Esi sisiqendu sesithathu kwi uthotho lwamanqaku malunga nohlobo oluxhaphakileyo lokuhlaselwa kweenkqubo zesoftware: ezo zisebenzisa kakubi irejista kawonke-wonke Vula Umnikezi izixhobo zesoftware. Emva kokuhlalutya kwisiqendu esidlulileyo "I-Anatomy yeePakethe ezinobungozi: Zithini iiTrends?"Indlela abenzi bobubi abafaka ngayo ukuziphatha okubi kwiindawo ezintsha okanye ezikhoyo ezishicilelweyo, sikulungele ukunxiba iijakethi zethu zokucima umlilo size sihlole indlela esinokuyithintela ngempumelelo ngayo isoftware enobungozi ehanjiswa ngale ndlela, okanye ngenye indlela, sijongane nesiganeko esinokuba yingozi kwi-intanethi kuba sithathe indlela engafanelekanga."
Uninzi lweengcali eziqaphela ukhuseleko zineengcinga malunga nendlela yokujongana nale ngozi. Sive abaphathi bezokhuseleko besithi ngaphandle kokuthandabuza ukuba SCA Izixhobo sele zikuxelela xa uhlobo lwephakheji luyi-malware. Okanye ukuba zixhomekeke kwizixhobo zesoftware ezaziwayo neziphononongiweyo, apho nayiphi na i-malware ingafunyanwa kwaye isuswe ngokukhawuleza. Zisebenzisa iinguqulelo ezivulekileyo ezincinci/ezinepatch ukuze zenze ukulungiswa kobuthathaka ngokuzenzekelayo, kwaye leyo yindlela efanelekileyo necetyiswayo yokunciphisa umngcipheko wokuxhomekeka komthombo ovulekileyo, kulandela "lungisa kwangethuba, lungisa rhoqo”Umgaqo.
Kule siqendu, siza kujonga ukuba kutheni ezi ngcinga zingachanekanga, kunye nendlela ezo ngcamango ziphosakeleyo ezinegalelo ngayo ekuthandweni kwale ndlela yokuhlasela, kunye nomngcipheko omkhulu ofunyanwa yimibutho. Siza kugqiba ngento esebenzayo, kwaye yeyiphi imizamo kunye nezixhobo ezibandakanyekayo.
Iimpazamo eziqhelekileyo
Ngexesha lohambo lwethu ngokhuseleko lwesoftware, sibone iindlela zokuhlasela zitshintsha kunye neengcinga ezahlukeneyo ezivela kubantu abaqaphela ukhuseleko. Imibutho idla ngokungaqondi kakuhle ukuba yintoni esebenza ngokuchasene nale ngozi, ngoko ke kuqala siza kuhlola ukuba yintoni engasebenziyo, sishwankathele kuluhlu olulandelayo, olungaphelelanga, lweengcinga eziphosakeleyo.
Ubuxoki # 1: SCA izixhobo sele zixela izinto ezinobungozi
Kanjalo! Kodwa emva kwenyani... Xa mhlawumbi sele kudlule ixesha ukuba le nto isetyenziswe kwisoftware, kwaye abadlali ababi sele befumene indawo kumphuhlisi okanye CI/CD umgcini. Iimfihlo zisenokuba zikhutshiwe, ezinye ii-malware zikhutshiwe zaza zafakwa, mhlawumbi utshaba luye lwafudukela ecaleni kwaye sele lufikelele kwenye indawo.
Uhlalutyo loBume beSoftware (SCAIzixhobo zanamhlanje zenza umsebenzi omhle ngokwandisa umlinganiselo wesignali nengxolo, zimisela ukuba ubuthathaka bunokufikeleleka okanye bunokuxhaphazwa. Kodwa azinamsebenzi nxamnye ne-malware entsha. Cinga ngecandelo elinobungozi njengobuthathaka bemihla ngemihla: Kuphela xa ukuziphatha kwalo okubi kufunyenwe, eli candelo lixelwa kwirejistri yokubamba, ethi emva kokuhlolwa liqela lokhuseleko iqinisekiswe njengenobungozi kwaye isuswe kwirejistri. [1].
