Lesi yisiqephu sesithathu ku-a uchungechunge lwezihloko mayelana nohlobo oluvame kakhulu lokuhlaselwa kwe-software supply chain: lezo ezisebenzisa kabi irejista yomphakathi ye evulekile-umthombo izingxenye zesofthiwe. Ngemva kokuhlaziya esiqeshini esedlule “Ukufana Kwamaphakheji Anobungozi: Yiziphi Izitayela?"Indlela abenzi bobubi abafaka ngayo ukuziphatha okunonya ezingxenyeni ezintsha noma ezikhona ezishicilelwe, sesikulungele ukugqoka amajazi ethu okucima umlilo futhi sihlole ukuthi singayivimba kanjani ngempumelelo isofthiwe enonya ethunyelwa ngale ndlela, noma, sibhekane nesigameko esingaba yingozi se-cyber ngoba sithathe indlela engalungile."
Iningi lochwepheshe abaqaphela ukuphepha banemibono yokuthi bangabhekana kanjani nalolu songo. Sizwile abaphathi bezokuphepha bethi ngaphandle kokungabaza ukuthi SCA amathuluzi asevele ekutshela ukuthi inguqulo yephakheji iyi-malware. Noma ukuthi ancike ezingxenyeni zesofthiwe ezaziwayo nezibuyekezwe kakhulu, lapho noma iyiphi i-malware ingatholakala futhi isuswe ngokushesha. Asebenzisa izinguqulo ezincane/ezivulekile ukuze athole ngokuzenzakalelayo ukulungiswa kobuthakathaka, futhi leyo yindlela efanele, enconywayo yokunciphisa ingozi ekuncikeni komthombo ovulekile, kulandela "lungisa kusenesikhathi, lungisa kaningi”Isimiso.
Kulesi siqephu, sizobukeza ukuthi kungani le mibono ingalungile, nokuthi imibono enjalo eyiphutha inegalelo kanjani ekuthandweni kwale ndlela yokuhlasela, kanye nengozi enkulu izinhlangano ezibhekene nayo. Sizophetha ngalokho okusebenzayo, nokuthi yimuphi umzamo nezinsiza ezihilelekile.
Imibono eyiphutha ejwayelekile
Phakathi nohambo lwethu ngokuphepha kwesofthiwe, sibone amasu okuhlasela ethuthuka kanye nemibono ehlukahlukene evela kubantu abaqaphela ukuphepha. Izinhlangano zivame ukungaqondi kahle ukuthi yini esebenza ngokumelene nalolu songo, ngakho-ke okokuqala sizohlola ukuthi yini engasebenzi, sifinyeze ohlwini olulandelayo, olungaphelele, lwemibono eyiphutha.
Umbono Oyiphutha #1: SCA amathuluzi asevele ebika izingxenye ezinonya
Impela! Kodwa ngemva kweqiniso... Uma mhlawumbe sekwephuze kakhulu uma lesi sici sisetshenziswe ekwakheni isofthiwe, futhi abenzi bokubi sebevele bathole indawo kunjiniyela noma CI/CD umsingathi. Izimfihlo kungenzeka ukuthi zikhishwe, i-malware eyengeziwe ilandiwe futhi yafakwa, futhi mhlawumbe isitha sithuthele eceleni futhi sesivele sithole ukufinyelela kwenye indawo.
Ukuhlaziywa Kokwakheka Kwesofthiwe (SCA) amathuluzi aklanyelwe ukuhlonza ubuthakathaka obungaba khona obaziwayo. Amathuluzi esimanje enza umsebenzi omuhle ngokwandisa isilinganiso somsindo wesignali, enquma ukuthi ubuthakathaka bungafinyeleleka noma bungaxhashazwa ngempela. Kodwa awasebenzi ngokumelene ne-malware entsha. Cabanga ngengxenye enonya njengobuthakathaka obungenalo usuku: Kuphela lapho ukuziphatha kwayo okunonya kutholwa, ingxenye ibikwa kurejista ephethe, okuthi ngemva kokubuyekezwa yithimba lezokuphepha kuqinisekiswe njengobungozi futhi kususwe kurejista. [1].
