Esiqeshini esidlule, Amaphakheji Anobungozi Omthombo Ovulekile: Inkinga, sixoxe ngokuthi kungani abenzi bezinsongo babenjalo kangaka ngishisekela ukushicilela izingxenye ezintsha ezinonya noma ukufaka i-malware ezinguqulweni zakamuva zezingxenye ezikhona: Ingqalasizinda yomthombo ovulekile ivumela noma ubani noma kuphi ukuthi adale i-akhawunti yesikhashana kurejista yezingxenye (njenge-NPM, i-PyPI, i-Docker Hub noma i-Visual Studio Marketplace) noma ipulatifomu yokuthuthukisa ngokubambisana (njenge-GitHub). Akukho zindleko, kanye namathuba amaningi okusebenzisa ukwethenjwa okweqile amaqembu esofthiwe anakho ngokuvamile ezingxenyeni zezinkampani zangaphandle.
Ukungalingani phakathi kokuthi kulula kangakanani ngabahlaseli ukusabalalisa i-malware besebenzisa ingqalasizinda etholakalayo yomthombo ovulekile, nokuthi kunzima kangakanani ngezinhlangano ezithuthukisa isofthiwe (wonke umuntu?) ukugwema ukutheleleka yi-malware (nokuletha i-malware kusofthiwe abayisabalalisa kwabanye), kwaholela ekutheni kube nophawu lwesigamu sesigidi lwamaphakheji anonya olucishe lwafinyelelwa ngonyaka odlule.
Lena inkinga enkulu kangangokuthi ayikho inhlangano eyodwa engayixazulula, futhi umphakathi usenqubweni yokushintsha inqubo yomthombo ovulekile maqondana nokwethenjwa, izimiso zokuvikela ngokuzenzakalelayo kanye nokuvikela ngokuklama, kanye nomjikelezo wokuphila kwezingxenye. Sizobheka imibono enjalo esiqeshini esilandelayo. Ukuvikela Amaphakheji Anobungozi Omthombo Ovulekile: Yini Engasebenzi (Engasebenzi).
Khumbula ukuthi sikhuluma ngezingxenye zesofthiwe ezihambisana nazo isikhathi esiningi amaphakheji wesoftware: izingxenye ezingasetshenziswa kabusha ezipakishwe ukuze zibhekiselwe njengokuncika ku-manifest yesofthiwe, futhi zifakwe nomphathi wephakheji noma ithuluzi lokwakha. Sicela uqaphele ukuthi leli cala lingandiswa ukuze lifake phakathi umphakathi izithombe zesitsha (kusetshenziswa ngezikhathi zokusebenza kweziqukathi kanye namapulatifomu okuhlanganisa njenge-Kubernetes), kanye izandiso kumathuluzi esofthiwe (kokwakha, ukuzenzakalela, kanye nokusabalalisa).
Lapha sihlaziya ukuthi lokhu isu lokuhlasela elisekelwe ezingxenyeni ezinonya iyasebenza, ngokwezibonelo zangaphambilini nalokho esikubonile epulatifomu yethu ye-Malware Early Warning (MEW). Sizohlaziya izingxenye ezinonya ngezindlela ezahlukene:
(1) indlela ekhethiwe yokusabalalisa (irejistri esetshenzisiwe, engxenyeni entsha noma ekhona, kanye nendlela esetshenziswayo yokutheleleka inguqulo yengxenye eshicilelwe), (2) indlela i-malware esebenza ngayo noma evuselelwa ngayo, (3) ukuziphatha okunonya okungukuthi yiziphi izenzo ezilimazayo ezibonwayo nokuthi yisiphi isisusa somhlaseli, (4) yiziphi izindlela ezivamile zokufiphaza, ukufihla ukuze kungabonakali, ukunyakaza okuseceleni, ukuxhumana nabasingathi bomyalo nokulawula (C2), njll.; kanye (5) amasu okuthola ukuthandwa nokwethenjwa okwanele ukuze izisulu zigcine zifake ingxenye.
