Lesi yisiqephu sokuqala ochungechungeni lwezihloko mayelana nohlobo oluvame kakhulu lokuhlaselwa kwe-software supply chain: lezo (ab) ezisebenzisa irejista yomphakathi yezingxenye ze-software, ezenzelwe amaphrojekthi omthombo ovulekile ukulayisha izinto ezingasetshenziswa nabanye abasebenzisi. Lapho abantu ababi beshicilela isofthiwe enonya lapho, besebenzisa irejista njengendlela yokusatshalaliswa kwe-malware, siba nokuhlaselwa kochungechunge lokuhlinzeka lapho izinhlangano ezihlukunyeziwe zifaka noma zisebenzisa ingxenye yesofthiwe ethelelekile.
Ukuze kube lula ingxoxo sizoxoxa ngayo amaphakheji wesoftware:, izingxenye ezifakwe efomini ehlanganisiwe ekhiqizwe abantu besithathu. Lokhu akubandakanyi nje izingxenye ezisetshenziswa abaphathi bephakheji njenge-NPM noma i-Poetry, kodwa futhi izingxenye zesistimu yokusebenza kufaka phakathi imitapo yolwazi kanye nama-binary asebenzisekayo, izithombe zesitsha, kanye nemishini ebonakalayo, noma izandiso zamathuluzi ngamathuluzi okuthuthukisa, ukwakha, kanye nokusabalalisa. Sibone amaphakheji anonya yonke indawo. Izigebengu ze-inthanethi azikhathazeki: ziyakujabulela ezinye izindlela ezinikezwa yizingqalasizinda zesofthiwe zanamuhla futhi zisebenzisa irejista kanye nethuluzi elifanelana kahle nenhloso yazo. Ngakho-ke sicela ukhumbule ukuthi amaphakheji esofthiwe ayi-shorthand yezithombe zesitsha, amaphakheji amabili, izindawo zokugcina ezivulekile, kanye nezandiso noma ama-plugin azo zonke izinhlobo (ama-IDE, CI/CD izinhlelo, amathuluzi okwakha). Konke kuhlaselwa njalo.
Lolu chungechunge luzoba neziqephu ezi-5:
- Iyini Inkinga Ngamaphakheji Omthombo Ovulekile? Lesi yisihloko salesi sihloko. Kungani izigebengu zazo zonke izinhlobo zishicilela amaphakheji anonya? Kungani kufanele ngikhathazeke?
- Ukufana Kwamaphakheji Anobungozi: Yiziphi Izitayela? Kulesi siqephu, sigxila engcupheni esiyiqaphayo ngohlelo lwethu lwe-MEW, usuku nosuku. Njengoba umsindo omkhulu wangemuva ubangelwa inani elikhulu lamaphakethe anonya asebenzisa ukuthayipha noma ukudideka kokuxhomekeka, iphesenti elincane lokuhlaselwa liyingozi kakhulu futhi libeka ingozi enkulu. Ukuziphatha kwabenzi ababi mayelana ne-OS kushintshe kanjani esikhathini esidlule samuva nje? Yiziphi izinombolo? Yiziphi amaqhinga, amasu, nezinqubo ezisetshenzisiwe, kanye nezenzo ezilimazayo ezibonwe?
- Ukuvikela Amaphakheji Anobungozi Omthombo Ovulekile: Yini Engasebenzi (Engasebenzi). Iningi lochwepheshe abaqaphela ukuphepha linemibono yokuthi bangabhekana kanjani nalolu songo. Sizwile abaphathi bezokuphepha bethi ngaphandle kokungabaza ukuthi SCA Amathuluzi asevele ekutshela ukuthi inguqulo yephakheji iyi-malware. Noma ukuthi ancike ezingxenyeni zesofthiwe ezaziwayo, ezibuyekezwe kakhulu, lapho noma iyiphi i-malware ingatholakala futhi isuswe ngokushesha. Bathi basebenzisa izinguqulo ezincane/ze-patch ezivulekile ukuze bathole ngokuzenzakalelayo ukulungiswa kobungozi, futhi leyo yindlela efanele, enconywayo yokunciphisa ingozi ekuthembekeni komthombo ovulekile, belandela isimiso esithi "patch kusenesikhathi, patch njalo". Kulesi siqephu, sizobuyekeza ukuthi kungani le mibono ingalungile, nokuthi imibono enjalo eyiphutha inikela kanjani ekuthandweni kwale ndlela yokuhlasela, kanye nengozi enkulu izinhlangano ezibhekene nayo. Sizophetha ngalokho okusebenzayo, nokuthi yimuphi umzamo nezinsiza ezihilelekile.