Ngaleso sikhathi, umhlaba (kufaka phakathi SCAs) uyazi ukuthi ukufaka noma ukusebenzisa ingxenye (noma ezinye izinhlobo zengxenye ekhona) akuyona into enhle. Kodwa lokhu kwenzeka lapho ingxenye ingatholakali kurejistaUkwazi ukuthi nginobuthakathaka ezingxenyeni zangaphandle, noma ngisho nezingxenye ezahlukaniswa njengezinonya yirejista kuhle, kodwa ngeshwa SCA noma amathuluzi okuhlola avamile awasizi kulokhu. Ngaphandle kokuthi SCA/audit ithuluzi lingazi kusengaphambili ukuthi ingxenye ethile inonya ngaphambi kokuba isetshenziswe enhlanganweni yakho.
Khumbula, noma yisiphi isisombululo ngokumelene nezingxenye zomthombo ovulekile ezinonya kumele sizibone endizeni, phakathi kwesikhathi lapho ingxenye ishicilelwa khona kurejista kanye nesikhathi lapho ingxenye (inguqulo) isetshenziswa okokuqala enhlanganweni yakho. Futhi lokho kufaka phakathi izingxenye eziguqukayo.
Umbono oyiphutha #2: Ukulawula izikripthi zokufaka ngesikhathi sokwakha kuvimbela ukuziphatha okunonya okuvela ezingxenyeni zomthombo ovulekile
Abaphathi bephakheji abahlukahlukene banikeza ikhono lokusebenzisa izikripthi (ezifakiwe ku-tarball yengxenye [2]), ngezizathu ezisemthethweni, njengokuhlanganisa izinto ezidingekayo kumapulatifomu ahlukene, ukukhiqiza ikhodi, noma ukusebenzisa izivivinyo, futhi sonke kufanele sazi ukuthi zingase zisetshenziswe kabi ngabenzi ababi uma izikripthi ezinonya zifakiwe ku-tarball, noma uma umhlaseli engenza isikripthi esinonya sisebenze esikhundleni sesihle.
Njengoba sazi lokhu, singalungiselela umphathi wephakheji ukuthi anganaki izikripthi. Isibonelo, nge-NPM –Ziba-imibhalo ifulegi (noma impahla yokumiswa ku- .npmrc ifayela) leqa izikripthi ngesikhathi sokufakwa. Lokhu kungase kudale izinkinga ezithile ngoba ukusebenzisa izikripthi kuvamile ezindaweni eziningi zemvelo: Abanye abaphathi bephakheji abavumeli ngisho nokukhubaza ukwenziwa kwesikripthi (icebiso: shesha “Yimaphi abaphathi bephakheji abangavumeli ukukhubaza ukwenziwa kwezikripthi zokufaka?"ku-AI yakho oyithandayo). Kodwa lokhu akuvikeli ngokujwayelekile (sidinga ukuphoqelela ukuthi ukucushwa kwe-skip disable kuyatholakala yonke indawo).
Futhi uma ukuziphatha okunonya kungekho kuma-script okufaka kodwa kusofthiwe okufanele isetshenziswe ngesikhathi sokusebenza, le nketho iyodwa ayisivikeli.
Umbono oyiphutha #3: Ukuphina inguqulo kuvimbela ukufakwa kwezingxenye ezinonya
Kukhona ukwahlukana phakathi kokulungisa ama-patches kusenesikhathi kanye nokushintshashintsha izinguqulo ezivulekile (ukuvumela umphathi wephakheji ukuthi afake ngokuzenzakalelayo izibuyekezo ezintsha uma zitholakala ukuze kulungiswe ukuphepha) kanye ukuphina inguqulo (ukuba nazo zonke izindlela eziqondile nezishintshashintshayo zesofthiwe enguqulweni ehleliwe). Izimiso zokuphepha zilukhuni futhi ngezinye izikhathi ziyaphikisana, njengoba kwenzeka nge-"patch early, patch often" kanye "Ukuthuthukisa akufanele kuthathwe kalula". Abanye abaphathi bephakheji benza izibuyekezo ezizenzakalelayo ngama-server ranges ngendlela enconywayo. Kuhle uma ufuna futhi ukuthola izibuyekezo ezinonya! Yebo, izingxenye kumele zibuyekezwe ukuze zithole ukulungiswa kokuphepha okuvala ubuthakathaka ngokushesha okukhulu, kodwa ... ungalokothi uvumele umphathi wephakheji enze lokhu ngokuzenzakalelayo.
Umbono Oyiphutha #4: Ukusebenzisa izingxenye ezithembekile kuphephile. Noma yiluphi uhlobo oluyingozi lungatholakala, ludalulwe futhi lususwe ngokushesha.