Ngelo xesha, ihlabathi (kuquka SCAs) uyazi ukuba ukufaka okanye ukusebenzisa i-component (okanye ezinye iinguqulelo ze-component ekhoyo) akulunganga. Kodwa oku kwenzeka xa i-component ingafumaneki kwi-registryUkwazi ukuba ndineengozi kwizixhobo zomntu wesithathu, okanye kwanezixhobo ezibekwe kuluhlu lwezona zinobungozi yirejista kulungile, kodwa ngelishwa SCA okanye izixhobo zophicotho eziqhelekileyo azincedi kule meko. Ngaphandle kokuba SCA/audit tool ingazi kwangaphambili ukuba into ethile inobungozi ngaphambi kokuba isetyenziswe kumbutho wakho.
Khumbula, nasiphi na isisombululo esichasene nezixhobo ezivulekileyo ezinobungozi kufuneka sizifumane ebhabha, phakathi kwexesha apho icandelo lipapashwe kwirejista kunye nexesha apho icandelo (uhlobo) lisetyenziswa okokuqala kumbutho wakho. Kwaye oko kuquka icandelo eliguqukayo.
Ingcamango ephosakeleyo #2: Ukulawula izikripthi zokufaka ngexesha lokwakha kuthintela ukuziphatha okubi okuvela kwizixhobo ezivulelekileyo
Abaphathi beephakheji abahlukeneyo banikezela ngesakhono sokuqhuba izikripthi (ezibandakanyiweyo kwi-tarball yecandelo [2]), ngezizathu ezivakalayo, ezinje ngokuqokelela izinto ezifunekayo kumaqonga ahlukeneyo, ukuvelisa ikhowudi, okanye ukuqhuba iimvavanyo, kwaye sonke sifanele sazi ukuba zinokusetyenziswa kakubi ngabadlali ababi ukuba izikripthi ezinobubi zifakiwe kwi-tarball, okanye ukuba umhlaseli angenza isikripthi esinobubi sisebenze endaweni yesilungileyo.
Ukwazi oku, singayilungiselela umphathi wephakheji ukuba angawahoyi ama-script. Umzekelo, nge-NPM -ungahoyi-imibhalo-ngqangi iflegi (okanye ipropati yoqwalaselo kwi .npmrc ifayile) iyayitsiba imibhalo ngexesha lokufakwa. Oku kunokubangela iingxaki kuba ukusebenzisa imibhalo kuqhelekile kwiindawo ezininzi ze-ecosystem: Abanye abaphathi beepakeji abavumeli nokuba kukhubaze ukwenziwa kwemibhalo (icebiso: nceda “Ngabaphi abaphathi beepakeji abangavumeliyo ukucima ukwenziwa kwezikripthi zokufaka?"kwi-AI yakho oyithandayo). Kodwa oku akukhuseli ngokubanzi (kufuneka siqinisekise ukuba uqwalaselo lwe-skip disable lukho kuyo yonke indawo).
Kwaye xa ukuziphatha okubi kungekho kwi-install scripts kodwa kwisoftware ekufuneka iphunyezwe ngexesha lokusebenza, olu khetho lodwa alusikhuseli.
Ingcamango engeyiyo #3: Ukufaka ii-version pinning kuthintela ukuba kufakwe izinto ezinobungozi
Kukho umahluko phakathi kokulungisa kwangethuba kunye nokulungisa rhoqo iinguqulelo ezivulekileyo (ukuvumela umphathi wephakheji ukuba afake ngokuzenzekelayo uhlaziyo olutsha xa lufumaneka ukuze kulungiswe ukhuseleko) kunye ukuphina inguqulelo (zinazo zonke ii-direct and transitive dependencies zesoftware kwi-fixed version). Imigaqo yokhuseleko ayinamandla kwaye ngamanye amaxesha iyaphikisana, njengoko kusenzeka kwi-"patch early, patch often" kunye "Ukuphucula akufanele kuthathwe lula". Abanye abaphathi beepakeji benza uhlaziyo oluzenzekelayo ngee-server ranges ngendlela ecetyiswayo. Kulungile ukuba ufuna ukufumana uhlaziyo olunobungozi! Ewe, iinxalenye kufuneka zihlaziywe ukuze kufumaneke ukulungiswa kokhuseleko okuvala ubuthathaka ngokukhawuleza, kodwa ... ungaze uvumele umphathi weepakeji enze oku ngokuzenzekelayo.
Ingcamango ephosakeleyo #4: Ukusebenzisa izinto ezithembekileyo kukhuselekile. Naluphi na uhlobo olunobungozi lunokufumaneka ngokukhawuleza, lutyhilwe kwaye lususwe.
