Imeko engapheliyo yoNgxamiseko: Xa "Ebaluleke kakhulu" Iba yingxolo emhlophe

Imeko eZinzileyo yoNgxamiseko: Xa "Ebalulekileyo" Iba yingxolo emhlophe

Ukuba umbutho wakho ubusaqhuba ii-Citrix NetScaler ADCs okanye iiGateways ekwindla yokugqibela, awuthathanga nje umngcipheko; ubusoloko uzimemela intlekele. Isilumkiso se-CISA esingxamisekileyo sosuku olubalulekileyo lwe-zero, i-CVE-2023-4966, eyaziwa ngokubanzi njenge "Citrix Bleed," yayingengomsebenzi wethiyori kulawulo lomngcipheko [1, 2]. Yayisisilumkiso esiqatha, isiqinisekiso esithe ngqo sokuba abahlaseli babesele bengaphakathi * kuthungelwano lwabo balibazise ukupeyishwa. Umhla we-27 ka-Oktobha 2023, umhla wokugqibela wokuba ii-arhente zomdibaniso zifake, zigunyaziswe yi-CISA Emergency Directive 23-02, ifikile kwaye yahamba [3]. Ukuba amaqumrhu omanyano, kunye nezixhobo zabo ezininzi kunye namaqela okhuseleko azinikeleyo, ajongana nemiceli mngeni ehlangabezana noko kujoliswe kuko, iqaqambisa uxinzelelo olukhulu kuye wonke umntu.

Oku akuyonto nje enye, ibug embi. Oku kumalunga nokungaphumeleli kwenkqubo ukubamba ubunzima "beziseko ezingundoqo" kwixesha ledijithali. Izixhobo zombane zeNetScaler zilingana nedijithali kumnyango oyintloko wokungena kwisakhiwo sakho, indawo yokukhangela yokhuseleko, kunye nenkqubo ye-HVAC zonke ziqengqeleke zaba nye. Bahlala kwi-perimeter, ukuphatha ukuqinisekiswa, ukulinganisa umthwalo, kunye nolawulo lwezithuthi. I-RCE (i-Remote Code Execution) kwisixhobo esinjalo asikokwaphulwa nje; kukuthathwa kwenkqubo epheleleyo, isitshixo esiyintloko esinikezelwe ngqo kumchasi. Sithetha ngohlobo lofikelelo oluvumela abahlaseli ukuba bangene ngaphandle kokuzama kuthungelwano lwangaphakathi, bakhuphe idatha ebuthathaka, okanye basebenzise i-ransomware ngokuchanekileyo ngotyando. Inyani yokuba i-CVE-2023-4966 yaxhatshazwa ngenkuthalo, ngoku ifakwe kwikhathalogu ye-CISA ye-KEV, ithetha ukuba ifestile yokhuselo olusebenzayo yavalwa ngokukhawuleza [1]. Imibutho yayingasaluthinteli uhlaselo; bebenciphisa isiganeko esiqhubekayo.

Umkhangeli zincwadi njengoMjikelo oMtsha: Umjikelo woBusichenge obungenasiphelo kwiChrome

Kwaye kanye xa ubucinga ukuba i-perimeter yenethiwekhi yakho kuphela kwento ephantsi kongqingo, uGoogle uhlala ebhengeza enye ibhombu: uxhaphaze ngeentsuku zero kwiChrome. Umzekelo, i-CVE-2024-4947, isiphene esibalulekileyo sohlobo lwe-V8, yayiyenye yezinto ezininzi ezixhatshaziweyo zobuthathaka ezifakwe kulo nyaka [4]. Oku asiyonto nje engenamsebenzi; yipateni ehambelanayo. Isiqwenga ngasinye esitsha, esihlala sikhatshwa sisibongozo esingxamisekileyo "sokuhlaziya ngokukhawuleza," sigxininisa into eyahlukileyo, kodwa efihlakeleyo ngokulinganayo, i-vector yokulalanisa. Ngelixa iNetScaler igada amasango, iChrome yindawo yokungena kuyo yonke indawo kwipokotho yomqeshwa ngamnye, kuyo yonke indawo yokusebenza, nakuyo yonke idesktop esekwe kwilifu.