Kungani ingxenye ithenjwa? Mhlawumbe ngoba ithandwa kakhulu, inezinhlayiya eziningi zamehlo ezifuna ubuthakathaka, inani elikhulu labanikeli bokunakekelwa, kanye nabanakekeli abaningi abayinhloko ababukeza ngenkuthalo konke pull requestsIqiniso lihlukile kakhulu. Ezinye izingxenye ezibalulekile zigcinwa ngunjiniyela oyedwa, ongakhokhelwa. Izinhlaka ezisetshenziswa kabanzi zine abanikeli abambalwa abavamile, ngenani elincipha ngokushesha commits ngomnakekeli ngamunye (amaphrojekthi athandwayo anenqwaba yabanikeli abenza umsebenzi othile wokushayela commit futhi ungaphinde ubuye). Futhi amaphrojekthi athandwayo anomnakekeli oyedwa ayanda.
Zicabange uthi "O, sisebenzisa izithombe ze-Spring Boot / Angular / React / PyTorch / ezisemthethweni ze-Docker, ngakho-ke ingozi okhuluma ngayo iphansi kakhulu." Mhlawumbe lokho kuyiqiniso, thina abathengisi bezokuphepha sisaba abantu ngaso sonke isikhathi, futhi ukuphazamisa amaqembu okuthuthukisa ukuze kuncishiswe ingozi ephikiswana ngayo kuyinto engenangqondo. Ungase ulingeke ukuthi ugxumele esigabeni sokwamukela ingozi (esigabeni esilandelayo) bese konke sekuqediwe. Ngeshwa, izingxenye ezithandwa kakhulu ziyizisulu zabenzi bokubi, futhi isibonelo, abantu abadumile Umtapo wezincwadi we-PyTorch uhlaselwe esikhathini esedlule.
"Kutholakale ngokushesha, kwembulwe, futhi kwasuswa". Kuthatha izinsuku ukuthi ingxenye entsha enonya isuswe kurejista yomphakathi. Amarejista ayaqaphela ngokususa inguqulo yengxenye, okuhle. Okuhlangenwe nakho kwethu ukuthi uma ibikwe ohlangothini lwethu, isikhathi esimaphakathi serejista sokususa inguqulo ethintekile singamahora angu-39, okungaphezu kosuku nesigamu. Kunezingxenye ezinonya eziba yisonto ngemuva kokubika kwethu kokuqala kurejista ngaphambi kokususwa. Futhi kwezinye izimo, ingxenye isuswa kuphela ngemuva kokuba isisulu noma inkampani yokusabela ezigamekweni ibike isigameko esihilela ingxenye.
OKUNGASEBENZI NGEZINGA EZINTO EZINOMLIVIA
Noma iyiphi indlela engaqondile izohluleka kakhulu. Lokhu kuyiqiniso, awunikezi izindlela zokulwa eziphumelelayo nengozi ehambisana nalolu songo.
Traditional SCA Amathuluzi akutshela nge-malware eyaziwayo kodwa anefasitela elikhulu lokudalulwa. Ngaphandle kokuthi enza ukutholwa kwe-malware ngokuvinjelwa okuphoqelelwe kwezingxenye ezinonya, awasebenzi ngokumelene nalolu songo.
Ukukhubaza izikripthi zokufaka kungasiza kodwa kudinga ukuphoqelelwa noma kuphi lapho ingxenye idinga ukufakwa khona. Kuyafana nangokuphina inguqulo, njengoba izinguqulo zingenakuphina zisuka esimweni sokuqala esiphephile unomphela.
Ukucabanga ukuthi izingxenye ezidumile zithola ukunakwa okwanele kangangokuthi azikwazi ukufakwa ngokuziphatha okungahlosiwe ekuhlaselweni kwe-supply chain ngaphandle kokutholwa okucishe kusheshe ukuze kuvinjelwe noma yimuphi umonakalo kuwubuwula futhi kuyingozi. Awufuni ukuhlala onqenqemeni, akunjalo?