Indlela Yokusabalalisa Ekhethiwe
Sibona “umsindo wangemuva"yamaphakheji anonya angenaso isiko asebenzisa ukubhala phansi ukuze athole ulwazi oluyimfihlo kunjiniyela abangaqaphile abanephutha lokuthayipha egameni lephakheji ngenxa yokuthembela kwabo. Amaphakheji amaningi athandwayo athola uhlu lwamaphakheji aqanjwe ngendlela efanayo anamaphutha okuthayipha, ngokulindela ukuthi azothola ulwazi oluyimfihlo kunjiniyela abangaqaphile.
Basebenzisa i-akhawunti yesikhashana, bashicilele iqembu lamaphakheji okubhala, badale elinye, futhi bashicilele elinye iqembu… Besebenzisa okuzenzakalelayo kanye nobuhlakani bangathola ubuhlakani, kodwa ngokuvamile abulutho. Sibabiza ngaphakathi ngokuthi “ama-anchoviesUkwebiwa kweziqinisekiso kuwumgomo oyinhloko, kodwa ngezinye izikhathi sithola i-spyware ikhipha ikhodi yomthombo noma idatha ebucayi njengolwazi oluhlonza umuntu (PII), ukubanjwa kwebhodi lokunamathisela, nokunye ukungabaza.
Uma sibheka nje, sibona izingxenye ezinonya eziyinkimbinkimbi kakhulu, “oshaka”. Idlanzana libhekiswe emaqenjini noma ezinhlanganweni ezithile, ngokuvamile ezinama-drainers e-crypto noma ama-web skimmers asebenza ngokwemibandela, mhlawumbe ngokulandela indlela ebonwe ku- isigameko sokusakaza umcimbi yokususa ukubethela umthwalo wokuhlaselwa kuphela uma iphakheji ibhekiselwa kuphakheji eqondiwe.
Indlela yokusabalalisa ihlaziywe ephepheni elihle kakhulu futhi manje elidala, “Iqoqo Lommese KaBackstabber: Isibuyekezo Sokuhlaselwa Kwe-Open Source Software Supply Chain", okuyinto okumele uyifunde. Ngokuqinisekile uke wayibona le shadi elihle ngaphambili:
Zonke izindlela zahlolwa, kufaka phakathi amaphakheji amasha nakhona; okuthinta ikhodi yomthombo, uhlelo lokwakha, noma ingxenye epakishiwe ngokwayo; kusetshenziswa iziqinisekiso ezibiwe noma ubunjiniyela bezenhlalo; ukuthumba ama-akhawunti ashiywe dengwane kanye nezindawo zokugcina noma ukufaka ubuthi kulezo ezigciniwe. Ezinye izihlaselo zathola amagama (Ukuthayipha, Ukudideka Kokuthembela, Ukudideka Okubonakalayo, Ukuphinda usebenzise i-jacking.njll.) futhi sekuxoxwe ngakho kwenye indawo.
Kuthiwani ngamarejista akhethiwe?
I-NPM iyaqhubeka nokuhola enanini eliphelele lamaphakheji anonya, kodwa sibone ukwanda okukhulu kusukela kulo nyaka ku-PyPI. I-Python iyindawo ethandwayo yesayensi yedatha kanye nokufunda komshini. Eqinisweni, ubuningi be-malware manje buphakeme ku-PyPI kunaku-NPM.
Indlela i-malware eqala ngayo
Amaphakheji anonya aqala ngesikhathi sokufakwa ezimweni ezine kweziyi-10 kuphela (eminyakeni yamuva nje ayecishe abe yi-6 kweziyi-10). Okunye kusebenzisa ukuziphatha okunonya ngesikhathi sokusebenza, kanti okukodwa kweziyi-100 kuqale ngesikhathi sokuhlolwa. Kubonakala sengathi izitha ziyazi ukuthi ukwenziwa okungalawulwa kwezikripthi zokufaka kukhutshaziwe ezindaweni eziningi.
Yini abantu ababi abayitholayo?
