Selelekela: Ho phahama ha Lipapali tsa GitHub le Likotsi tse ka Morao ho Monate
Haeba u kile ua batla Lipapali tsa GitHub, mohlomong o kile wa kopana le ntho e nngwe le e nngwe ho tloha ho di-shooter tse thehilweng ho sebatli ho isa ho di-clone tsa kgale tse hahiloeng ka JavaScript kapa Python. Diporojeke tsena di monate ho di leka, di bonolo ho di tsamaisa, mme hangata di hlaha dithutong tsa YouTube kapa diforamong. Ka lebaka leo, di se di tumme haholo dikolong, moo bahlahisi le baithuti ba atisang ho di fihlella ka tsona Lipapali tse koetsoeng tsa GitHub kapa ba li fereko ho tsoa ho Lipapali tsa GitHub io maqephe.
Ka lebaka la botumo bona, bahlahisi le baithuti ka ho tšoana ba kopitsa li-repo tsena, ba tsamaisa khoutu, 'me ba tsoela pele ntle le ho nahana haholo. Empa bothata ke bona: ha se lipapali tsena tsohle tse leng kamoo li bonahalang kateng.
Li-repo tse ling tsa lipapali li na le li-script tse lefifi tsa ho kenya. Tse ling li hula mekhoa e siiloeng ke nako kapa e kotsing. Tse 'maloa li bile li pata malware ka har'a thepa, lijana kapa lifaele tsa ho kenya. Kaha bahlahisi ba bangata ba tšoara merero ena ka Lipapali tsa GitHub io, kotsi e ata kapele 'me hangata ha e hlokomeloe.
Posong ena, re tla hlahloba kamoo li-repo tsa lipapali li ka bang tšokelo e kholo ea ts'ireletso. Re tla boela re u bontše mokhoa oa ho lula u sireletsehile ntle le ho tela bohelehele ba hau kapa ba hau. CI/CD.
Hobaneng Bahlaseli ba Sheba Lipapali tsa GitHub le Libaka tsa Polokelo tse sa Thibeloang
Ha o sheba ka lekhetlo la pele, li-repo tsa lipapali ho GitHub li bonahala li se na kotsi. Etsoe, hangata ke liteko tse nyane kapa merero ea thuto e hahiloeng bakeng sa monyaka. Leha ho le joalo, bahlaseli ba bona tsena ka tsela e fapaneng. Ha e le hantle, tse ngata tse joalo li-repos li sebelisoa e le li-platform tsa ho fana ka malware, hangata e ipata e le Lipapali tsa GitHub or lipapali tse sa thibeloang tsa github.
Mohlala, sebapali sa tšokelo se tsejoang ka hore ke Stargazer Goblin e sebetsa marangrang a fetang Liakhaonto tse 3,000 tsa GitHub tse nang le moea, e reheletsoeng ka lebitso la "Stargazers Ghost Network." Sehlopha sena se bapala ka boomo, se fereko le ho shebella li-repo tse kotsi ho eketsa ponahalo le tumello ea tsona, hangata se shebane le basebelisi ba batlang lisebelisoa kapa maqiti a lipapali. Libaka tsena tsa polokelo li 'nile tsa sebelisoa ho aba li-info-stealers le ransomware tse kang Atlantida Stealer, Rhadamanthys, Lumma Stealer, le RedLine.
Ho feta moo, letšolo le leng le rarahaneng le bitsoang Thohako ea Metsi bonyane e sebelisitse libetsa Liakhaonto tse 76 tsa GitHub, ho kenya malware ea mekhahlelo e mengata ho seo ho bonahalang e le lisebelisoa tse molaong. Meputso e patiloe lifaeleng tsa projeke ea Visual Studio (PreBuildEvent), ho sebelisoa lingoloa tse patiloeng le li-binary tse thehiloeng ho Electron bakeng sa bosholu ba mangolo, ho ntšoa ha data ea sebatli, le ho phehella nako e telele. Lipheo li kenyelletsa bahlahisi, lihlopha tsa DevOps le baetsi ba lipapali.
Bahlaseli ba nka monyetla ka taba ea hore bahlahisi ba bangata ba etsisa lipapali tsa github ho li leka kapa ho ithuta ho tsona ntle le ho hlahloba khoutu. Ka mokhoa o ts'oanang, lipapali tsa github io, li-repo tse sebeletsoang ka Maqephe a GitHub, li ka amohela JavaScript e mpe, litšoantšo, kapa li-redirection script tse sebetsang ha li kentsoe ho sebatli. Kaha lipapali tse ngata tsa github io li ferekoa 'me li sebelisoa hape ntle le tlhahlobo e tebileng, bahlaseli ba li sebelisa ho pata khoutu e patiloeng, li-tracker tse patiloeng, kapa ho jarolla lintho tse bakang. Maqiti ana a sebelisa hampe tšepo eo bahlahisi ba e behang mererong ea mohloli o bulehileng.