Kutheni le nto ithembeke kangaka? Mhlawumbi kungenxa yokuba ithandwa kakhulu, uninzi lwabantu lukhangela ubuthathaka, inani elikhulu labantu abanikelayo ekugcinweni kwayo, kunye nabantu abaninzi abagcina izinto eziyimfuneko abahlola yonke into ngenkuthalo. pull requestsInyani yahlukile kakhulu. Ezinye izinto ezibalulekileyo zigcinwa ngumphuhlisi omnye, ongahlawulwayo. Iiframework ezisetyenziswa kakhulu ziye abambalwa abanikela rhoqo, kunye nenani elincipha ngokukhawuleza commits ngomgcini-mali ngamnye (iiprojekthi ezidumileyo zineenkampani ezininzi ezinikelayo ezenza ezinye izinto eziqhutywayo commit kwaye ungaze ubuye). Kwaye iiprojekthi ezidumileyo ezinomgcini omnye zininzi.
Khawuzithelekelele usithi "Owu, sisebenzisa imifanekiso yeSpring Boot / Angular / React / PyTorch / esemthethweni yeDocker, ngoko ke umngcipheko othetha ngawo uphantsi kakhulu." Mhlawumbi oko kuyinyani, thina bathengisi bezokhuseleko sisoloko sisoyikisa, kwaye ukuphazamisana namaqela ophuhliso ukuze kuncitshiswe umngcipheko onokuthi uxoxwe ngawo akunamsebenzi. Usenokuhendeka ukuba utsibele kwisiqendu sokwamkelwa komngcipheko (kwicandelo elilandelayo) uze ugqibe. Ngelishwa, ezona zinto zidumileyo zijoliswe kubenzi bobubi, kwaye umzekelo, abantu abadumileyo Ithala leencwadi lePyTorch lihlaselwe mandulo.
"Ifunyenwe ngokukhawuleza, yatyhilwa, yaza yasuswa". Kuthatha iintsuku ukuba icandelo elitsha elinobungozi lisuswe kwirejista kawonke-wonke. Iirejista zilumkile malunga nokususa inguqulelo yecandelo, okulungileyo. Amava ethu kukuba xa sele kuxeliwe kuthi, ixesha eliphakathi lerejista ukususa inguqulelo echaphazelekayo ziiyure ezingama-39, ngaphezulu kosuku olunesiqingatha. Kukho iicandelo ezinobungozi eziba yiveki emva kwengxelo yethu yokuqala kwirejista ngaphambi kokususwa. Kwaye kwezinye iimeko, icandelo lisuswa kuphela emva kokuba ixhoba okanye inkampani yokusabela kwisiganeko ibike isiganeko esibandakanya icandelo.
Yintoni Engasebenziyo Kwizinto Ezinobungozi
Nayiphi na indlela engacacanga iya kusilela kakhulu. Oku kuqinisekile, awuboneleli ngamanyathelo okulwa nomngcipheko onxulumene nale ngozi.
zeMveli SCA Izixhobo zikuxelela nge-malware eyaziwayo kodwa zinesithuba esikhulu sokubonakala. Ngaphandle kokuba zenza ukufunyanwa kwe-malware ngokunyanzelisa ukuvalwa kwezinto ezinobungozi, azisebenzi ngokuchasene nale ngozi.
Ukukhubaza izikripthi zokufakela kunokunceda kodwa kufuneka kunyanzeliswe kuyo yonke indawo apho kufuneka kufakwe khona icandelo. Kuyafana nangokufaka inguqulelo, njengoko iinguqulelo zingenakukwazi ukuphinwa ukusuka kwimeko yokuqala ekhuselekileyo ngonaphakade.
Ukucinga ukuba izinto ezidumileyo zifumana ingqwalasela eyaneleyo kangangokuba azinakufakwa kwisenzo esingacwangciswanga kuhlaselo lwe-supply chain ngaphandle kokufunyanwa ngokukhawuleza ukuthintela nawuphi na umonakalo kuyinto engenamsebenzi kwaye iyingozi. Awufuni ukuhlala usemngciphekweni, akunjalo?