- Amaphakheji Amabi Omthombo Ovulekile: Indlela ye-XygeniKulesi siqephu, sethula isu esililandelayo e-Xygeni ngohlelo lwethu lwe-Malware Early Warning (MEW). Lolu hlelo olunezigaba eziningi lusebenza kanjani ngesikhathi sangempela lapho kushicilelwa inguqulo entsha yephakheji, ukuthi ubufakazi buthathwa kanjani emithonjeni ehlukene, ukuthi kwenziwa kanjani i-triage, yiziphi izindlela zokuhlela esizilandelayo, nokuthi kungani kusadingeka ukuhlaziywa ngesandla ukuqinisekisa uhlobo lwephakheji elinonya? Indlela impendulo evela emaqenjini ethu angaphakathi nawokubhalisa esiza ngayo uhlelo ukuthi lufunde ebufakazini besikhathi esidlule obuqoqwe ukuze kuncishiswe imiphumela engamanga ibe mincane. Sizochaza ukuthi sisiza kanjani i-NPM, i-GitHub, i-PyPI, nezinye izingqalasizinda ezibalulekile ezindaweni zemvelo ezivulekile zomthombo ovulekile ukunciphisa isikhathi sokuhlala..
- Ukusebenzisa Umthombo Ovulekile: Ongakulindela Kubantu Ababi. Uchungechunge luphetha ngokugxila ezenzweni ezintsha izitha ezizamukelayo zokwenza ukuhlaselwa kube yimfihlo, kube nzima ukukubona, kuqondiswe kakhulu ezimbonini ezithile, futhi kutholakale izinzuzo ezengeziwe kulolu hlobo lokuhlaselwa. Ingabe ukuhlaselwa kwe-ransomware kuzolethwa kusetshenziswa le moto? Abantu ababi basebenzisa kanjani amathuluzi e-AI ukuletha amaphakheji anonya ayinkimbinkimbi? Ingabe amaphrojekthi adumile asengozini? Lokhu ukunikeza abafundi umuzwa ngalo mncintiswano wezikhali, nokuthi yini okufanele bayilindele esikhathini esifushane (ingxenye yesibili ka-2024) kanye nesikhathi esiphakathi (2025). Sizofunda ukuthi ukuhlaselwa okufana nokwakamuva I-XZ-Utils Backdoor, noma ukuhlaselwa kokuphila ngaphandle komhlabathi umakhi we-electron ngoMashi Mashi 2024 zibonisa ukuthi kufanele sihlale siqaphele indlela izitha ezithuthuka ngayo.
Ake siqale isiteji ngesiqephu sokuqala: Kwenzekani ngamaphakheji omthombo ovulekile ononya?
Iyini Inkinga Ngamaphakheji Omthombo Ovulekile?
Eminyakeni yamuva nje, abenzi bobubi bazo zonke izinhlobo basebenzise amarejista esofthiwe yomthombo ovulekile ukuze banikeze ukulethwa kokuziphatha okunonya. Le misebenzi indala njengomthombo ovulekile, kodwa ukuvama kwayo kukhuphuke kakhulu eminyakeni emithathu edlule.
