Shai-Hulud: Tsanangudzo yeMapakeji eNpm Honye

Mhedzisiro yeKurwiswa kweShai-Hulud Supply Chain

Shai-Hulud ichiri kushanda nanhasi. Gonye iri rinokurumidza nguva yekurovera. Zvaimbotora mavhiki netrojan zvino zvabuda mumaawa. Nekuda kweizvozvo, kupararira kwacho kunokurumidza uye kwakaoma kudzora. Inofambira mberi ne:

• Kuba npm publish tokens uye zvakavanzika zveGitHub.
• Kuzviburitsa patsva mune mamwe mapakeji eNpm.
• Kuwedzera mabasa eGitHub Actions ane hutsinye kuti urambe uchiita basa.

Ndiani akabatwa:

Chero timu inoisa mapakeji eruzhinji e npm inoonekwa pachena. Uyezve, vagadziri vane ma npm akachengetwa kana kuti ma GitHub token vanotarisana nenjodzi huru. Vanomhanya veCI vanoshandisa zvakavanzika zvakafara vanewo mukana wekusashanda zvakanaka.

Njodzi yebhizinesi

Kukanganiswa kwebhizinesi kunowedzera nekukurumidza. Matokeni akabiwa anogona kutungamira mukutorwa kweakaundi, kubiwa kwemapakeji, uye kunyange kushandiswa zvisina kunaka kwe cloud. Pamusoro pezvo, kuramba kuripo muGitHub workflows kunoita kuti zviome kuchenesa., zvikwata zvinofanirwa kubata Shai-Hulud sechiitiko chiri kuenderera mberi, kwete chiitiko chakavharwa.

Mashandiro anoita Shai-Hulud Supply Chain Attack mu npm Packages

Chinangwa nezvinangwa zvemurwisi

Mushandirapamwe uyu unogadzirisa zvinhu zvitatu:

• Chinangwa chekutanga ndechekuita kuba zvitupa pachiyero kubva kumalaptop evagadziri uye maCI runners. Izvi zvinosanganisira npm publish tokens, maGitHub tokens, uye cloud credentials. Kutaura zvazviri, ongororo dzakawanda dzinosimbisa kuunganidza kwakavanzika kwakarongeka, senge kumhanya TruffleHog uye kubvunza cloud metadata endpoints.
• Chinangwa chechipiri ndechekuita kuti kuparadzira otomatiki nekushandisa zvisirizvo kodzero dzekuburitsa mashoko dzevaya vanochengetedza mashoko asina kunaka. Nekuda kweizvozvo, nzvimbo imwe chete inokurumidza kukura kusvika kune dzakawanda, sezvo mamwe mapakeji matsva ane utachiona achibuda pasina kuedza kwekuwedzera kwevanhu.
• Chinangwa chechitatu ndechekuita ramba uchibuda uye unosefa zvakavimbika kuburikidza neGitHub infrastructure. Varwi vanogadzira nzvimbo yeruzhinji inonzi "Shai-Hulud" ine base64 mbiri data.json, uye pamusoro pezvo vanodyara mafambiro ebasa anotevedzana ${{ toJSON(zvakavanzika) }} uye woitumira kune static webhook.

Mubairo uyu ungangosanganisira mukana wekuwana marejistri kwenguva refu uye kodhi yesource, kufamba nekukurumidza muakaundi dzegore, uye sarudzo yekuwedzera kushandisa cheni yezvekugovera. Mishumo yeruzhinji inoratidza kuti marepo epachivande akaendeswa kune veruzhinji ne "-kutama" chivakashure, icho chinowedzera kuratidzwa kwedata uye simba

Mukati meShai-Hulud Payload: bundle.js mu npm Mapakeji

Shai-Hulud inotakura zvinhu hombe, yakaunganidzwa paWebpack uye yakapetwa zvakanyanya Faira reJavaScript (bundle.js, inenge 3–3.7 MB) inoita kubva ku postinstall batanidza mukati package.json. Nekuda kweizvozvo, Kuisa kwega kwega kunokonzeresa mutoro wepayload otomatiki. Dhizaini iyi inovanza zvinozivikanwa, inodzvanya kuyerera kwekutonga, uye inosundira pfungwa dzese muchinhu chimwe chete chinoshanda panguva yekuisa. Vaongorori vanogara vachisimbisa kuunganidzwa kweWebpack, saizi yemafaira isingawanzoitiki, uye kuitiswa kwenguva yekuisa.

