Ofufuza a GitGuardian asindikiza zotsatira za kusanthula kwawo kwachinsinsi chomwe chinasiyidwa ndi omanga mu code yomwe ili pa Python Package Index (PyPI) yosungirako. Atayang'ana mafayilo opitilira 9.5 miliyoni ndi ma phukusi 5 miliyoni okhudzana ndi ma projekiti 450, adazindikira kutayikira kwachinsinsi 56866. Poganizira zapadera zokhazokha, kupatula kubwereza zomwe zatulutsidwa, kuchuluka kwa zotulutsa zomwe zadziwika zinali 3938, ndipo kuchuluka kwa mapulojekiti omwe ali ndi kutayikira kumodzi kunali 2922.
Ponseponse, mitundu yopitilira 150 yazidziwitso zachinsinsi idadziwika, kuphatikiza mapasiwedi wamba, makiyi a cryptographic, ma tokeni ofikira mautumiki amtambo, machitidwe ophatikizika mosalekeza, ndi ma API. Osachepera zidziwitso za 768 zidakhalabe zovomerezeka panthawi yophunzira. Zitsanzo za kutayikira wamba komwe kumakhalabe kovomerezeka kumaphatikizapo makiyi ofikira a Azure Active Directory, SSH, MongoDB, MySQL, ndi zidziwitso za PostgreSQL, GitHub OAuth App, Dropbox, ndi makiyi a Auth0, ndi makiyi a Coinbase ndi Twilio.
Pakati pa mitundu yochulukirachulukira yochulukira, ma tokeni ofikira a Telegraph bot atchulidwa, kuchulukaku kuwirikiza kawiri koyambirira kwa 2021 ndiyeno kuwirikizanso mu kasupe 2023. Kuchulukira kosalekeza kwa kutayikira kwalembedwanso kwa makiyi ofikira a Google API kuyambira 2020, komanso zidziwitso zadongosolo la database kuyambira 2022, ma phukusi ambiri amatulutsidwa. zotchulidwa, ndi makiyi 209 OpenAI ndi 320 Google Cloud makiyi akutsitsidwa.
Kuphatikiza pa mafayilo omwe ali ndi ".py" yowonjezera, mitundu ya mafayilo omwe ali ndi zowonongeka zambiri kuphatikizapo .json (610 leaks), .md (270), PKG-INFO (240), METADATA (210), .txt (170), README owona (209), ndi mafayilo ochokera ku zolemba zotchedwa test (675). Kutulutsa kochulukira kudachitikanso chifukwa choyang'anira ndi zolakwika pamakonzedwe opatula mafayilo popanga mapaketi. Mwachitsanzo, mafayilo omwe ali ndi mafayilo amtundu wamba (.cookiecutterrc, .env, .pypirc, etc.) akhoza kuchotsedwa ku Git repository kudzera pa fayilo ".gitignore", zomwe sizimaganiziridwa popanga phukusi. Makamaka, mafayilo a 43 .pypirc adapezeka m'malo osungirako zinthu, omwe ali ndi zizindikiro zopezera PyPI. Pamilandu 15 yotayikira, opanga analibe cholinga chotulutsa mapaketi omwe adapangidwa kuti agwiritse ntchito mkati, koma adawasindikiza pa PyPI molakwika.
Kuphatikiza apo, zochitika zina ziwiri zokhudzana ndi PyPI ziyenera kutchulidwa:
- Maphukusi oyipa asanu ndi atatu adapezeka m'malo osungiramo PyPI, omwe amati ndi zida zowonera, kapena kusokoneza ma code, zomwe zimapangitsa kuti zikhale zovuta kupanganso ma algorithm oyambira. Maphukusi omwe adapezekawo anali ndi zingwe "pyobf" m'maina awo (Pyobftoexe, Pyobfusfile, Pyobfexecute, Pyobfpremium, Pyobflight, Pyobfadvance, Pyobfuse, ndi pyobfgood) ndipo adatsitsidwa nthawi zopitilira 2000.
Khodi yoipa yomwe idaphatikizidwa m'maphukusi inali yokhudzana ndi nsanja Windows ndipo analola kulumikizana ndi chowongolera chakunja seva, yendetsani malamulo okhwima pa kompyuta ya wopanga mapulogalamu, pezani ndikutumiza zambiri zachinsinsi, monga makiyi olowera, ku seva yakunja, ndikusamutsa mafayilo okhwima kuchokera ku dongosololi. Kuphatikiza apo, khodi yoyipa ikhoza kugwira ntchito ngati keylogger, kuletsa mawu achinsinsi omwe alowetsedwa mu Chrome, kupanga zithunzi, kujambula mawu, komanso kuwongolera webcam.
- Zotsatira za kafukufuku wodziyimira pawokha wa codebase pazida zomwe zimagwiritsidwa ntchito poyang'anira pypi.org ndi "cabotage" chimango, chomwe chimapereka mphamvu zopangira zida, zasindikizidwa. Kafukufukuyu adachitika mothandizidwa ndi bungwe lopanda phindu la OTF (Open Technology Fund). Kufufuzako sikunapeze zovuta zazikulu, ndipo code code inapezedwa kuti ikukwaniritsa zofunikira zolembera zotetezeka. Komabe, kuyesedwa kosakwanira kwa codebase ya cabotage kunadziwika, ndipo nkhani za 29 zinadziwika, zisanu ndi zitatu zomwe zinayesedwa kuti ndizochepa, zisanu ndi chimodzi zotsika, ndi 14 monga uphungu.
Mavuto odziwika kwambiri ndi awa:
- Kusatsimikizika kokwanira kwa siginecha za digito zomwe zimagwiritsidwa ntchito kuphatikiza PyPI ndi AWS SNS zidalola kuti zidziwitso za imelo zitumizidwe kwa ogwiritsa ntchito payekha.
- Kuchulukirachulukira kwazomwe mukutsitsa kumalola kukhalapo kwa akaunti kutsimikiziridwa popanda kutulutsa zochitika zolowera.
- Kugwiritsa ntchito ma hashes ofooka a cryptographic omwe samapatula kuwononga poyizoni.
- Ndi chilolezo choyendetsa njira zomanga kudzera pa cabotage, wowukira atha kupeza m'malo mwa lamulo.
- Ndi ufulu wotumizira mu cabotage, wowukira atha kuyika chithunzi chowoneka chovomerezeka.
Source: opennet.ru