Ukushicilela izingxenye ezinonya kumarejista omphakathi (ukuhlaselwa okusekelwe ekuthembeleni) yimpi yama-guerilla engalingani esongela abalingisi ukusabalalisa i-malware, isebenzisa ukwethenjwa okubekwa yizinhlangano ezingxenyeni zomthombo ovulekile ezivela kubathuthukisi abangaziwa (khumbula ukuthi ukuxhomekeka kwe-xkcd yamahlaya?). Ngenxa yokuthi uyawathemba amaphakheji futhi awunankinga nokubukeza ngesandla okuqukethwe kwephakheji kanye nokuncika kwawo, lokhu kuhlasela kusebenza kahle kakhulu. Futhi ukungalingani kuza ngoba kungenziwa ngokuzenzakalelayo kakhulu futhi abantu ababi akudingeki basebenzisane ngqo nesisulu. Bamane balayishe iphakheji kurejista yomphakathi bese beyidedela.
Amaphakheji anonya kwanda nge-6x factor ngo-2022, futhi yaqhubeka nokukhula ngesilinganiso esingu-2.5x ngo-2023. Ngonyaka odlule kwabonakala amaphakheji anonya angu-245,000, inani eliphindwe kabili kunenani eliphelele eminyakeni edlule lihlangene. Lokhu ukukhula okukhulu! Kusukela ekususweni kwamaphakheji njenge-malware eqinisekisiwe emakhulwini phakathi kuka-2021 kanye nasezinkulungwaneni phakathi kuka-2022 sibone "umsindo" omkhulu wangemuva phakathi kuka-2023, ngesivinini esifanayo kulo nyaka. Futhi kufihlwe kuleyo ngemuva elibangelwa yizigebengu ze-inthanethi ezingenabuchwepheshe ezilandela "indlela yokumelana okuncane", ukuhlaselwa okuncane okudumile kwafinyelela ezindabeni ngisho nakwabezindaba jikelele.
Kungani lokhu kuyinkinga enkulu kangaka? Kukhona inkinga ukweqisa kokuthembana kulo lonke uchungechunge. Isofthiwe yomthombo ovulekile isatshalaliswa nekhodi yayo yomthombo, futhi ikhishwa ngaphansi kwelayisensi enikeziwe. Yebo, noma ubani angahlola ikhodi yomthombo; kodwa, ubani ohlola yonke indawo? Ngubani, ngemva kokuhlola ukuthi isofthiwe ayinayo i-malware, owakha isofthiwe evela emithonjeni? Ngubani, ngaphambi kokudlulisa ingxenye epakishiwe (eyaziwa nangokuthi Iphakheji) phansi kuya kumphathi wephakheji noma ithuluzi lokwakha, iqinisekisa ukuthi iphakheji ayigcwele i-malware futhi ihambisana nekhodi yomthombo okufanele ivele kuyo?
Kungani ingqalasizinda ivumela ukuhlaselwa okulula kangaka?
Ukubhaliswa kwamaphakheji zivulekile, ngokuvamile zidinga ukuqinisekiswa okuncane kobunikazi bomshicileli. “Noma ubani wamukelekile ukushicilela isofthiwe yakhe lapha!” Ibha yabahlaseli ibekwe phansi: basebenzisa amakheli e-imeyili alahlwayo kanye nama-akhawunti e-GitHubgithub alahlwayo ukudala amakhulu amaphakheji anonya emikhankasweni emfushane, efana ne-phishing. Kulabo abaqondiwe kuphela okudingekayo ubuchwepheshe obuphezulu: Sibone ngisho nokudala indawo yokugcina imithombo ye-GitHub ethembekile enezinkanyezi eziningi kanye commits ezivela kubanikeli abaningi mbumbulu kanye nezinye izindlela zokuthandwa nokugcinwa. ababukeli bezinkanyezi kanye nedumela elivela eminikelweni mbumbulu Akunzima ukuzenzakalela. Sibone ukusetshenziswa kabi kwengqalasizinda yesofthiwe evulekile yazo zonke izinhlobo, hhayi nje i-malware, njenge- isigameko senqubo yetiyi.