Uma uyeka kulesi sigaba, khona-ke ukwamukelwa kwengozi yiyona nto kuphela ongayenza: Lokhu kuyindlelacisi-ion edinga ukubhalwa phansi kumodeli yakho yosongo/ukuhlolwa kwengozi, okuhlanganisa nesizathu sokwamukela ingozi kanye nemiphumela yayo engaba khona. Khulisa ulwazi ngokuyidlulisela kubaphathi kanye nabanye abantu abathintekayo. isimo esiphuthumayo Kungahlelwa lapho ingxenye enobungozi ifakwa noma ifakiwe kusofthiwe yakho, kodwa lokhu kunzima ngoba abahlaseli banezindlela eziningi okufanele bazilandele. Imininingwane yokuhlaselwa kweketanga lokuhlinzeka ngokusekelwe ekusetshenzisweni kwengxenye enobungozi izoshintsha kakhulu ukudalulwa komphakathi kwesigameko, okungenzeka ukuthi kuyimpoqo ngaphansi kohlaka lokulawula lwenhlangano yakho. Ungase futhi ubhekane nalokhu izilawuli zokunxephezela or ingozi yokudluliselwa isib. ngomshwalense.
Kodwa-ke, kunezindlela zokulawula ezibhekana nosongo futhi kufanele zicatshangelwe uma unganelisekile ngokwamukela ingozi. Sicela uqhubeke ufunda.
Yini Esebenza Ngokulwa Nokuhlaselwa Okusebenzisa Izingxenye Ezinonya
Ukuphathwa Kwenguqulo Eqinile
Ukufaka izinguqulo ngezinkinga zenguqulo ezilawulwayo nezinolwazi kuyindlela okufanele uyenze, ukuze ulinganisele isidingo sokususa ubuthakathaka ngaphandle kokuthola i-malware. Kodwa khumbula iphutha elingalungile #3: Ukufaka izinguqulo zodwa akwanele ukuvimba ikhodi enonya evela ezinguqulweni ezintsha, ngoba uzodinga esikhathini esizayo ukubuyekeza izinguqulo kunoma yikuphi ukuncika okuqondile noma okungaqondile. Ngaleso sikhathi udinga ubufakazi obuqinile ngokwanele ukuthi zonke izinguqulo eziguquliwe azinawo ama-malware.
Isixwayiso Sokuqala
Enye indlela yokuxazulula inkinga yezingxenye ezinonya uhlelo lokuxwayisa kusenesikhathi (oluqanjwe lapha ngokuthi Isexwayiso Sangaphambi Kwesikhathi Se-Malware noma i-MEW), lapho izinguqulo ezintsha ezishicilelwe (zezingxenye ezintsha noma ezikhona) zihlaziywa yinjini yokuthola, okuthi uma kutholakala ubufakazi obanele ingase ihlukanise inguqulo entsha njengengaba yingozi.
Ukuzenzakalela kubalulekile lapha, njengoba kungenakwenzeka ukubuyekeza ngesandla zonke izingxenye ezintsha ngesivinini sokushicilela samanje. Ngakho-ke injini yokuthola idinga ukuhlanganisa amasu ahlukahlukene, mhlawumbe kufaka phakathi ukuhlaziywa kwe-static, dynamic, kanye nekhono, idumela lomsebenzisi, kanye nobufakazi obuvela ekungafani phakathi kwe-metadata yezingxenye kanye nokuqukethwe kwe-tarball, noma phakathi kwe-tarball kanye nendawo yokugcina imithombo lapho kuthiwa ingxenye ivela khona.
Kukhona indawo emnyama phakathi kwesikhathi sokushicilela kanye nesikhathi lapho injini ihlaziya okuqukethwe yizingxenye, kodwa akufanele kudlule imizuzu embalwa. Uhlelo lungashintshwa, isibonelo ngokulinda izingxenye ezintsha ukuthi zihlaziywe ngaphambi kokuzivumela ukuthi zifakwe futhi zisetshenziswe ekwakheni isofthiwe. pipelines, noma uzihlaziye uma kudingeka. Ingxenye enguqulweni ethile ayinakuguqulwa [3], ngakho-ke kudingeka ihlaziywe kanye kuphela.
Ukuzenzakalela okugcwele akunakwenzeka, futhi kudingeka isibuyekezo sokuphepha sezingxenye ezingaba yingozi. Qaphela abaxhasi be-digital panacea: I-AI kanye ne-Machine Learning azikathuthukiswa ngokwanele ukuthatha igama lokugcina uma kukhulunywa ngokuqinisekisa ukuthi ingxenye esolwayo ine-malware. Impela, ukufunda komshini kudlala indima ebalulekile enjinini yokuthola ekuhlukaniseni ingxenye yokufaka ebufakazini obungahleliwe obuthathwe, kodwa uma ingxenye "isivalelwe" igama lokugcina lisekubuyekezweni ngesandla yithimba lezokuphepha elinolwazi ezingxenyeni ezinonya. Lokhu kuqinisekisa noma iyiphi i-malware engaba khona noma ukuyihlela kabusha njengephephile. Futhi isikhathi sisebangeni lamahora.