Ka bokhutšoanyane, botumo ba li-repo tsa lipapali le merero ea ho bapala e sa thibeloang li etsa hore e be sebaka se nonneng bakeng sa bahlaseli. Ntle le tlhahlobo e nepahetseng, moqapi ea bohelehele a ka kenya malware tikolohong ea hae ka ho etsa hore e be klone kapa ho tšoara repo ea lipapali.
Na u batla ho sireletsa merero eohle ea hau ea GitHub?
Haeba o ipotsa hore na o ka sireletsa li-repo tsa hau tsa GitHub joang ho feta li-mods tsa papali, o se ke oa fetoa ke poso ea rona e tebileng mabapi le litumello, pull requests, CI/CD kopanyo, le tse ling.
Mekhoa ea Malware ho Lipapali tse sa Thibeloang tsa GitHub le Lipapali tsa GitHub IO
Ha bahlahisi ba hlahloba merero e ngotsweng e le github unblocked games, tse ngata li bonahala li se kotsi. Leha ho le joalo, mekhoa e 'maloa e pheta-phetoang e senola litšokelo tse tebileng tse ka fosoang habonolo.
Letšolo: Thohako ea Metsi
Trend Micro e sibollotse letšolo le bitsoang Thohako ea Metsi, moo bonyane Liakhaonto tse 76 tsa GitHub Libaka tsa polokelo tse nang le libetsa tse amohetsoeng tse iketsang lisebelisoa tsa moqapi kapa li-mod tsa papali. Li-repos tsena li kenya meroalo e kotsi ea moputso ka ho sebelisa <PreBuildEvent> Li-tag lifaeleng tsa projeke ea Visual Studio. Nakong ea ho haha, li-script tsa PowerShell kapa VBS tse patiloeng li jarolla li-archive tsa ZIP tse patiloeng, li kenya li-binary tse thehiloeng ho Electron, 'me li ntša mangolo a tumello, data ea sebatli le li-tokens tsa seboka. Malware e boetse e kenya tšebetsong ho phehella ka mesebetsi e reriloeng le liphetoho tsa ngoliso.
Khoutu ea bohata ho Lipapali tsa GitHub: Hook
<PropertyGroup> <PreBuildEvent> powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "download ZIP from GitHub → extract payload → run installer" </PreBuildEvent> </PropertyGroup> Khoutu ea Pseudo: Ts'ebetso ea PowerShell e sa Tsejoeng
# decode base64 payload payload = decode_base64('...') # run in memory execute_in_memory(payload) Mohlala ona o nolofalitsoeng o bontša kamoo khoutu e kotsi e qobang ho ngola disk ka ho e hlalosa le ho e kenya tšebetsong ka ho toba memoring.
Letšolo: Thohako ea Metsi
Trend Micro e hlwaile ts'ebetso ea tšokelo e tsejoang e le Thohako ea Metsi, moo bahlaseli ba sebelisitseng bonyane Liakhaonto tse 76 tsa GitHub ho boloka lipolokelo tse nang le libetsa. Merero ena e ne e bonahala e le lisebelisoa tsa moqapi kapa li-mod tsa papali. Ka hare, ba kentse mohopolo o kotsi lifaeleng tsa kaho, haholo-holo ka <PreBuildEvent> tag ho Visual Studio .csproj difaele.
Meputso e ne e kenyelletsa lingoloa tsa mekhahlelo e mengata tse neng li jarolla li-ZIP tse patiloeng, li ntša lifaele, 'me li etsa mesebetsi ea ka morao. Ho feta moo, bahlaseli ba ekelitse mekhoa ea ho phehella ba sebelisa liphetoho tsa ngoliso ea Windows le mesebetsi e reriloeng.
Mohlala oa Khoutu ea Maqiti: Hook ea Kaho ea Visual Studio
<PropertyGroup> <PreBuildEvent> powershell -Command "download ZIP from GitHub, extract payload, and run installer" </PreBuildEvent> </PropertyGroup>Khoutu ea Pseudo: Ts'ebetso ea Ka hare ho Memori ka PowerShell
# Decode and run base64 payload in memory payload = decode_base64('...') execute_in_memory(payload) Mokhoa ona o qoba ho ngolla disk, e leng se thusang bahlaseli ho qoba ho lemoha antivirus le ho fumana sephiri.