Abaphathi bamaphakheji baklanyelwe ukuba kube lula ukuyisebenzisa hhayi ukuphepha. Bangasebenzisa izikripthi zangaphambi kokufakwa kanye nangemuva kokufakwa (ngezinye izikhathi ukuhlanganisa ikhodi yomdabu yelabhulali kuyadingeka). Futhi, Abaphathi bephakheji faka amaphakheji avela emithonjeni eminingi, futhi ngezinye izikhathi okuzenzakalelayo ukusebenzisa amarejista omphakathi. Abazange bahlole ukungafani phakathi kwe-metadata esicelweni sokushicilela, kanye ne-metadata ephaketheni uqobo.
Ukuthembela kuyakhiwa futhi kwakha igrafu. Kwezinye izindawo zemvelo ezifana ne-Node (JavaScript), ukuthembela okuncane kuqongelela ngamakhulu noma izinkulungwane. Into eyodwa ukuba nokulawula okuqinile kokuthembela okuqondile okumenyezelwe amaphrojekthi esofthiwe yami, kodwa ukuncika okuguquguqukayo Kunzima ukulawula. Umthombo ovulekile ulandelwe “abangane babangani bami ngabangane bami”. Ubuzalwane buyinto evamile eMpumalanga Ekude yasendle! Abadlali bezingozi bayakwazi lokhu futhi bafihla ngokujulile ukuziphatha okubi ezinhlotsheni ezingaziwa ezivame ukungaziwa. Lokhu bekunjalo nge ukusakaza-umcimbi isigameko esiqondiswe ku- Isikhwama semali se-Copay.
Lena yindlela isofthiwe yomthombo ovulekile esebenza ngayo kusukela yasungulwa. Ngeke ishintshe kakhulu. Amanye ama-package registry afuna ukuqinisekiswa kwezinto ezimbili, futhi ngokuvamile ngenxa yama-package athandwa kakhulu. Amanye ama-registry ahlinzeka ngama-scope, indawo yamagama ephethwe yinhlangano ehlolwe, kodwa kabuhlungu abanye abakusekeli (i-PyPI) noma bakwenza kube okukhethwayo (i-NPM). Kuyathakazelisa ukuqaphela ukuthi ngisho uhlelo lokuhlola olulula (kusekelwe ekulawulweni kwendawo yokugcina/inhlangano ye-DNS noma ye-GitHub efanisa i-ID yeqembu) kanye nokwenza Ukusayina kwe-PGP kuyadingeka kuzo zonke izinto zobuciko ngaphandle kwama-checksum kususa iningi lamaphakheji “omsindo”, afana nokubhala amagama anonya, futhi kukhawulela okuningi ukudideka kokuthembelaUkuhlasela okuyinkimbinkimbi kungenzeka kodwa kunzima kakhulu, njengoba kumbalwa nje okufana com.github.codingandcoding:maven-compiler-plugin eyaziwa ngeMaven Central. Futhi akuwona wonke amarejista e-maven alandela imikhuba efanayo!
Izilawuli zokuphepha kubaphathi bephakeji zingase zibe nzima kodwa azithinti ukuhlaselwa kokuxhomekeka. Inkinga ngokuqinisekiswa kwezinto eziningi ukuthi ukuze kwenziwe ngokuzenzakalela, kukhiqizwa iziqinisekiso ezithathwe njengezithokheni zokufinyelela noma okhiye be-APIapi ukuze ama-akhawunti asetshenziswe kumakholi we-APIapi enziwe ngezikripthi zokwenza ngokuzenzakalela, ngaphandle komsebenzisi oxhumana naye osekelayo onikeza isici sesibili. I-MFA ilungele ukuvikela ama-akhawunti abasebenzisi ekuvuvukeni kwephasiwedi, kodwa amathokheni okufinyelela akhiqizwe noma okhiye be-APIapi kudingeka avikelwe ngenkathi esebenza, noma umnikazi wawo uzolingiswa yizitha. Ingxenye enkulu yemikhankaso yochungechunge lokuhlinzeka olusekelwe ephakejini iqala ngokhiye/ithokheni evuzayo. Khumbula nje izehlakalo ezifana nalezi I-Ledger, 3CX, kanye nokunye okuningi, lapho iziqinisekiso ezingasebenzisani zaqala ukukhishwa ekungeneleleni kokuqala kokuqalisa ukuhlaselwa kweketanga lokunikezela.