Kangangeminyaka, sigxininise ukhuseleko lwesiphelo, kodwa isantya esiphezulu se-Chrome zero-days sikwenza kubonakale ngathi sihlala sisokola ukuqhubeka. Nganye kwezi buthathaka imele uhlaselo olunokubakho, iwebhusayithi ekhohlakeleyo, okanye uthungelwano lwentengiso oluchaphazelekileyo olukwaziyo ukwenza ikhowudi engafanelekanga kumatshini womsebenzisi. Ukusuka apho, yi-hop emfutshane ukuya kubusela, intshukumo esecaleni, okanye ukusasazwa kwe-malware entsonkothileyo. "Esona sikhangeli sidumileyo sewebhu" sikwangowona mhlaba udumileyo wohlaselo.

Inkohliso yoLawulo: Kutheni siqhubeka sisilela ngasemva

Ke, yintoni intambo eqhelekileyo apha? Asikuko nje ukuba ezi "ziyingozi" ezibuthathaka. Luhlobo oluqikelelwayo, oluphantse lufane nesiko lokufunyanwa nokuxhatshazwa kwabo. Sibanjelwe kwimeko yonxunguphalo engapheliyo, apho "ukufakela okungxamisekileyo" kuye kwaba yindlela yokusebenza engagqibekanga, endaweni yokukhetha.

Ngoba?

1. Ityala elintsonkothileyo: Zombini iNetScaler kunye neChrome ngamaqhekeza esoftware antsokothileyo. I-NetScaler, kunye nentaphane yeempawu zayo kunye nokudityaniswa, inika indawo enkulu yohlaselo. I-Chrome, ene-injini yeJavaScript (V8), i-injini yokubonelela, kunye nezongezo eziqhubekayo, yinto ekujoliswe kuyo eshukumayo yabaphandi bokhuseleko kunye nabahlaseli ngokufanayo. Ukuntsokotha kuzala iincukuthu, kwaye iincukuthu, ngokungaphephekiyo, zikhokelela ekubeni sesichengeni.
2. I-Advantage yoMhlaseli: Izizwe-zizwe kunye namaqela olwaphulo-mthetho anobugocigoci akalindanga ukubhengezwa koluntu. Bazingela ngokukhutheleyo ezi ziphene, rhoqo ngemithombo ebalulekileyo. Xa sele ifunyenwe, i-zero-day litikiti legolide, lixhatshazwa ngokuzolileyo de isiziba sinyanzelise isandla sabo. Inyaniso yokuba ezi zixhatshaziwe ngenkuthalo kuthetha ukuba abachasi sele bephambi kwegophe.
3. I-Patching Paralysis: Kwiziseko zophuhliso ezibalulekileyo ezifana ne-NetScaler, ukupeyinta kudla ngokuthetha ixesha lokuphumla, ukucwangcisa ngononophelo, kunye nolungelelwaniso kumaqela amaninzi. Kumashishini amakhulu, oku kunokuba liphupha elibi le-bureaucratic. KwiChrome, ilula, kodwa isaxhomekeke ekuthotyelweni kwabasebenzisi okanye kulawulo olomeleleyo oluphakathi. Ingqondo ethi "yibeke kwaye uyilibale", okanye okubi ngakumbi, indlela "siya kufika kuyo kwikota elandelayo", yindlela yokulungelelanisa. Umhla wokugqibela we-CISA we-NetScaler, ngoku udlulile, sisikhumbuzo esicacileyo sale inertia.
4. Ukhuseleko njengoQoqosho lwasemva: Ngaphandle kwazo zonke iintetho ezithethwayo, ukhuseleko lusabonwa kakhulu njengeziko leendleko, umqobo ekuqaliseni izinto ezintsha, okanye ingxaki ekufuneka isonjululwe emva kolwaphulo-mthetho. Utyalo-mali ekuzingeleni okukhawulezileyo kwezigrogriso, ulawulo oluluqilima lokuba sesichengeni, kunye nemfundo yokhuseleko ethe gqolo ilula xa kuthelekiswa noqhankqalazo oluqhubekayo lwasemva kwesehlo.

Ngaphaya kwePatch: Ikhwelo lokuHlwa ngokutsha koBuchule

Ukuxelela nje umbutho ukuba "ufake ngokukhawuleza" kufana nokuxelela umntu onzima emanzini ukuba "aqubhe ngakumbi." Kuyimfuneko, kodwa ayilungiseleli ingxaki esisiseko. Sidinga utshintsho olusisiseko kwindlela esilujonga ngayo ukhuseleko.

