Ukwanda kohlaselo olucwangciswe kuluntu kwi-cybersecurity
Kwi-cybersecurity, kuye kwavela isoyikiso esitsha. Ngokukodwa, uhlaselo olucwangciswe kuluntu ngoku lubamba nabadlali abanamava kakhulu bengalindelanga. Ngokungafaniyo nezoyikiso zemveli, olu hlaselo aluxhomekekanga kubuchwepheshe obutsha okanye kwi-malware enzima. Endaweni yoko, lusebenzisa ukuthembana kunye nentsebenziswano.
Ngo-Epreli 2024, uluntu olusebenzisa imithombo evulekileyo lwajongana nomceli mngeni omkhulu. Umzekelo, umsebenzisi weGitHub ogama linguJia Tan wafumana ukufikelela kwi Isixhobo sokucinezela se-XZ Utils, esetyenziswa kakhulu kwiinkqubo zeLinux. Emva koko, uJia Tan wasebenzisa olu fikelelo ukufaka ucango lwangasemva kwisoftware. Ngenxa yoko, izixhobo ezininzi ezisekelwe kwiLinux zajongana neengozi ezinokubakho.
Enyanisweni, esi siganeko saba yindlela yokuvusa abantu. Satyhila ubuthathaka obukhoyo kwinkqubo yendalo evulelekileyo. Nangona ukungafihlisi kunye nentsebenziswano zihlala zizinto ezinamandla, zaba zizixhobo zabenzi bobubi. Ngaphezu koko, le meko igxininise indima ebalulekileyo yabagcini, abamele njengomgca wokuqala wokuzikhusela kwiindlela ezinjalo zobuqhetseba.
Iziganeko Zokwenyani Zohlaselo Olucwangciswe Yintlalo
Iziganeko ezahlukeneyo zehlabathi lokwenyani zibonise impembelelo embi yohlaselo olucwangciswe kuluntu kwiiprojekthi ezivulelekileyo. Le mizekelo ibonisa ubuthathaka kwaye igxininisa imfuneko yamanyathelo okhuseleko aqinileyo.
Isifundo seTyala 1: Ukusasazwa komsitho wephakheji ye-npm
NgoNovemba ka-2018, uhlaselo olucwangciswe kakuhle lwentlalo luye lwabeka emngciphekweni ukusasazwa komcimbi kwiphakheji ye-npm. Umdlali onobungozi wanikela ngoncedo lokugcina le projekthi. Umgcini wokuqala oxinezelekileyo, elangazelela uncedo, wanikezela ulawulo. Umhlaseli wazisa ikhowudi enobungozi eyenzelwe ukuba ii-bitcoins, eyakhutshelwa izihlandlo ezizizigidi ngaphambi kokuba ifunyanwe. Ngenxa yoko, abaphuhlisi kwafuneka bafumane ezinye iindlela okanye baqinisekise iikhowudi zabo zekhowudi enobungozi. Esi siganeko sakhokelela ekulahlekelweni kokuthembana kwangoko kwiphakheji yesiganeko kwaye sabangela ingxoxo ebanzi ngaphakathi kwenkqubo ye-npm malunga nesidingo sokuhlolwa okuqinileyo komgcini kunye nokuhlolwa kokuxhomekeka.
Umzekelo 2: Ukubiwa kweRubyGems
Ngowama-2020, abahlaseli basebenzise amagama ayimfihlo abuthathaka okanye asetyenziswe kwakhona ukuze bafikelele kwi- IrubyGems umphathi wephakheji. Bafumene ulawulo lweeakhawunti ezininzi baza bafaka ikhowudi enobungozi kwiigugu, nto leyo eyavumela ukusetyenziswa kwekhowudi ekude kwiimashini ezichaphazelekayo. Abagcini basabela ngokukhawuleza ngokususa nokutshintsha iigugu ezichaphazelekileyo. Bakwazisa ngokukhawuleza abasebenzisi ngokuphulwa komthetho. Esi siganeko sagxininisa ukubaluleka kwamagama ayimfihlo aqinileyo nahlukileyo kunye nokusetyenziswa kokuqinisekiswa kwezinto ezimbini. Ngenxa yoko, uluntu lweRubyGems luphucule amanyathelo okhuseleko kwaye lwaphakamisa ulwazi lokuzikhusela ngcono kwiintlaselo eziNjinelwe luLuntu.
Umzekelo 3: Isivumelwano se-PHP Git Server
NgoMatshi 2021, abahlaseli babeka emngciphekweni igosa Iseva ye-PHP GitBakwazile ukutyhala abantu abanobungozi commits equlethe ucango olungasemva kwikhowudi yomthombo we-PHP. Nangona i-malicious commitIi-s zifunyenwe ngokukhawuleza zaza zabuyiselwa, esi siganeko saphakamisa iinkxalabo ezibalulekileyo malunga nokhuseleko lolunye lweelwimi zeprogram ezisetyenziswa kakhulu. Ukuphendula, iqela lophuhliso lwe-PHP lathuthela indawo yalo yokugcina ulwazi kwiGitHub, enika iimpawu zokhuseleko ezingcono kunye nezixhobo zokubeka esweni. Bakwaqalise neenkqubo zokujonga ikhowudi ezingqongqo ngakumbi. Oku kwaphulwa kwemigaqo kube yindlela yokuvusa ezinye iiprojekthi ezivulelekileyo, kugxininisa imfuneko yeziseko zophuhliso ezikhuselekileyo kunye nokubeka esweni ngononophelo.
Izixhobo kunye neMikhwa eBalaseleyo yokulwa nohlaselo olucwangcisiweyo kwintlalo
Ukuthintela uHlaselo oluNjinelwe luLuntu, amaqela kufuneka asebenzise izixhobo kunye neendlela ezifanelekileyo. Umzekelo, Ukufunyanwa kweMalware yeXygeni kwangethuba Ibonelela ngokubekwa esweni ngexesha langempela. Esi sixhobo sivala iipakethe eziyingozi kwaye siqinisekisa ukuxhomekeka okukhuselekileyo. Ukongeza, sibona ukosuleleka yi-malware ngoko nangoko, nokuba kwiipakethe ezintsha okanye uhlaziyo kwiipakethe ezithembekileyo.
Ukongeza, i-Xygeni SSC Security ixhasa ukuqinisekiswa kokuqinisekiswa kwezinto ezininzi (i-MFA). Ikwanyanzelisa uphononongo lwekhowudi oluzenzekelayo kunye nolunye uhlolo lokhuseleko. La manyathelo anceda ekuchongeni ubuthathaka kunye nokuyeka izenzo ezimbi, ezidla ngokusetyenziswa ngexesha loHlaselo oluNjinelwe luLuntu.
Ngamafutshane, iziganeko zokwenyani ezifana ne-event-stream compromise, i-RubyGems hijacking, kunye nokwaphulwa kwe-PHP Git server kubonisa imfuneko engxamisekileyo yokuzikhusela kwi-Socially Engineered Attacks. Ngokusebenzisa uvavanyo oluqinileyo, ukubeka esweni okuqhubekayo, ukuqinisekiswa okuqinileyo, kunye nokukhusela iziseko zophuhliso, uluntu oluvulelekileyo lunokukhusela iiprojekthi. Ke ngoko, ukusebenzisa izixhobo ezifana ne-Xygeni kunceda ukugcina ukuthembana okubalulekileyo kwimpumelelo ye-ecosystem.