Impendulo enikezwe kulolu songo yayinganele ngokwanele. Esiqeshini sesithathu, sizogxila kulokho okusebenzayo, nalokho okwahluleka kakhulu. Imboni idinga ukusebenzisana ekubhekaneni standards, izinqubo, imfundo, kanye namathuluzi okunciphisa izingozi ezinkingeni zokuphakelwa komhlaba wonke. Lena akuyona inkinga inhlangano eyodwa engayixazulula yodwa.
Ukuqeda lesi sigaba, ukungaqondi kahle okubalulekile: sikhuluma ngakho enonya amaphakheji, hhayi engozini lawo. Ubuthakathaka buvela emaphutheni okuklama noma okubhala ikhodi, angeniswe ngengozi, ngaphandle kwenhloso embi. Ubuthakathaka bungase busetshenziswe kabi, kodwa abaningi abusetshenziswa kabi. Amaphakheji anonya ahlala ehlosiwe, futhi kukhona ukuxhashazwa okungu-100% uma esetshenziswa. Akukho bungozi obufanayo! Ngakho-ke Kuyaxaka ukubona ukuthi mingaki imizamo eyenziwayo yokuthola nokunciphisa ubuthakathaka, kanye nokuntuleka kwezinyathelo ezifanayo zezingxenye ezinonya.
"Sithatha ezokuphepha ngokungathi sína"
Ake sicabange ngendlela evamile I-Acme Corporation. I-Acme, umhlinzeki omkhulu we-WileCoyote.com, inesofthiwe yayo eningi evela kubantu besithathu, enamaphrojekthi angaphezu kuka-80% avela kumthombo ovulekile. Bakhiqiza isofthiwe yokusetshenziswa kwangaphakathi, kodwa futhi bahlinzeka ngesofthiwe kubalingani babo, abahlinzeki, kanye namakhasimende/abasebenzisi bokugcina. I-Acme inesofthiwe ebhalwe ku-Go, JavaScript, Java, C#, kanye ne-Python, futhi isebenzisa iningi lesofthiwe yayo efwini, ngaphansi kwamaqoqo e-Kuberneteskubernetes. I-Acme yakha izithombe zayo ezenziwe ngokwezifiso kusuka ezithombeni eziyisisekelo ezithathwe ku-Docker Hub nakwamanye amarejista. Futhi babelana ngamalabhulali ambalwa, amaphakheji, kanye nezithombe zamakhonteyina kumarejista omphakathi.
I-Acme ithatha ezokuphepha ngokungathi sína. Bayazi kahle inkinga ye- open source security, kanye nengozi evezwayo. Bonke abathuthukisi, abaphathi bezinhlelo, kanye nonjiniyela be-DevOpsdevops basebenzisa lawo makhi amancane amahle e-crypto njengokuqinisekiswa kwezinto zesibili. commitAma-s ukuze ama-repos ekhodi asayinwe, ukuvikelwa kwegatsha kuvunyelwe ngokubuyekezwa kwekhodi okuphoqelekile, CI/CD ikhiyiwe, izimfihlo zigcinwa endaweni yokugcina eyimfihlo, kanye nerejista yangaphakathi ekhombisa ngokwengxenye amarejista angaphandle lapho kugcinwa khona kuphela izingxenye ezivunyelwe, ezibhalwe ohlwini olumhlophe. Kuyadingeka ukuthi isofthiwe eyakhiwe yi-Acme kumele ithathe ukuncika komuntu wesithathu kule rejista.
Mhlawumbe izinhlangano eziningi ziyafanelana nale phrofayili. Mfundi othandekayo, eyakho iyafanelana uma usekhona, akunjalo?