Irejista ibika ngenguqulo/ingxenye enonya; irejista ibe isibuyekeza ukuqinisekisa bese iqhubeka nokudalula umphakathi nokususa kurejista. Amanye amarejista agcina iphakheji yokubamba ukuphepha. Ububanzi besikhathi lapha yizinsuku noma amasonto kusukela ekushicilelweni, okuyi-'isikhathi sokuhlala'noma'ifasitela lokudalulwa' kwezingxenye eziningi ezinonya.
Kungenzeka yini ukwazi ukuthi inguqulo yengxenye inonya?
Ngakho-ke ukuze sixwayise kusenesikhathi, sidinga ukunikeza impendulo eyanelisayo kulo mbuzo: Ngingazi kanjani ukuthi umtapo wolwazi noma iphakheji ayinabo ubungozi? Ngingabuqoqa kanjani ubufakazi obanele bokuziphatha okunobubi? Kungenzeka, kodwa kunzima, njengoba izitha zisebenzisa ubuhlakani obukhulu ukugwema ukutholakala. Kunezindlela ezahlukene, ngayinye inezinzuzo nezimbi.
Ukuhlaziya okumile ingahlola zonke izindlela zokwenza umsebenzi ihlole amasu asetshenziswa abahlaseli ngaphandle kokusebenzisa ingxenye, futhi yenze imisebenzi yokucubungula kwangaphambili njengokususa i-obfuscation noma ukucacisa. Njengoba abahlaseli bezama ukufihla ububi babo, imizamo yokufihla iwubufakazi be-malware (kodwa qaphela ukuthi izingxenye ezisemthethweni zifihla ikhodi yokugcina impahla yobuhlakani, ziphikisana "umthombo ovulekile"). Zimbalwa kakhulu izihlaselo eziyinkimbinkimbi kakhulu ezine-"obfuscation" ezinamandla ezidinga i-sandboxing, kodwa i-"obfuscation" enjalo iwuphawu lobubi. Sicela uqaphele ukuthi okuvamile SAST amathuluzi aklanyelwe ukukhubazeka okungahlosiwe, hhayi izinhloso ezimbi njengeminyango yangemuva.
Ukuhlaziya okunamandla isebenzisa ingxenye futhi ihlola impendulo ngokusebenzisa isikhathi sokusebenza, ngokuvamile ngokuhlinzeka ngendawo ene-sandbox. Ukuziphatha okunonya okubangelwa ngaphansi kwezimo ezithile kungase kudlule kungatholakali: sicela uqaphele ukuthi i-malware ingasebenzisa amasu okugwema afana I-Virtualization / Sandbox Evasion ukuze isebenze kuphela uma ingahlolisiswa, kanye nophawu olubonisa umsebenzi ononya kunoma iyiphi injini yokuhlaziya engaguquki.
Ukuhlaziywa kwamakhono ibheka ukuthi ingxenye yenzani: lapho ixhuma khona, ukuthi imaphi amafayela ewafinyelela, ukuthi yimiphi imiyalo noma izinhlelo eziqhutshwayo, i-terminal noma idivayisi ye-I/O eyenziwayo, noma ukuthi yiziphi izingcingo zesistimu ezibizwayo. Lokhu kunyatheliswa kweminwe kokuziphatha kungaqhathaniswa (kwengxenye ekhona) kuzo zonke izinguqulo, ngakho-ke lapho kutholwa ukuziphatha okungalindelekile, lobo bufakazi bungaphakamisa ukusola komsebenzi onobungozi ongase ube khona ofakwe kunguqulo entsha. Le ndlela ilandela izinyathelo zokuhlola ezilandelwa abahlaziyi bezokuphepha lapho bebhekene ne-malware engaba khona: ukuhlolwa kusetshenziswa izintambo noma amathuluzi afanayo. Le ndlela ithola ukuziphatha okunonya kungakhathaliseki ukuthi yiziphi izimo ezibangela lokhu futhi isebenza uma kungekho ikhodi yomthombo etholakalayo.