Sizobala izigaba zokuziphatha okunonya, okuthandwa kakhulu kuqala. Sicela uqaphele ukuthi umthelela ungahluka kakhulu: a wiper kuyabhubhisa ngenkani, kodwa akuvamile futhi kubonakale ezimweni ezimbalwa kuphela, okuhlobene nemikhankaso yempi ye-inthanethi eqondiwe noma i-hacktivism enonya. Izigaba ezilandelayo zivamile impela:
- Infostealer / Credentials Draner. Okuvame kakhulu, ukuhlasela okungaphezu kuka-90% okungaqondakali kungabantu abantshontsha kalula abafuna iziqinisekiso ezifana namaphasiwedi, amathokheni okufinyelela, okhiye be-API, kanye nokhiye abazimele (be-SSH nokunye okunjalo). Cishe kulula kakhulu ukubhala (kanye nama-wiper?). Bala amafayela/izincwajana ezaziwayo kanye neminye imithombo (isb. okhiye bokubhalisa), bapakisha okuqukethwe, bese bethumela leyo datha kuseva ye-C2. Umqondo ulula: “Ngishicilela i-stealer yeziqinisekiso zobugebengu bokweba imininingwane, ngakho-ke ngingasebenzisa kamuva iziqinisekiso ukuze ngiqalise ukuhlasela okuqondisiwe”.
Ukuxhumana kwe-C2 okubonwayo ngokuvamile kushibhile futhi kungcolile, njengeziteshi zeTelegram noma amathuluzi okufaka umhubhe afana ne-ngrok (ngokuvamile ngesimo sama-proxies abuyela emuva avezwe ngama-IP e-VPN egress). Kunamakhulu (!) amathuba, kanye namaphrojekthi amaningi e-GitHub ngaphansi kwe- isihloko sokweba amaphasiwedi. Ubuchwepheshe obufana nama-keylogger abuvamile kumaphakheji anonya nezithombe zesitsha, kodwa buvame kakhulu kuzandiso zamathuluzi, lapho kulindeleke khona ukusebenzisana komsebenzisi.
- I-Dropper / Umlandi. Esesibili ngokuthandwa, ngokuvamile siza kuqala ekuhlaselweni kwezigaba eziningi. Izingxenye ezingaphezu kweyodwa kwezintathu ezinonya zinama-dropper (uma umthwalo okhokhelwayo ononya ufika ufakiwe ngaphakathi kwephakheji) noma abalandi (umthwalo okhokhelwayo ulandwa kusuka endaweni yokugcina ngaphansi kokulawulwa komhlaseli). Umthwalo okhokhelwayo uvame ukuba uhlobo lwe-malware oluyi-binary olwaziwayo, futhi luqhutshwa futhi ngezinye izikhathi luqhubeka, lokufaka iminyango yangemuva, i-spyware, ama-drainers e-crypto, kanye nezinye izimo zokusetshenziswa. Umthwalo okhokhelwayo olandiwe noma osetshenzisiwe uqala ukuhlasela kwesigaba sesibili ngawo wonke amandla anikezwa yi-malware binary ekhona. Ama-binary angasatshalaliswa ngaphakathi kwephakheji, avame ukufihlwa njengezithombe noma izinhlobo zamafayela okuthiwa azinangozi, ukuze kugwenywe ukutholakala ngenkathi kuxhunywa kumasayithi angalindelekile.
- Abantshontshi be-Cryptocurrency / AbavukuziIzitha ezishukunyiswa ngokwezimali zizimisele ukusebenzisa izimpahla zakho zamafu ukuze zisebenzise ama-cryptominers (zize zithole ukuthi asebenza ku-VM yamafu). Azinandaba nokuthi isilinganiso senzuzo ephansi u-$1 kuwo wonke u-$53 okhokhiswa isisulu ngengqalasizinda yefu eyebiwe. Izisulu zingase zingazi ngalokhu kuze kube yilapho zithola ibhili elingalindelekile. Ngenhlanhla, lokhu kuyafika futhi kudlule. I-Cryptojacking imikhankaso emaphaketheni anonya iyavela ngezikhathi ezithile bese iyanyamalala, iphishekele abasebenzisi be-wallet noma ekugcineni iqondise kumhlinzeki we-wallet, njengaku- Ukuhlaselwa kwe-Ledger.