Letšolo: Stargazer Goblin le Liakhaonto tsa Ghost
Tlhaselo e 'ngoe e kholo e tlalehiloe ke Check Point Research, e ileng ea senola Letlooa la Li-Ghost la StargazersLetšolo lena le sebelisitsoe ho feta Liakhaonto tse 3,000 tsa GitHub tsa bohata ho kenya linaleli, lifereko le bashebelli polokelong ea lintho tse kotsi. Sepheo e ne e le ho theha maikutlo a fosahetseng a hore lintho li nepahetse.
Litlaleho tsena tsa moea li thusitse ho khothaletsa malware joalo ka Atlantic Stealer, Luma, Rhadamanthys, 'me RedLine, haholo-holo e shebane le bahlahisi le libapali. Ka matsatsi a mane feela, leqhubu le le leng la tlhaselo le ile la tšoaetsa batho ba fetang Bahlaseluoa ba 1,300 ka ho jala dipakete tsa mod tsa papali tse fetotsweng ka dihokelo tsa Discord le README.
Mohlala oa Khoutu ea Bohata: README e Lonya
# Ultimate Game Mod Pack 🕹️ Download and run the installer here: [Download Now](https://github[dot]com/ghost/repo/releases/latest/modpack.zip) Mekhoa e Tloaelehileng ea Malware Lipolokelong tsa Lipapali tsa GitHub
| paterone | Tlhaloso |
|---|---|
| Kenya pele / Haha Lingoloa | Lingoloa tse sebetsang ka boiketsetso nakong ea ho kenya kapa ho haha ho lata le ho kenya mesebetsi ea hole, hangata ntle le tlhokomeliso ea mosebelisi. |
| Ho thaepa ka mongolo o hlabang le lifereko tsa bohata | Merero e kotsi e etsisang mabitso kapa sebopeho sa lisebelisoa tse tsebahalang kapa li-repo tsa lipapali ho qhekella bahlahisi hore ba li kenye. |
| Tlhekefetso ea Maqephe a GitHub | JavaScript, litšoantšo, kapa li-redirect tse patiloeng maqepheng a `github io games` tse bakang ho kenngoa tšebetsong ha li-script tse kotsi ha leqephe le jarisoa. |
| Matšoao a Botumo ba Bohata | Liakhaonto tsa meea li phahamisa linaleli, lifereko le bashebelli ka maiketsetso ho etsa hore libaka tsa polokelo tse kotsi li bonahale li tšepahala. |
Mekhoa ena ha se ea khopolo-taba. E se e bonoe ketsahalong e phelang matšolo a malware, tseo bongata ba tsona li neng li shebane le bahlahisi ba sebelisang li-repo tsa lipapali e le libaka tsa ho kena.
Ka lehlohonolo, li-platform tse ling tsa ts'ireletso li ka tšoara mekhoa ena pele li baka tšenyo. Karolong e latelang, re tla bontša kamoo Xygeni e lemohang, e thibelang le ho lokisa litšokelo tsena ho pholletsa le hau. SDLC.
Kamoo Xygeni e Sireletsang Lipapali tsa GitHub, Merero e sa Thibeloang, le CI/CD Pipelines
Ha dipaterone tse kotsi ho di-repo tsa dipapadi tsa GitHub di hlahella, Xygeni e fana ka tshireletso e felletseng ho emisa ditshoso pele di beha ditsamaiso tsa hao kotsing kapa ketane ya phepelo.
1. Temoso ea Pele: Ho Lemoha Malware ea Nako ea Sebele Lipapaling tsa GitHub le Litšehetsong
Xygeni e ntse e hlahloba liphutheloana tse ncha ho pholletsa le NPM, Maven, PyPI, le tse ling. Sena se kenyelletsa liphutheloana tse kentsoeng libakeng tse sa lebelloang, joalo ka li-repo tsa lipapali kapa merero ea lipapali tse sa thibeloang tsa github tse arolelanoang liforamong kapa marang-rang a sekolo. Haeba karolo e belaetsang e fumanoa, Xygeni e e arola ka bo eona, e thibela ts'ebeliso ea eona ho batho bao u ba tšepang, 'me e romela litemoso tsa nako ea sebele sehlopheng sa hau. Sena se thibela meputso e mebe ho kena ho codebase ea hau kapa CI/CD pipeline.