Ukuhlaziywa kokuqukethwe iqoqa ulwazi mayelana nokuthi ingxenye yashicilelwa kanjani nokuthi ubani. Imikhankaso yabenzi bokubi ivame ukusebenzisa i-akhawunti(ama-akhawunti) entsha yomsebenzisi engekho ngaphansi kwenqubo eqinile yokuhlolwa. Ukulandelela umsebenzi wesikhathi esidlule kunganikeza ukuqonda ngomsebenzisi oyisisekelo, ikakhulukazi ngeziphambeko ezingase zibonise ukuthi kungenzeka kube nokuyekethisa. Idumela kunzima kakhulu ukulithola futhi kulula kakhulu ukulilahla! Umsebenzisi ongenamsebenzi wesikhathi esidlule akakhethi, kodwa i-karma iphishekela ububi. Ama-Hacktivists, noma abasebenzisi abavamile abebiwe iziqinisekiso zabo zokushicilela kufanele balandelwe ngokucophelela.
Olunye ulwazi oluphathelene nomongo luwukungqubuzana phakathi kwendawo yokugcina umthombo okuthiwa isetshenziswe ukudala i-tarball yengxenye kanye nokuqukethwe kwe-tarball uqobo. Futhi kulandela imikhuba emihle, njengokudala amathegi noma ukukhishwa endaweni yokugcina umthombo okufanisa izinguqulo zengxenye eshicilelwe kurejista yomphakathi. Lapho indawo yokugcina umthombo endaweni ethile commit iphawulwe ngokuthi ikhishwe, bese kuthi ngokuzumayo inguqulo eyodwa yehluleke ukuyilandela, lokho kukodwa kuwubufakazi obuqinile bokuthi ingxenye ingase ibe nokungcola: umenzi omubi kungenzeka ukuthi uphazamise i-akhawunti esetshenziswe ekushicileleni ingxenye, kodwa akanazo izimvume zokubhala endaweni yokugcina ikhodi yomthombo). Ukuhlaselwa okuningi kutholwa njalo kusetshenziswa le mithetho: isibonelo, Ukuhlaselwa kwe-Ledger kungatholakala kalula ngale ndlela. Ngakho-ke, ukuhlaziywa komongo kukhomba ukungalingani okunjalo enqubweni yokushicilela.
Ukuvikela Ukuthembela
Indlela ehlukile ukuba nohlu oluphelele lwezingxenye zawo wonke amagrafu okuncika asetshenziswa kusofthiwe yakho, ngakho-ke kunoma yikuphi ukwakhiwa pipeline ukusebenzisa enhlanganweni yakho kungafakwa futhi kusetshenziswe izinguqulo zezingxenye ezivunyiwe kuphela.firewall"kuphoqelelwa kusetshenziswa irejista yangaphakathi lapho ama-tarball ezinguqulo zezingxenye ezivunyelwe ekhonzwa khona (agciniwe noma afakwe iphroksi). Sicela uqaphele ukuthi noma yiluphi uhlu olumhlophe ngeke lusebenze ngaphandle kokuthi unobuchwepheshe bokuhlukanisa noma iyiphi inguqulo entsha njengephephile ukuze ingezwe ohlwini olumhlophe.
Sicela uqaphele ukuthi isexwayiso sangaphambi kwesikhathi (ukutholwa okusheshayo ngokushesha okukhulu ngemva kokushicilelwa kwenguqulo entsha) sidinga ukuhlanganiswa nendlela ethile yokusebenzisa lolo lwazi ngendlela efanele ukuvimba ingxenye ethinta ukwakhiwa. pipelinenoma imishini yabathuthukisi [4]Lokhu sikubiza ngokuthi “ukuvikela ngomlilo kokuxhomekeka": indlela yokuvalela abantu yokuvikela izakhiwo ezizenzakalelayo kumaphakheji anonya. Amaphakheji angaphakathi kanye nokubhaliswa kwezithombe kuhle ukuvikela izinhlangano ebubini bangaphandle, kodwa ubufakazi obuqinile ngokwanele buyadingeka ukuze ukuvalela abantu kube yimpumelelo.
I-Runtime Sandboxing
Enye indlela yokuthola ngesikhathi sokushicilela ukuhlaziya ukuziphatha ngesikhathi sokusebenza. Umqondo uwukubamba ukuziphatha okulindelekile kusuka kusofthiwe bese uthola (noma ukuvimba) noma yikuphi ukungalingani okutholakalayo. Lo mzila wesenzo unenkinga yokuthi kufanele usebenzise isikhathi sokusebenza sokuqapha noma ukuvimba, futhi kuwumqondo othembisayo ozongezwa ezikhalini zezindlela zokuvikela ngokumelene nezinambuzane ezinonya.