Ezinye izindlela zokuziphatha, njengokusebenzisa i- emuva Ukusetshenziswa kwekhodi ekude ngokuvula igobolondo elibuyela emuva akujwayelekile manje kunasesikhathini esidlule. Isibonelo, i- 123rf_contributor_web iphakheji (manje esusiwe kurejista) ivula ngaphandle kokufihla igobolondo eliphambene elikopishwe futhi lanamathiselwa kusuka ku- Ishidi Lokukhohlisa Elibuyela Emuva Le-Shell:
Ngaphezu kwezingxenye ezisemthethweni nezinonya, sibone ukuxhashazwa okuningana, okuhlanganisa:
Amaphakheji ogaxekile
Kunezinkulungwane zamaphakheji amancane, ikakhulukazi ku-NPM, angenayo i-malware kodwa athembisa ukuthola imali elula, uwoyela wenyoka, izixhumanisi ezinikezwa yi-Viagra, nakho konke lokho. Abasebenzisi abambalwa bashicilela ugaxekile onjalo futhi bathatha i-bandwidth eningi kurejista. Omunye umdlali (abadlali) okungenzeka ukuthi uvela e-Indonesia wazama ukuthola inzuzo ngo ukusebenzisa kabi i-teaRank okuhloswe ngakho ukunxephezela onjiniyela bemithombo evulekile, ngokudala amashumi ezinkulungwane zamaphakheji e-NPM ahlobene anezindawo zokugcina ze-GitHub ezingezona ezeqiniso. Lokhu kuwukwephulwa okusobala kwemigomo yokusebenzisa.
Amaqhinga ocwaningo lwe-bug bounty kanye nezokuphepha
Uma iphakheji izichaza njengokukhipha idatha ngezinjongo ezinhle, njengokuthola amaphutha okuphepha kwezinhlelo zokukhokha amaphutha noma ukucwaninga izici ezithile ze-ecosystem. Sibone izinkulungwane zamaphakheji kulesi sigaba, alanda ukuhlonza kodwa hhayi idatha ebucayi kakhulu ekhelini le-Burp Collaborator elivela ku-PortSwigger (isb. i-host kusizinda se-oastify.com). Sivame ukubona ama-copycats e- Ukudideka Kokuthembela ubufakazi bomqondo ngu-Alex Birsan, njenge- i-aurora-webmail-pro iphakheji (isusiwe kurejista), evele isebenzise le khodi embi kuskripthi sokufaka ngaphambi kokufaka:
Futhi kufakwe "Lokhu kuwubufakazi bokuthi uthembele kalula ekuhlaselweni kokudideka komqondo"Incazelo yokuzikhulula ku-" iphakethe.jsonLokhu kuwukwephulwa okusobala kwemigomo yesevisi, ngisho noma kungekho nhloso embi.
Izindaba ezinhle? Asikakuboni (okwamanje) ukuhlaselwa kwe-ransomware okulethwa ngezingxenye ezinonya. Ngezizathu ezingaziwa, izigebengu ze-inthanethi zibonakala zikhetha izindlela zokuthumela i-imeyili ezivamile, ezisekelwe ku-RDP, kanye nezindlela zokulethwa kokulanda nge-drive-by.
Amasu Engeziwe Aqashelwe
Kwasetshenziswa amasu amaningi ukuze kuqhutshekwe nokuphikelela, ukugwema ukuzivikela, ukuqoqwa kolwazi, ukuxhumana nabaphathi bezokulawula kanye nokukhipha izikhali.
ukuphikelela Kuzingxenye ezinonya kutholakala kusetshenziswa izici zokuphikelela ku-malware yesigaba sesibili se-binary, kodwa ngezinye izikhathi ukuziphatha kutholakala kukhodi yephakheji, kanti imisebenzi ehleliwe kanye nezinguquko kurejista ye-Windows zivame kakhulu.
Ukubanjwa kuvamile, kodwa akunazo izincazelo ezicacile. Amaphakheji amaningi okubhala (khumbula "ama-anchovies"?") abasebenzisi i-obfuscation nhlobo; abaningi basebenzisa ama-smallly (base64/hex encoding noma ama-substitution ciphers afana ne-rot13) noma basebenzisa ama-code obfuscators kanye ne-minification etholakalayo, okuguqulwa kalula ngethuluzi elifanele. "Oshaka" kuphela abenza i-real, hard-core, obfuscation, hard to reverse-engineer.