Ukuba uyema kweli nqanaba, ngoko ke ukwamkelwa komngcipheko yinto ekuphela kwayo onokuyenza: Le yinto yokwenyanicisi-ion ekufuneka ibhalwe phantsi kwimodeli yakho yosongelo/uvavanyo lomngcipheko, kubandakanya isizathu sokwamkela umngcipheko kunye neziphumo zawo ezinokubakho. Yazisa ulwazi ngokwazisa abaphathi kunye namanye amaqela afanelekileyo ngayo. imeko engxamisekileyo isenokucwangciswa xa kufakwa icandelo elinobungozi okanye lifakiwe kwisoftware yakho, kodwa oku kunzima kuba abahlaseli baneendlela ezininzi ekufuneka bazilandele. Iinkcukacha zohlaselo lwe-supply chain olusekelwe ekusetyenzisweni kwecandelo elinobungozi ziya kutshintsha kakhulu ukutyhilwa koluntu ngesiganeko, mhlawumbi esiyimfuneko phantsi kwesakhelo solawulo sentlangano yakho. Ungajongana ne ulawulo lokuhlawula or umngcipheko wokudluliselwa umz. nge-inshurensi.
Nangona kunjalo, kukho iindlela zokulawula ezijongana nosongelo kwaye kufuneka ziqwalaselwe ukuba awonelisekanga kukwamkelwa komngcipheko. Nceda uqhubeke ufunda.
Yintoni Esebenza Ngokuchasene Nokuhlaselwa Ngokusebenzisa Izinto Ezinobungozi
Ukuphathwa kweNguqulelo eQinileyo
Ukucinezela iinguqulelo ngeenguqulelo ezilawulwayo nezinolwazi yindlela efanelekileyo, ukulinganisela isidingo sokususa ubuthathaka ngaphandle kokufumana i-malware. Kodwa khumbula impazamo #3: Ukucinezela iinguqulelo zodwa akwanelanga ukuvimba ikhowudi enobungozi evela kwiinguqulelo ezintsha, kuba kuya kufuneka kwixesha elizayo uhlaziye iinguqulelo kuyo nayiphi na indlela exhomekeke ngqo okanye ngokungathanga ngqo. Ngelo xesha udinga ubungqina obuqinileyo ngokwaneleyo ukuba zonke iinguqulelo ezilungisiweyo azinazo i-malware.
Isilumkiso kwangethuba
Enye indlela yokusombulula ingxaki yezinto ezinobuthi yinkqubo yokulumkisa kwangethuba (ebizwa apha ngokuthi Isilumkiso saKwangoko seMalware okanye i-MEW), apho iinguqulelo ezintsha ezipapashwe (zezinto ezintsha okanye ezikhoyo) zihlalutywa yinjini yokufumanisa, ethi xa kufunyenwe ubungqina obaneleyo ichaze inguqulelo entsha njengenokuba yingozi.
Ukwenziwa kwezinto ngokuzenzekelayo kubalulekile apha, njengoko kungenakwenzeka ukuphonononga ngesandla zonke izinto ezintsha ngesantya sokupapasha sangoku. Ngoko ke injini yokufumanisa kufuneka idibanise iindlela ezahlukeneyo, mhlawumbi kuquka uhlalutyo oluzinzileyo, oluguquguqukayo, kunye nobuchule, udumo lomsebenzisi, kunye nobungqina obuvela kukungangqinelani phakathi kwe-metadata yecandelo kunye nomxholo we-tarball, okanye phakathi kwe-tarball kunye nendawo yokugcina izinto apho kuthiwa icandelo livela khona.
Kukho i indawo emnyama phakathi kwexesha lokupapasha kunye nexesha injini ehlalutya ngalo umxholo wecandelo, kodwa akufuneki kudlule imizuzu embalwa. Inkqubo ingatshintshwa, umzekelo ngokulinda ukuba kuhlalutywe izixhobo ezintsha ngaphambi kokuba zivunyelwe ukuba zifakwe kwaye zisetyenziswe kwisoftware yokwakha. pipelines, okanye uzihlalutye xa zifuneka. Icandelo kwinguqulelo ethile aliguquki [3], ngoko ke kufuneka ihlalutywe kube kanye kuphela.
Akunakwenzeka ukuba i-automation epheleleyo isebenze, kwaye kufuneka kuhlolwe ukhuseleko lwezinto ezinokuba yingozi. Lumka kubantu abaxhasa i-digital panacea: I-AI kunye ne-Machine Learning aziphuhliswanga ngokwaneleyo ukuba zithathe igama lokugqibela xa kufikwa ekuqinisekiseni ukuba icandelo elirhanelwayo line-malware. Ewe, ukufunda koomatshini kudlala indima ebalulekileyo kwi-engine yokubhaqa ekuhleleni icandelo lokufaka kubungqina obungacwangciswanga obufunyenweyo, kodwa xa icandelo "livalelwe" igama lokugqibela likwi-manual review yiqela lokhuseleko elinamava kwizinto ezinobuthi. Oku kuqinisekisa nayiphi na i-malware enokubakho okanye ukuyihlela kwakhona njengekhuselekileyo. Kwaye ixesha likwi-hours range.