Ukubeka Isu Eliphelele
Isu elinconyiwe lidinga ukuhlanganisa amasu ahlukene enkambisweni yokuthuthukiswa kwesofthiwe, sithathe ukulawula izibuyekezo zenguqulo ukuze sivimbele izingxenye ezingenayo ezinonya. Kumelwe sivumele ukuphinwa kwenguqulo ukuze sigweme ukutheleleka okuzenzakalelayo ngokubuyekeza izinguqulo ukuze sithole ukulungiswa kobuthakathaka obubalulekile; ukuhlolwa okusheshayo nokuphumelelayo kokuxhomekeka okuqondile nokungaqondile ngesikhathi sokubuyekezwa kwenguqulo ukuze kube nobufakazi obanele bokuthi akugcwele i-malware. Izakhiwo zesofthiwe ezincike ezingxenyeni ezinobungozi ezaziwayo kumele zivinjwe. Futhi konke kumele kuphoqelelwe.
Sebenzisa ukuphina inguqulo, uma kungenzeka, njengoba kwenza ukwakheka kuphindeke kakhudlwana. Ukuphina inguqulo ngama-bumps enguqulo alawulwayo, avunyiwe ngesandla, Futhi esizwa ubuchwepheshe bokusiza, kufanele ihlole ukuthi isibuyekezo siletha i-malware noma siyaphula isofthiwe, futhi ivumelanise ukubuyekezwa kokulungisa ubuthakathaka nokugwema ukutheleleka kwe-malware. Amathuluzi angasiza lapha, (1) ngokubeka phambili ukuthi yiziphi ubuthakathaka ezibaluleke ngempela (ezifinyelelekayo nezingasetshenziswa, ezinengozi enkulu yokuqondiswa abahlaseli), (2) ukukhetha izinguqulo eziqondiwe ezihambisana nokusetshenziswa kwezingxenye zamanje futhi ezingaphuli isofthiwe, (3) ukukhetha izinguqulo eziqondiwe ezingenayo indlela yokuziphatha enonya, kanye (4) nokwenza isibuyekezo senguqulo sokuxhomekeka okuqondile nokungaqondile kube ngokushesha, ngokuphakamisa izinguquko kumafayela e-manifest ezingavunyelwa ngokushesha. Isinyathelo (3) sidinga ulwazi oluthile mayelana nezingxenye ezinonya eduze nesikhathi sazo sokushicilela ngangokunokwenzeka.
Le nqubo yokuvuselela ukuncika kumele ibe kuqiniswe futhi iqinisekisiwe kuzo zonke izindawo. Inqubo kumele ibhalwe phansi, futhi bonke abathintekayo kufanele baqeqeshwe, njengoba ngokuvamile ukuthuthukiswa kanye nokwakhiwa/ukusetshenziswa kwesofthiwe kuvele ngaphandle. CI/CD pipelines kufanele iguqulwe ngokufanele, ngakho-ke ukuzenzakalela akuvumeli ukuthembela okungaqondile okunonya ukuthi kungene ekwakhiweni: guardrails ukuvimba ukwakhiwa uma kukhona ubufakazi obanele bokuthi kukhona i-malware engaba khona ekuthembekeni kuyindlela enconywayo okufanele ilandelwe.
Uma inhlangano yakho inerejista yangaphakathi esebenza njengommeleli wokuphepha wokugcina izinguqulo zezingxenye ezivunyelwe, kufanele uthole ulwazi mayelana nezingxenye ezinonya (ngaphandle kwezinye izindlela) zokuhlola ingxenye eceliwe ngaphambi kokuyifaka ohlwini lwezibonelelo.
Ukusebenzisa isofthiwe yomthombo ovulekile ngokuphepha akulula, futhi isici se-malware kumele sicatshangelwe ngokugcwele, kanye nomzamo ofanayo owenziwe ekusingathweni kobuthakathaka.