Kwabe sekuthi ngolunye usuku olubi, unjiniyela obalulekile we-frontend e-Acme wagijima ukufaka i-acme-cute-lib npm, ngikhohlwa ukuthi i-@acme/cute-lib yayiyi-scoped dependence efanele. Iphutha eliqondile alibalulekile, izinto eziningi zingase zihambe kabi ngisho noma umuntu ethatha ukulawula okuphelele komjikelezo wokuphila kwesofthiwe. Umthuthukisi wethu wayengazi ukuthi iqembu le-APT lalihlose i-Acme futhi lashicilela ingxenye enonya ngaphansi kwalelo gama, ngendlela yobuqili ngakho ukuziphatha okunonya kusebenza kuphela uma isofthiwe ifakiwe kumakhompyutha e-Acme. Iphakheji ayizange itholakale amasonto amaningi ngemva kokushicilelwa kwayo.
Kusetshenziswa iskripthi sokufaka esifuna iziqinisekiso (kwakukhona amathokheni amaningi okufinyelela amnandi kukhompyutha yethu ephathekayo yonjiniyela), okuvumela ukufinyelela ezindaweni zokugcina isofthiwe yangaphakathi, kanye nendawo yokugcina yangaphakathi eshiwo ngenhla, okufinyeleleka kuphela nge-VPN. Ikhodi enonya ikwazile ukusebenzisa uxhumano lwe-VPN olukhona futhi yashicilela ingxenye enonya yesigaba sesibili kurejista yangaphakathi, okuthinta umtapo wolwazi ovamile we-utils owabelwana ngawo iningi lesofthiwe elethwa yi-Acme.
Ngemva kwamasonto, ezinye izinhlangano ezisebenzisa amathuluzi ashicilelwe yi-Acme zaqala ukubona ithrafikhi engavamile kumanethiwekhi azo, ithrafikhi isebenzisa iphrothokholi ye-Acme kodwa iqondiswe kuma-host afana nesizinda se-Acme. Ithrafikhi yayibethelwe kodwa amathuluzi okuqapha uhlelo athole ukufinyelela kumafayela angalindelekile kanye nokusetshenziswa kwezinqubo ezibukeka njengemiyalo yesistimu kodwa ezigcina zisebenzisa ama-executable alandiwe.
Okunye sekuwumlando: I-Acme yaqale yaphika ukuthi ukuziphatha okunjalo kwakungabalelwa kubo nokuthi zonke izinyathelo zokuphepha ziyasebenza. Kuphela ngemva kokuba abezindaba be-cybersec beqale ukubuza ukuthi kungani umthombo wokuziphatha okutholiwe uvela ezingxenyeni ze-Acme, futhi ukuhlaziywa kokuphepha kwaveza ukuthi lezo zingxenye zazigcwele kangakanani i-malware efihliwe, i-Acme kwadingeka iqaphele lesi sigameko futhi yashayela inkampani yokusabela ezigamekweni. Umkhankaso wokumaketha omubi owaqeda ukuzethemba okuzuzwe kanzima ngomzuzwana.I-Acme yayifakwe i-npm eyodwa kude ne-disaster"Kwakuyisihloko esivamile. Kwabe sekulandela amacala kanye nezinkontileka ezikhanseliwe.
Uyakubona ukufana nezigameko ezaziwayo zesikhathi esidlule? I-Acme yawela esigamekweni sochungechunge lokuhlinzeka ngezimpahla ngezigaba ezimbili, kusetshenziswa ingxube ye ukudideka kokuthembela/ukubhala phansi ukuhlaselwa okwasebenzisa indawo yokusebenza yabathuthukisi njengendawo yokungena yokutheleleka izingxenye ezagcina sezisetshenziswa yizinkampani zangaphandle. Lokhu kungavinjelwa noma kuncishiswe kanjani?