Irejistri inika ingxelo ngenguqulelo/icandelo elinobungozi; irejistri emva koko yenza uphononongo lwayo ukuqinisekisa kwaye iqhubeke nokutyhila esidlangalaleni kunye nokususa kwirejistri. Ezinye iirejistri zigcina iphakheji yokugcina ukhuseleko. Uluhlu lwexesha apha ziintsuku okanye iiveki ukusukela ekupapashweni, okuyi-'hlala ixesha'okanye'ifestile yokubonakalisa' kwinxalenye ezininzi ezinobuthi.
Ngaba kunokwenzeka ukwazi ukuba inguqulelo yecandelo inobungozi?
Ngoko ke ukuze silumkise kwangethuba, kufuneka sinike impendulo eyanelisayo kulo mbuzo: Ndingazi njani ukuba ithala leencwadi okanye iphakheji ayinabungozi? Ndingaqokelela njani ubungqina obaneleyo bokuziphatha okubi? Kunokwenzeka, kodwa kunzima, njengoko iintshaba zisebenzisa ubuchule obukhulu ukuze zingabhaqwa. Kukho iindlela ezahlukeneyo, nganye ineengenelo kunye neengxaki.
Uhlalutyo olusisigxina inokuhlola zonke iindlela zokuphumeza ukujonga iindlela ezisetyenziswa ngabahlaseli ngaphandle kokusebenzisa icandelo, kwaye yenze imisebenzi yokulungisa kwangaphambili efana nokususa i-obfuscation okanye ukutolika. Njengoko abahlaseli bezama ukufihla ububi babo, imizamo yokufihla ngokwenene bubungqina be-malware (kodwa qaphela ukuba izinto ezisemthethweni zifihla ikhowudi yokugcina impahla yengqondo, ziphikisana "Vula Umnikezi"). Zimbalwa kakhulu izihlaselo ezintsonkothileyo nezinobuqhophololo obunamandla ezifuna ukuphoswa kwisanti, kodwa ubuqhophololo obunjalo bubonisa ukuba kukho ububi. Nceda uqaphele ukuba ngokwesiqhelo SAST izixhobo zenzelwe ubuthathaka obungeyonjongo, kungekhona iinjongo ezimbi ezifana neengcango zangasemva.
Uhlalutyo olunamandla iqhuba icandelo kwaye ihlola impendulo ngokusebenzisa ixesha lokusebenza, ngesiqhelo ngokubonelela ngendawo enesanti. Ukuziphatha okubi okubangelwa phantsi kweemeko ezithile kunokudlula kungabonwanga: nceda uqaphele ukuba i-malware ingasebenzisa iindlela zokubaleka ezifana Ukwenziwa kwe-Virtualization/Ukuphepheka kwiSandbox ukusebenza kuphela xa kungekho phantsi kovavanyo, kunye nomqondiso obonisa ukuba kukho umsebenzi onobungozi kuyo nayiphi na injini yohlalutyo olungaguqukiyo.
Uhlalutyo lwezakhono Iqwalasela into eyenziwa yinxalenye: apho iqhagamshela khona, zeziphi iifayile efikelela kuzo, zeziphi imiyalelo okanye iinkqubo eziqhutywayo, isiphelo sendlela okanye isixhobo i-I/O esenziwayo, okanye zeziphi iifowuni zenkqubo ezibizwayo. Oku kufingqwa kweminwe yokuziphatha kunokuthelekiswa (kwinxalenye ekhoyo) kwiinguqulelo ezahlukeneyo, ngoko ke xa kufunyenwe ukuziphatha okungalindelekanga, olo bungqina lunokuphakamisa ukurhanelwa kwemisebenzi enobubi enokuthi ifakwe kwinguqulelo entsha. Le ndlela ilandela amanyathelo okulinganisa alandelwa ngabahlalutyi bokhuseleko xa bejongene ne-malware enokubakho: ukuhlolwa kusetyenziswa imida okanye izixhobo ezifanayo. Le ndlela ibona ukuziphatha okubi nokuba iimeko zithini kwaye isebenza xa kungekho khowudi yomthombo ekhoyo.