Unhu hwekusaziva uye hunhu hwekusaongorora hwauchaona mumienzaniso:

• Girafu yemodule yakapfupikiswa ine maID emodule enhamba, makomendi mashoma, uye kuyerera kwekutonga kwakatsetseka., chimiro ichi chinoita kuti kuongororwa nemaoko kuve kwakaoma zvikuru.
• Kuvanza tambo kuburikidza ne base64 layers uye vabatsiri vekuvaka. Semuenzaniso, Kudzokorora kunyorwa uye kunyorwa kwebase64 kunowanzoonekwa pamaitiro ekubvisa data kubva muzvinhu zvichienda muzvinhu zvichienda muzvinhu zvichienda muzvinhu zvichienda muzvinhu zvino ...
• Kutumirwa kwakasimba kuburikidza eval-maitiro emaitiro uye miviri yebasa yakagadzirwa, nokudaro zvichiita kuti kodhi ichinje maitiro panguva yekumhanya.
• kusefa kweOS kusarudza Linux ne macOS kunyanya pama CI runners nema developer laptops.

Kubva pakona inoshanda, bundle iri rakafanana. MaWriteups anotsanangura mamodule eOS discovery, filesystem uye git secret scans, cloud SDK access, GitHub API operations, uye propagation engine inogadzirisa mamwe mapakeji akachengetedzwa nemuchengeti. Kutaura zvazviri, StepSecurity neReversingLabs zvese zvinoratidza basa rinogadzirisa otomatiki mapakeji nechinhu chine njodzi.

Kuitwa Kwenguva Yekuisa muShai-Hulud: Maitiro eNpm Packages Anokonzera Honye

Kurwiswa kunotanga kana postinstall inomhanya node bundle.js. Panguva ino, chinyorwa chinotanga uye chinoburitsa mamiriro ekushanda mundangariro, zvichigadzira nzira yekuti honye ishande zvizere.

Kuwanikwa uye kukohwa

• Iyo payload dumps inoburitsa process.env uye inoskena mafaira emunharaunda kuti ione zvakavanzika zve-entropy zvine simba uye zviziviso zve token. Pamusoro pezvo, inowedzera kufukidzwa kwayo nekushandisa TruffleHog.
• Inobvunza nezvemagumo emetadata egore kuti iunganidze zvitupa zvenguva pfupi. Semuyenzaniso, kufona kuna 169.254.169.254 paAWS kana metadata.google.internal paGCP inowanzoonekwa muvanhu vane hutachiona.
• Nokudaro, Chero chitupa chinowanikwa chinobva changoshandiswa kuburitsa mapakeji matsva eNpm kana kusundidzira maGitHub workflows.

Exfiltration

• Honye inogadzira repo itsva yeGitHub inonzi Shai Hulud uye anonyora double base64-encoded data.json neruzivo rwepuratifomu, nzvimbo dzinorasirwa nharaunda, nezvakavanzika. Sezvatinoona, maitiro aya ane ruzha ari nyore kuona kana vadziviriri vachiziva kwekutarisa.
• Inodyarawo mafambiro eGitHub Actions, kazhinji pabazi rine zita shai-hulud, izvo zvinotevedzana ${{ toJSON(secrets) }} uye anotumira data racho kuwebhu inongoshanda. Uyezve, basa iri rinoramba riripo kusvika mumwe munhu aribvisa.

Kupararira

• Nechero chinhu chakawanikwa che npm token, payload inoverenga mapakeji ese ari emunhu anochengetedza akakanganiswa. Zvadaro, inotora tarball yega yega, inoisa bundle.js uye postinstall entry, uye inoburitsa patsva package yacho.
• Nekuda kweizvozvo, mapakeji akawanda ane hutachiona anogona kuoneka mumaawa mashoma, zvichiwedzera kuputika kwenzvimbo dzakasiyana siyana.

Kuramba uchienderera mberi uye kuratidzwa

• Honye iyi inochengetedza mabasa akaipa aripo uye, muzviitiko zvakawanda, inoshandura nzvimbo dzakavanzika kuenda kuruzhinji ne "-kutama" Zvose pamwe chete, izvi zvinoita kuti murwisi arambe akadzikama uye anowedzera kubuda kwedata.

Chinyorwa chekuona kiyi
Kushandiswa kusingawanzoitiki uku ${{ toJSON(secrets) }} muActions workflows haiwanzoitiki. Naizvozvo, Mapoka anofanira kuiona sechiratidzo chikuru panguva yekuvhima.

Maitiro ekushanda akacheneswa aunofanira kutsvaga

Kushandiswa kusingawanzoitiki uku to JSON (zvakavanzika) muActions chiratidzo chikuru muchiitiko ichi.

Kodhi yekunyepedzera yekuparadzira yepamusoro-soro (yakachengeteka, inotsanangura)