Ukufiphaza kungafihla ukuhlaselwa, kodwa kungani ikhodi engxenyeni yomthombo ovulekile ingadinga ukufiphaza? Ingabe kukhona ubufakazi bokuthi kukhona okudingeka kufihlwe ekubonakaleni okusobala? Sithole izibonelo eziningi zamaphakheji angenabungozi asebenzisa ukufiphaza ukuvikela impahla yobuhlakani, okuphikisana "nomthombo ovulekile". Ukufiphaza kungasetshenziswa njengobufakazi be-malware, kodwa akuqinisekisi. Kunzima futhi ukususa ukufiphaza.
ukugwema kusukela ekulawulweni kwezokuvikela kusebenzisa amasu alula. Ikhodi enonya ivame ukuvikelwa ku zama ... ukubamba amabhlogo anganaki noma yikuphi okuhlukile, ngakho-ke umsebenzi ongajwayelekile awuboniswa kumalogi. Ukuqinisekiswa kwendawo (okusebenza ku-VM noma esitsheni) akuvamile, ngaphandle kokuthi i-malware ihlose inhlangano noma indawo ethile.
Ukufihla izithombe ezimbili ezithombeni nakumafayela e-PDF (uhlobo lwe-steganography) kwakungenye indlela ebonakala ivikela ukutholakala.
Njengoba izingxenye eziyingozi ezivame kakhulu ziyizinto ezintshontsha ulwazi, ukuqoqwa kwemininingwane kubalulekile. Izimfihlo (amaphasiwedi, amathokheni okufinyelela, okhiye be-API, okhiye be-cryptographic) ziskenwa njalo kumafayela elogi, eziguquguqukayo zemvelo, ngisho nebhodi lokunamathisela (libonakala ngama-trojan asebhange kanye nabantshontshi be-crypto). Ukukhishwa kwekhodi yomthombo nakho kuvamile, njengoba ukufakwa kwephakheji kuvame ukwenziwa endaweni yokuthuthukiswa lapho ama-repository angaphakathi e-git angase ahlanganiswe khona. Sibone amaphakheji ebala iziqondisi efuna ama-repository e-git. Ukufuna izindawo ezifana ne-.env, private.pem, settings.py, app.js, noma application.properties kuvamile kakhulu.
Ukukhipha okunye kuyisenzo esisetshenziswa kabanzi. Amaphakheji ambalwa kuphela anonya azama ngisho nokufihla indawo lapho idatha ekhishwe khona. Iziteshi ze-Telegram kanye imigudu efana ne-ngrok zivame ukusetshenziswa. Futhi kunezinhlobo eziningi ama-domain ngokuvamile avunyelwe ukusetshenziswa ekuhlungeni.
Amanye amasu, njengokwenyuka kwamalungelo noma ukunyakaza okuseceleni, ayengavamile.
Ukuthola Ukuthandwa Nokwethenjwa
Cabanga ngesela lobuchwepheshe elinomuntu obulalayo ozenzile kakade ozibuza ukuthi: “Ngingalenza kanjani leli qeshana libe elithembekile kulezo ziwula ezingalindelekile?”.
Lokho kuchaza indlela yokufaka ingxenye enonya ukuze ibonise izinkanyezi/amafoloko amaningi (ukuze ithandwe), kanye nezinguqulo/izinkinga kanye pull requests (yomsebenzi). Umqondo uwukuthola ukuthandwa okungelona iqiniso (izinkanyezi) kanye nabantu abaxhomeke kukho, kanye nokubukeka okukholisayo mayelana nokufaneleka kanye nokugcinwa.
Irejista ayihloli ukuthi okuqukethwe kuphrojekthi ye-GitHub nokuqukethwe kwephakheji kuyafana yini. Lena inkinga eyaziwayo eketangeni lokuhlinzekwa kwesofthiwe. Amarejista omphakathi ayimigodi emikhulu egwinya konke okuphonswa kuwo. Ungaxhumanisa noma iyiphi indawo yokugcina idatha.