Kungani amaphakheji anobuthi ethandwa kangaka
Lesi sigameko esicatshangelwayo sibonisa ukuthi ngisho nangendlela enengqondo yokuphepha komthombo ovulekile, izinhlangano zidinga izinyathelo ezithile zokugwema ukuba yizisulu ze-malware ezingxenyeni zomthombo ovulekile. Ngokwesimiso, umlingisi osongelayo angenza lokhu:
- Dala iphakheji entsha (ulandela izindlela zokubhala noma zokudideka kokuxhomekeka, lena yindlela edlula kakhulu abantu ababi ngobuningi);
- Zama ukuthelela ekhona kakade, noma ngokuyifaka kukhodi yomthombo, uzama ukuyifihla njengomhlinzeki nge pull request, noma ukusebenzisa ubunjiniyela bezenhlalo ukuze ube ngumnakekeli (njengoba “uJao Tan” enza ku-XZ Backdoor noma kwesokudla9ctrl Umsebenzisi we-GitHub wenze ku- ukusakaza-umcimbi isigameko ekwindla ka-2018), noma ngokuthola iziqinisekiso zokugcina imithombo evulekile nokuzenza umgcini;
- Faka i-malware ngesikhathi sokwakhiwa kwephakheji, kungaba ngokusebenzisa iskripthi sokwakha esinonya, noma ukuphazamisa ukulanda amaphakheji nge-man-in-the-middle intercepts (ngenhlanhla, i-TLS manje iyadingeka njalo kumarejista amaningi).
- Faka ingxenye epakishiwe ngqo kurejista, ngokuvamile ngokuthwebula iziqinisekiso zokubhalisa (indlela ekhethwayo yokuhlasela okuningi okuyinkimbinkimbi njenge-Acme's, lapho indawo yokusebenza eyonakele esigabeni sokuqala yayinethokheni yokufinyelela kurejista yangaphakathi isib. .inv or ~/.m2/settings.xml: abenzi bobubi bayazi ukuthi bangabhekaphi izimfihlo). Ubuthakathaka ezindaweni zokubhalisa nabo basetshenziswa kabi.
Ukufaka ubuthi ezingosini zokubhalisa nge-malware kuyisisekelo sokuhlaselwa kokuthembela. Akukho okusha ngaphansi kwelanga: ukusabalala kwayo kwanda kakhulu, kodwa amasu afanayo asebenza manje njengoba ayenjalo eminyakeni emihlanu edlule.
Source: Iqoqo Lommese KaBackstabber.
Iphakheji enonya ingasebenza ngesikhathi sokufakwa, ngesikhathi sokwakhiwa kwesofthiwe, noma ngesikhathi sokusebenza. Futhi ukuziphatha kuyahlukahluka kusukela ekukhishweni kolwazi isib. ukukhipha izimfihlo zomzamo wesigaba sesibili, kuya ekukhishweni kwekhodi yomthombo, ukulahla i-malware eyengeziwe. Esiqeshini esilandelayo, sizohlaziya amaphakheji anonya nokuthi ashicilelwa kanjani.
Ukufundwa Okwengeziwe
Isiqephu esilandelayo Ukufana Kwamaphakheji Anobungozi: Yiziphi Izitayela? sizogxila ezimweni zangempela esiziqaphayo ngohlelo lwethu lwe-Malware Early Warning, usuku nosuku. Sizobuyekeza ukuthi yiziphi izinhlobo ze-malware ezibonwe, nokuthi yimaphi amaqhinga, amasu, kanye nezinqubo ezithandwa kakhulu. Sizohlola ukufiphala kanye nendlela ezizama ngayo ukufihla kubabuyekezi abangaba khona, amasu okugwema ukutholwa, kanye nendlela ezishintsha ngayo nge-telemetry kanye nokunyakaza okuseceleni. Sicela uhlale ubukele!
Okubhekwayo
- Iqoqo Lommese KaBackstabber: Isibuyekezo Sokuhlaselwa Kwe-Open Source Software Supply Chain. M. Ohm nabanye., Meyi 2020.
- Ukuvikelwa Kwe-Malware Yomthombo OvulekileIphepha Elimhlophe elivela ku-Xygeni.
- Software Supply Chain Security Ukubuka Kwangemuva: Ukwakha Ukuphepha Okungcono Ngo-2024Umbiko ovela ku-Xygeni.