Uhlalutyo lomxholo iqokelela ulwazi malunga nendlela eli candelo elipapashwe ngayo kwaye ngubani. Iiphulo zabadlali abangalunganga zihlala zisebenzisa iakhawunti entsha yomsebenzisi engaxhomekekanga kwinkqubo yokuhlolwa ngokungqongqo. Ukulandelela imisebenzi edlulileyo kunokunika ulwazi ngomsebenzisi ongaphantsi, ikakhulu kwiimpazamo ezinokubonisa ukuba kukho isivumelwano esinokwenzeka. Udumo kunzima kakhulu ukulufumana kwaye kulula ukululahla! Umsebenzisi ongenamsebenzi wexesha elidlulileyo akanacala, kodwa i-karma ilandela ububi. Ama-Hacktivists, okanye abasebenzisi abaqhelekileyo ababiweyo iziqinisekiso zabo zokupapasha kufuneka balandelwe ngononophelo.
Olunye ulwazi oluhambelanayo lulo naluphi na ukungafani phakathi kwendawo yokugcina ulwazi ekuthiwa isetyenziselwe ukwenza i-component tarball kunye nomxholo we-tarball ngokwayo. Kwaye kulandelwa neendlela ezilungileyo, njengokudala iithegi okanye ukukhutshwa kwindawo yokugcina ulwazi ehambelana neenguqulelo zenxalenye epapashwe kwirejista kawonkewonke. Xa indawo yokugcina ulwazi kwindawo ethile commit iphawulwe ngokukhululwa, ize ngequbuliso enye inguqulelo ingaphumeleli ukuyilandela, loo nto yodwa bubungqina obuqinileyo bokuba icandelo linokuba lonakele: umenzi ombi usenokuba uchaphazele iakhawunti esetyenzisiweyo ukupapasha icandelo, kodwa akanazo iimvume zokubhala kwindawo yokugcina ikhowudi yomthombo). Uhlaselo oluninzi lufunyanwa rhoqo kusetyenziswa le mithetho: umzekelo, Uhlaselo lweLedger inokubonwa lula ngale ndlela. Uhlalutyo lomxholo, ke ngoko, luchonga ezo zinto zingaqhelekanga kwinkqubo yokupapasha.
Ukucima umlilo ngokuxhomekeka
Indlela eyahlukileyo kukuba noluhlu olupheleleyo lwezinto ezifunekayo kuzo zonke iigrafu zokuxhomekeka ezisetyenziswa kwisoftware yakho, ngoko ke kuyo nayiphi na into yokwakha. pipeline Sebenzisa umbutho wakho kuphela kwiinguqulelo zecandelo ezivunyiweyo ezinokufakelwa kwaye zisetyenziswe.firewall"iyasebenza kusetyenziswa irejista yangaphakathi apho ii-tarball zeenguqulelo zecandelo ezivunyelweyo zikhonzwa (zigcinwe okanye zifakwe kwi-proxied). Nceda uqaphele ukuba naluphi na uluhlu olumhlophe aluyi kusebenza ngaphandle kokuba uneteknoloji yokwahlula naluphi na uhlobo olutsha njengolukhuselekileyo ukuze longezwe kuluhlu olumhlophe.
Nceda uqaphele ukuba isilumkiso sangethuba (ukufunyanwa ngokukhawuleza emva kokupapashwa kwenguqulelo entsha) kufuneka sidityaniswe nendlela ethile yokusebenzisa olo lwazi ngendlela ekhawulezileyo ukuthintela icandelo elichaphazela ulwakhiwo. pipelineokanye oomatshini babaphuhlisi [4]Oku sikubiza ngokuba “ukucima umlilo ngokuxhomekeka": indlela yokuvalelwa kwabantu abakhubazekileyo yokukhusela izakhiwo ezizenzekelayo kwiipakeji ezinobungozi. Iipakeji zangaphakathi kunye neerejista zemifanekiso zilungile ukuzikhusela kwimibutho ebubini bangaphandle, kodwa ubungqina obuqinileyo buyimfuneko ukwenza ukuvalelwa kwabantu kube yimpumelelo.
I-Runtime Sandboxing
Enye indlela yokufumanisa ngexesha lokupapasha kukuhlalutya indlela yokuziphatha ngexesha lokusebenza. Ingcinga kukubamba indlela yokuziphatha elindelekileyo kwisoftware kunye nokufumanisa (okanye ukuvimba) naziphi na izinto ezingaqhelekanga ezifunyenweyo. Olu luhlu lwezenzo lunengxaki yokubeka iliso okanye ukuvimba ixesha lokusebenza, kwaye yingcinga ethembisayo eya kongezwa kwizixhobo zokukhusela ngokuchasene nezinambuzane ezinobungozi.