Uma iphutha lokubhala ngephutha lephakheji elinonya lihlala lidumile, kulula lokho: vele ubhekisele endaweni yokugcina i-GitHub ekhona ku-manifest esetshenziswa ekudaleni iphakheji nokuyishicilela ebhukwini. Kumaphakheji amasha ku-repo ye-GitHub engamanga, ungadinga ubuhlakani obengeziwe, mhlawumbe udale i-fake ukubuka izinkanyezi/ukufaka imfoloko Ama-akhawunti e-GitHub ngokusebenzisa iskripthi.
Futhi uma okuqukethwe kwephakheji yakho kufana kahle ne-repo, faka izinguquko ezimbalwa eziklanywe kahle lapha nalaphaya… Ungafaka i-malware yakho kuphakheji entsha efana nethandwayo ebhekisela endaweni yokugcina ekhona, bese ulinda amaphutha okubhala. Uma noma ubani enesibindi sokuqhathanisa okuqukethwe kwe-tarball yephakheji nokuqukethwe okuvela endaweni yokugcina ye-GitHub, umehluko ezindaweni zokujova i-malware ungaphuthelwa kalula. Sesibonile le ndlela izikhathi eziningi ngaphambili.
Indlela yokuthi ingxenye ethile yenze isitatimende esingaphazamiseki mayelana nemvelaphi, ukuthi iphakheji yakhiwe kanjani, ivela emithonjeni emiphi, futhi ngobani, eyamukelekayo. Kodwa leyo indaba ehlukile.
Ingabe i-component X iyi-malware?
Ingabe ikhona isizindalwazi (esibanzi) samaphakheji anonya? Cha. Ubuthakathaka bomthombo ovulekile bune-CVE ID enikeziwe, kodwa amaphakheji ambalwa anonya kuphela (ikakhulukazi lawo enza izihloko) anikezwa wona. I-CWE yamaphakheji anonya yi CWE-506 (ikhodi enonya efakiwe).
Amathuluzi avamile e-malware (i-VirusTotal, i-MalwareBazaar, i-SOREL-20M…) awenzi amalungiselelo aqondile ezingxenyeni ezinonya. Lokho kungamukeleka!
Kunezinqolobane zedatha zesampula zocwaningo kanye namasethi edatha okuhlaziywa (sisebenzisa ambalwa awo), kodwa okufakiwe kubuyekezwa kuphela uma iphakheji enonya yaziwa, okuvame ukuba sekwephuzile kakhulu. Uma unesithakazelo, i- OpenSSF Amaphakheji Anonya kuyisiqalo esihle.
Esihlokweni esilandelayo, sizoxoxa ngendlela yokwazi ukuthi iphakheji ethile inonya yini. I-Spoiler: yebo, kunezindlela zokuhlola izingxenye ezinonya kusenesikhathi ngesikhathi sokudalulwa, ngaphambi kokuba irejista isuse ingxenye enonya eyaziwayo.
Ukufundwa Okwengeziwe
Esiqeshini esilandelayo “Ukuvikela Amaphakheji Anobungozi Omthombo Ovulekile: Yini Engasebenzi (Engasebenzi)" sizoxoxa ngezinto okufanele zenziwe kanye nezinto okungafanele zenziwe ukuze kuvikelwe umthombo ovulekile. Ochwepheshe abaningi abaqaphela ukuphepha banemibono yokuthi bangabhekana kanjani nalolu songo, kodwa imibono eyiphutha iyanda.
Sizobuyekeza ukuthi kungani le mibono ingalungile, nokuthi imibono enjalo eyiphutha inegalelo kanjani ekuthandweni kwale ndlela yokuhlasela, kanye nengozi enkulu izinhlangano ezibhekene nayo. Sizoqhubeka nalokho okusebenzayo, nokuthi yimuphi umzamo nezinsiza ezihilelekile.
Futhi, sizothumela ngokuvela kwamaphakheji anonya ngokwenhloso yawo, indlela yokujova, kanye namasu okuhlasela.
Hlala ubukele!
Okubhekwayo
- Amaphakheji Anobungozi Omthombo Ovulekile: Inkinga, isiqephu sangaphambilini kulolu chungechunge.
- Iqoqo Lommese KaBackstabber: Isibuyekezo Sokuhlaselwa Kwe-Open Source Software Supply Chain
- OpenSSF Amaphakheji Anonya