2. Ho Ela Hloko ho Fihlella SCA ka Bohlale ba ho Etella Pele
Ho ena le ho imetsa sehlopha sa hau ka litemoso, Xygeni e lekola hore na bofokodi bo hlile bo sebelisitsoe khoutung ea hau (ho fihlella habonolo) mme e kenyelletsa lintlha tsa kotsi (EPSS, tšusumetso ea khoebo) ho hlahisa litaba tsa bohlokoa ka ho fetisisa. Sena se fokotsa lerata haholo 'me se netefatsa hore sehlopha sa hau se nka khato ho seo e leng sa bohlokoa e le kannete.
3. Ho Sebelisa Tokiso e Iketsang Pull Requests
Ha ho fumanoa bofokoli kapa ho itšetleha ka kotsi ka tharollo e tsejoang, Xygeni e iketsetsa Pull Request ho ntlafatsa kapa ho lokisa bothata. Sena se potlakisa nako ea karabelo, se fokotsa mosebetsi oa matsoho, 'me se boloka pipeline sireletsehileng.
4. CI/CD Litaolo tsa Tšireletso ho Thibela Meaho e Mebe
Xygeni e hokahana le build pipelines ka Liketso tsa GitHub, Jenkins, GitLab, Azure Pipelines, le tse ling. E skena li-script tsa kaho, li-Dockerfiles, le CI/CD configs bakeng sa ditaelo tse belaetsang, tse kang dikhetla tse kgutlisang morao kapa di-script tsa ho kenya, mme di ka thibela ho aha haeba khoutu e kotsi e fumanwa.
5. Haha Botšepehi ka Litiisetso tse Latelang SLSA
The Build Security mojule o theha bopaki bo saennweng ho latela SLSA le in-toto standards, ho kenya metadata mohloling, ho itšetleha ka eona, SBOM, le liteko. Haeba ho etsahala liphetoho tse sa lumelloang, netefatso ea bopaki ea hloleha 'me pipeline e ema ka bohona.
6. Ho lemoha ho se tloaelehang ho SCM le CI Artifacts
Xygeni e lula e lekola khoutu ea hau ea mohloli le libaka tsa CI ho lemoha boitšoaro bo sa tloaelehang, joalo ka commitho qoba tshireletso ya lekala, basebedisi ba sa tsejweng, kapa dithuso tse sa lebellwang tsa token. E kopantswe le yona SAST enjene, e hlwaya mamati a ka morao a patilweng kapa lingoloa tse kentsoeng pele ho kopanngoa kapa ho kenngoa tšebetsong.
7. Ho Sibolloa ha Thepa ka Boiketsetso le ASPM ponahalo
Xygeni e haha thepa e teng tsa hao kaofela SDLC tikoloho, ho kenyeletsoa le libaka tsa polokelo ea lintho, basebetsi-'moho, pipelines, ho itšetleha ka tsona, le infra ea leru. Ponahalo ena e nolofalletsa ho beha pele likotsi tse fetohang, ho etsa limmapa tsa ho latela melao (mohlala, NIS2, DORA), le bopaki bo itokiselitseng tlhahlobo ntle le ho sitisa mekhoa ea mosebetsi e seng e ntse e le teng.
Seo Lipapali tsa GitHub li se Bolelang bakeng sa Bahlahisi ba Sireletsehileng: Lula u labalabela ho tseba, Lula u Sireletsehile
- Haeba repo e na le sengoloa se patiloeng sa kaho se jarollang khoutu e kotsi (mohlala, sengoloa sa PowerShell sa kamora ho se kenya), Xygeni e tla e tšoaea le ho e thibela pele e etsoa.
- Ha ho kopanngwa khoutu e buang ka ho itshetleha ho belaetsang, Xygeni ka bobedi e a e thibela mme e fana ka tokiso e iketsahallang ka Pull Request.
- Haeba Maqephe a GitHub, projeke e amohetsoeng e na le lingoloa tse patiloeng tse kotsi, Xygeni's SCA le ho lemoha malware ho a hlwaya esita le haeba a sebetsa feela nakong ya ho kenya leqephe.
- haha pipelineba tla hana commitHaeba mesebetsi ea matsoho kapa li-config tse hahiloeng li hlōleha ho hlahloba bopaki, e leng se thibelang mehaho e senyehileng ho fihlela tlhahiso.
Ka Xygeni, o ka tswela pele ho sibolla le ho leka lipapali tsa github ka boitshepo. Mohato o mong le o mong, ho tloha ho cloning ho isa ho kenya tshebetsong, o sireleditswe. Bahlahisi ba dula ba labalabela ho tseba, pipelineLula u sireletsehile, 'me ketane ea hau ea phepelo e lula e hloekile.