Ukubeka iQhinga eliBanzi
Icebo elicetyiswayo kufuneka lidibanise iindlela ezahlukeneyo kwinkqubo yophuhliso lwesoftware, lithathe ulawulo lohlaziyo lwenguqulelo ukuthintela izinto ezingenayo ezinobungozi. Kufuneka sivumele ukuphina kwenguqulelo ukuze siphephe ukosuleleka ngokuzenzekelayo ngokuhlaziya iinguqulelo ukuze sifumane izilungiso zobuthathaka obubalulekileyo; uvavanyo olukhawulezileyo nolusebenzayo lokuxhomekeka ngokuthe ngqo nangokungathanga ngqo ngexesha lohlaziyo lwenguqulelo ukuze kubekho ubungqina obaneleyo bokuba azinazo ii-malware. Ulwakhiwo lwesoftware oluxhomekeke kwizinto ezinobungozi ezaziwayo kufuneka luvalwe. Kwaye zonke kufuneka zinyanzeliswe.
Sebenzisa ukuphina kwenguqulelo, xa kunokwenzeka, njengoko kwenza ukwakhiwa kube lula ukuphinda kusetyenziswe. Ukufaka ii-version pinning kunye nee-version bumps ezilawulwayo nezivunyiweyo ngesandla, yaye ndincediswa yitekhnoloji yokuncedisa, kufuneka ihlole ukuba uhlaziyo luzisa i-malware okanye luyaphula isoftware, kwaye ilungelelanise uhlaziyo lokulungisa ubuthathaka kunye nokuphepha ukosuleleka yi-malware. Izixhobo zinokunceda apha, ngokuthi (1) zibeke phambili ukuba zeziphi ubuthathaka ezibalulekileyo (ezinokufikeleleka nezinokuxhaphazwa, ezinomngcipheko omkhulu wokujoliswa ngabahlaseli), (2) zikhethe iinguqulelo ekujoliswe kuzo ezihambelana nokusetyenziswa kwamacandelo angoku kwaye ezingaphuli isoftware, (3) zikhethe iinguqulelo ekujoliswe kuzo ezingenazo iindlela zokuziphatha ezinobungozi, kunye (4) zenze uhlaziyo lwenguqulelo yokuxhomekeka ngokuthe ngqo nangokungathanga ngqo lube mfutshane, ngokucebisa utshintsho kwiifayile ze-manifest ezinokwamkelwa ngokukhawuleza. Inyathelo (3) lifuna ulwazi oluthile malunga nezixhobo ezinobungozi kufutshane nexesha lazo lokupapasha kangangoko kunokwenzeka.
Le nkqubo yokuhlaziya ukuxhomekeka kufuneka nya nzeliswa kwaye qi nisiwe kuzo zonke iindawo. Inkqubo kufuneka ibhalwe phantsi, kwaye onke amaqela abandakanyekayo kufuneka aqeqeshwe, njengoko rhoqo uphuhliso kunye nokwakhiwa/ukusasazwa kwesoftware kuye kukhutshwe ngaphandle. CI/CD pipelines kufuneka iguqulwe ngokufanelekileyo, ngoko ke ukuzenzekela akuvumeli ukuxhomekeka okungathanga ngqo okunobungozi ukuba kungene kwisakhiwo: guardrails Ukuthintela ulwakhiwo ukuba kukho ubungqina obaneleyo bokuba kukho i-malware enokubakho kwi-dependence yindlela ecetyiswayo.
Ukuba umbutho wakho unerejista yangaphakathi esebenza njengommeli wokhuseleko wokugcina iinguqulelo zecandelo ezivunyelweyo, kufuneka ufumane ulwazi malunga nezixhobo ezinobungozi (ngaphandle kwezinye iindlela) zokuvavanya icandelo eliceliweyo ngaphambi kokuba ulongeze kuluhlu lwezibonelelo.
Ukusebenzisa isoftware evulelekileyo ngokhuseleko akulula, kwaye umba we-malware kufuneka uqwalaselwe ngokupheleleyo, kunye nomzamo ofanayo owenziwe ekusingatheni ubuthathaka.