• Cinga uKulalanisa: Imodeli endala yokhuselo yomjikelezo ifile. Cinga ukuba iNetScaler *yaphuliwe. Cinga ukuba iibrowser zeChrome zabasebenzisi bakho *ziya kuxhatshazwa. Qalisa ulwahlulo lwenethiwekhi olomeleleyo, ukufikelela kwilungelo elincinci, kunye nokubeka iliso okuqhubekayo kumsebenzi ongaqhelekanga. Ukuzingela isoyikiso asinto yanto; yimfuneko. Jonga imiqondiso efihlakeleyo: uqhagamshelo olungaqhelekanga oluphumayo oluvela kwi-NetScaler yakho, ii-akhawunti zabasebenzisi abatsha, uphumezo lwenkqubo engalindelekanga.
• Yenzeka ngokuzenzekela yonke into enokwenzeka: Ulawulo lweepetshi zeendawo eziphelayo ezifana neChrome kufuneka luzenzekele ngokupheleleyo kwaye lunyanzeliswe. Kwiziseko ezingundoqo ezifana ne-NetScaler, ngelixa inzima ngakumbi, inkqubo kufuneka ihlaziywe, ivavanywe, kwaye iphinde iphindwe. Ukuphumla kohlaziyo lokhuseleko kufuneka kucwangciswe kwaye kwamkelwe njengeendleko zokwenza ishishini, kungaphetshwa kuzo zonke iindleko.
• Tyalo-mali kwi-Resilience, Hayi nje uThintelo: Izicwangciso zokuphendula zezehlo kufuneka zivavanywe edabini. Ngaba unokuyibona impazamo ngokukhawuleza? Ungasiqulatha? Ngaba unokuchacha ngaphandle kokuhlawula intlawulelo? Le yimibuzo ebalulekileyo xa uthintelo lusilela ngokungaphephekiyo.
• Funa iNgcono kubathengisi: Ngelixa uGoogle echwetheza, umthamo opheleleyo weentsuku zero kwiChrome ucebisa imfuno yophononongo olunzulu lolwakhiwo kwaye mhlawumbi nenkqubo yebhonasi yebug endlongondlongo yangaphakathi. Kubathengisi beziseko ezingundoqo abanjengoCitrix, ulindelo kufuneka lube phezulu nangakumbi. Iimveliso zabo zingumqolo wemisebenzi yeshishini.

Inyaniso kukuba, ezi ayizoziganeko zodwa. Ziimpawu zedijithali ecosystem phantsi kohlaselo oluqhubekayo, oluntsonkothileyo. Izilumkiso "ezibalulekileyo" ziya kuhlala zisiza. Umbuzo awungokuthi ukuba umbutho wakho uya kujoliswa, kodwa ninini, kwaye nokuba uye wadlulela ngaphaya kwe-reactive scramble ukwakha ukhuselo olomelele ngokwenene. Ukuba umhla wokugqibela we-CISA we-NetScaler awukhange uphucule isicwangciso sakho sokhuseleko, lixesha lokuphinda uphonononge kwakhona.

Imithombo

[1] Ikhathalogu eyaziwayo ye-CISA eSebenzisiweyo yokuSebenziswa koBugcisa — https://www.cisa.gov/known-exploited-vulnerabilities-catalog [2] Abadlali bezoyikiso abaSebenzisa iCitrix NetScaler ADC kunye neCitrix NetScaler Gateway Vulnerability (CVE-2023-4966) - https://www.cisa.gov/news-events/alerts/2023/10/05/threat-actors-exploiting-citrix-netscaler-adc-and-citrix-netscaler-gateway-vulnerability [3] I-Emergency Directive 23-02: Nciphisa iCitrix NetScaler ADC kunye neGateway Vulnerability — https://www.cisa.gov/news-events/directives/emergency-directive-23-02-mitigate-citrix-netscaler-adc-and-gateway-vulnerability [4] Uhlaziyo lwesitishi oluZinzile lweDesktop (CVE-2024-4947) — https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html [5] I-Citrix NetScaler ADC kunye neCitrix NetScaler Gateway Security Bulletin ye-CVE-2023-4966 kunye neCVE-2023-4967 - https://support.citrix.com/article/CTX579459/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967