Inothi lokugcina: Imvelaphi yomthombo, ngesimo sobufakazi besofthiwe, obukhiqizwe ngesikhathi sokwakhiwa kwengxenye, kungenye ingxenye ebalulekile emzamweni wokulandelela i-artifact (i-component tarball) nemithombo kanye nenqubo yokwakha eyikhiqizile. Qaphela ukuthi lesi sixhumanisi phakathi kwesithombe somthombo + indawo yokwakha kanye ne-software artifact ehlobene (esayinwe uhlelo lokwakha oluthembekile) asivimbeli ukuthi ingxenye ayinayo indlela yokuziphatha enonya, kodwa yenza kube nzima kubantu ababi ukufaka i-malware. Futhi ukwenza ukuqinisekiswa kwemvelaphi kube yisidingo esivamile sokudla izingxenye zomthombo ovulekile kuzothatha isikhathi eside, futhi kuphela okungeziwe muva nje ku-NPMUkwenza lezo zinhlelo zokwakha nokusabalalisa ezithembekile zingaphazamiseki, noma ukuvumela ukutholakala kwanoma yikuphi ukuphazamiseka ekwakhiweni kuyindaba ehlukile, engaphandle kobubanzi balokhu okuthunyelwe.
Ukufundwa Okwengeziwe
Isiqephu esilandelayo Amaphakheji Amabi Omthombo Ovulekile: Indlela ye-Xygeni sizokwethula isu esililandelayo eXygeni lethu Isexwayiso Sangaphambi Kwesikhathi Se-Malware uhlelo (MEW). Izinguqulo ezintsha zephakheji kuphakheji yomphakathi kanye nokubhaliswa kwezithombe ziyaskenwa futhi ubufakazi butholakala kusetshenziswa inhlanganisela yokuhlaziywa okungaguquki, okuguquguqukayo, kwamakhono, kanye nomongo. Ubufakazi, obuhlanganiswe nedumela lomsebenzisi kanye nomlando wezinguquko ezindaweni zokugcina amakhodi omthombo, buvumela ukuhlukaniswa okuzenzakalelayo kwengxenye ibe yizigaba ezinobungozi obukhulu futhi okungenzeka zibe nonya. Uhlelo lufunda ebufakazini obudlule obuqoqwe kumaphakheji ukuze kuncishiswe imiphumela engamanga ibe mincane.
Izinhlangano ezibhalisiwe zithola isaziso sesixwayiso sezingxenye ezizisebenzisayo, ngokuqondile noma ngokungaqondile, lapho inguqulo enonya ihlukaniswa ngezigaba. Bese kuba nokuhlaziywa ngesandla ngabahlaziyi bethu, okuqinisekisa noma okwenqaba ukuhlukaniswa. Ku-malware eqinisekisiwe, irejista yomphakathi iyaziswa ukuze ikwazi ukwenza ukuhlaziywa kwayo futhi ngokuvamile isuse inguqulo enonya noma ithathe isinyathelo esengeziwe, njengokuvimba noma ukususa i-akhawunti yomsebenzisi okukhulunywa ngayo.
Sizochaza ukuthi sisiza kanjani i-NPM, i-PyPI, i-GitHub, kanye nezinye izingqalasizinda ezibalulekile ohlelweni lomthombo ovulekile ukunciphisa isikhathi sokuhlala lapho ingxenye entsha enonya eshicilelwe ihlala isebenza kuze kube yilapho iqinisekisiwe ukuthi iyi-malware futhi isusiwe ebhukwini. Futhi ukuthi izinhlangano zingazuza kanjani ohlelweni lwe-MEW ukuze zibe nesivikelo esingcono kakhulu ekuhlaselweni kwe-software supply chain okubandakanya izingxenye zomthombo ovulekile.
- [1] Noma kunjalo, abasebenzisi bengxenye kudingeka bahlole ukuthi i-tarball yengxenye igcinwe yini noma ibhalisiwe ndawana thize, isibonelo kurejista yangaphakathi, ukuze lesi sifo siqedwe.
- [2] Ingxenye epakishiwe ifaka phakathi i-manifest ememezela okuqukethwe kwayo kanye ne-metadata, ikhodi yomthombo noma ehlanganisiwe, izikripthi zokufaka, nezinto ezengeziwe ezifana nama-test suites, ngokwefomethi yokupakisha futhi ngokuvamile ngesimo esicindezelwe. Lokhu kubizwa ngokuthi "i-tarball yengxenye".
- [3] Ngisho noma umenzi ononya engashintsha ingxenye eshicilelwe ngenxa yokwephulwa kwerejista uqobo, i-cryptographic digest endala ingathola noma yiluphi ushintsho ku-tarball ngemuva kokuthi ukuhlaziywa sekuqediwe.
- [4] Khumbula ukuthi ezinye izingxenye ezinonya zisebenza ngesikhathi sokufakwa, ngakho-ke kungathinta ama-node onjiniyela asebenzisa ngokungazi i-“npm install X” kanye ne-X ingxenye enonya.