Inqaku lokugqibela: Imvelaphi yomthombo, ngohlobo lwe-software attestations, ezenziwe ngexesha lokwakhiwa kwe-component, yenye into ebalulekileyo kumzamo wokulandelela i-artifact (component tarball) kunye ne-sources kunye ne-build producted process. Qaphela ukuba olu nxibelelwano phakathi kwe-source snapshot + build environment kunye ne-software artifact edibeneyo (esayinwe yi-trust build system) aluthinteli ukuba i-component ayinayo i-problem behavior, kodwa yenza kube nzima kubantu ababi ukufaka i-malware. Kwaye ukwenza i-provenance validation ibe yimfuno eqhelekileyo yokusebenzisa i-open source components kuya kuthatha ixesha elide, kwaye kuphela. kutshanje kongezwe kwi-NPMUkwenza ezo nkqubo zithembekileyo zokwakha nokusasaza zingaphazanyiswa, okanye ukuvumela ukufunyanwa kwanoma yikuphi ukuphazamiseka kwisakhiwo libali elahlukileyo, elingaphaya komxholo wale posi.
Ukufunda okuqhubekayo
Isiqendu esilandelayo Iipakeji Ezinobungozi Zomthombo Ovulekileyo: Indlela yeXygeni siza kubonisa icebo esililandelayo eXygeni lethu Isilumkiso saKwangoko seMalware Inkqubo (MEW). Iinguqulelo ezintsha zephakheji kwiphakheji kawonkewonke kunye neerejista zemifanekiso ziyaskenwa kwaye ubungqina bufunyanwa kusetyenziswa indibaniselwano yohlalutyo oluzinzileyo, oluguquguqukayo, olunezakhono, kunye nolweemeko. Ubungqina, obudityaniswe nodumo lomsebenzisi kunye nembali yotshintsho kwiindawo zokugcina ikhowudi yomthombo, buvumela ukuhlelwa ngokuzenzekelayo kwecandelo libe ziindidi ezinomngcipheko ophezulu kwaye mhlawumbi ezinobubi. Inkqubo ifunda kubungqina bangaphambili obuqokelelwe kwiiphakheji ukunciphisa iziphumo ezingezizo ezilungileyo zibe zincinci.
Imibutho ebhalisiweyo ifumana isaziso sesilumkiso sezinto ezizisebenzisayo, ngokuthe ngqo okanye ngokungathanga ngqo, xa inguqulelo enobungozi ihlelwa ngokwamaqela. Emva koko uhlalutyo lwenziwa ngesandla ngabahlalutyi bethu, oluqinisekisa okanye olulahla udidi. Kwi-malware eqinisekisiweyo, irejista kawonkewonke iyaziswa ukuze ikwazi ukwenza uhlalutyo lwayo kwaye iqhele ukususa inguqulelo enobungozi okanye ithathe amanyathelo ongezelelweyo, njengokuvala okanye ukususa iakhawunti yomsebenzisi ekuthethwa ngayo.
Siza kuchaza indlela esinceda ngayo i-NPM, i-PyPI, i-GitHub, kunye nezinye iziseko ezibalulekileyo kwinkqubo ye-open source ukunciphisa ixesha lokuhlala apho icandelo elitsha elinobungozi elishicilelweyo lihlala lisebenza de liqinisekiswe ukuba liyi-malware kwaye lisuswe kwirejistri. Kwaye indlela imibutho enokuzuza ngayo kwinkqubo ye-MEW ukuze ibe nokhuseleko olungcono kakhulu kuhlaselo lwe-software supply chain olubandakanya icandelo le-open source.
- [1] Nokuba kunjalo, abasebenzisi becandelo kufuneka bajonge ukuba i-component tarball igcinwe kwi-cache okanye ibhalisiwe ndaweni ithile, umzekelo kwirejista yangaphakathi, ukuze esi sifo sipheliswe.
- [2] Icandelo elipakishiweyo liquka i-manifest echaza umxholo wayo kunye ne-metadata, ikhowudi yomthombo okanye eqokelelweyo, izikripthi zokufakela, kunye nezinto ezongezelelweyo ezifana nee-test suites, ngokwefomathi yokupakisha kwaye ngokuqhelekileyo kwimo ecinezelweyo. Oku kubizwa ngokuba yi-"component tarball".
- [3] Nokuba umenzi wobubi angatshintsha icandelo elipapashiweyo ngenxa yokwaphulwa kwerejista ngokwayo, i-cryptographic digest endala ingabona naluphi na utshintsho kwi-tarball emva kokuba uhlalutyo lwenziwe.
- [4] Khumbula ukuba ezinye izinto ezinobuthi zisebenza ngexesha lokufakwa, ngoko ke zinokuchaphazela iindawo zabaphuhlisi abasebenzisa ngokungazi "npm install X" kunye ne-X into enobuthi.
