwunikanso pamanja kukhale kovuta kwambiri.
• Kubisa zingwe kudzera mu zigawo za base64 ndi othandizira pa zomangamanga. Mwachitsanzo, Kubwerezabwereza kwa base64 encoding ndi decoding nthawi zambiri kumachitika pozungulira njira zotulutsira deta.
• Kutumiza kwamphamvu kudzera eval-mapangidwe a kalembedwe ndi matupi ogwirira ntchito opangidwa, motero zimathandiza kuti code isinthe khalidwe panthawi yogwiritsira ntchito.
• kusefa kwa OS kukonda kugwiritsa ntchito Linux ndi macOS makamaka pa ma CI runners ndi ma developer laptops.

Kuchokera kumbali yogwira ntchito, mtolowu ndi wa modular. Ma Writeups amafotokoza ma module a OS discovery, filesystem ndi git secret scans, cloud SDK access, GitHub API operations, ndi propagation engine yomwe imasintha ma phukusi ena omwe woyang'anira ali nawo. Ndipotu, StepSecurity ndi ReversingLabs onse akuwonetsa ntchito yomwe imasintha ma phukusi okha ndi chinsinsi choipa.

Kukhazikitsa Nthawi Yogwiritsira Ntchito mu Shai-Hulud: Momwe Mapaketi a npm Amayambitsira Worm

Kuukira kumayamba pamene pambuyo pokhazikitsa imayendetsa node bundle.js. Pakadali pano, script imayambitsa ndikutsegula momwe ntchito ikuyendera, ndikukhazikitsa njira yogwirira ntchito yonse ya nyongolotsi.

Kupeza ndi kukolola

• Payload dumps imafufuza mafayilo am'deralo kuti apeze zinsinsi za entropy zapamwamba komanso ma prefixes a token. Kuphatikiza apo, imawonjezera kufalikira poyendetsa TruffleHog.
• Imafunsa ma endpoints a metadata a cloud kuti ipeze ziphaso zosakhalitsa. Mwachitsanzo, kuyimbira foni ku 169.254.169.254 pa AWS kapena metadata.google.internal pa GCP nthawi zambiri imawonekera mwa anthu omwe ali ndi kachilomboka.
• Chifukwa chake, Chidziwitso chilichonse chomwe chapezeka chimagwiritsidwa ntchito nthawi yomweyo kufalitsa ma phukusi atsopano a npm kapena kukakamiza ntchito za GitHub.

Exfiltration

• Nyongolotsi imapanga repo yatsopano ya GitHub yotchedwa Shai Hulud ndipo amalemba double base64-encoded data.json ndi tsatanetsatane wa nsanja, malo otayira zinthu zachilengedwe, ndi zinsinsi. Monga momwe tikuonera, phokoso ili ndi losavuta kulizindikira ngati oteteza akudziwa komwe angayang'ane.
• Imakhazikitsanso njira yogwirira ntchito ya GitHub Actions, nthawi zambiri pa nthambi yotchedwa shai-hulud, zomwe zimapanga mndandanda ${{ toJSON(secrets) }} ndipo imayika deta ku webhook yosasinthika. Kuphatikiza apo, njira iyi imagwira ntchito mpaka wina atachotsa.

Kufalitsa

• Ndi chizindikiro chilichonse cha npm chomwe chapezeka, payload imawerengera ma phukusi onse omwe ali a wosamalira wowonongeka. Kenako, imatenga tarball iliyonse, imayambitsa bundle.js ndi cholowera cha postinstall, ndikusindikizanso phukusilo.
• Zotsatira zake, ma phukusi ambiri omwe ali ndi kachilomboka amatha kuwonekera pakangopita maola ochepa, zomwe zimapangitsa kuti kuphulika kuchuluke kwambiri m'chilengedwe chonse.

Kulimbikira ndi kuwonekera

• Nyongolotsiyi imasunga ntchito zoyipa ndipo, nthawi zina, imasinthira malo osungiramo zinthu zachinsinsi kuti zigwiritsidwe ntchito pagulu ndi "-kusamuka" Chiganizo. Zonsezi zimatsimikizira kuti woukirayo akupitirizabe kugwira ntchito komanso kuti deta yake ituluke bwino.

Chidziwitso chozindikira makiyi
Kugwiritsa ntchito kosazolowereka kwa ${{ toJSON(secrets) }} Mu ntchito za Actions, njira zogwirira ntchito sizipezeka kawirikawiri. Choncho, magulu ayenera kuiona ngati chizindikiro chachikulu panthawi yosaka.

Ndondomeko ya ntchito yoyeretsa yomwe muyenera kuyang'ana

Kugwiritsa ntchito kosazolowereka kwa ku JSON (zinsinsi) mu Actions ndi chizindikiro chachikulu pankhaniyi.

Khodi yabodza yofalitsa yapamwamba kwambiri (yotetezeka, yofotokozera)