Xaaladda Degdegga ah ee Joogtada ah: Marka "Xaaladda" ay noqoto buuq cad
Haddii ururkaagu uu wali ku shaqaynayey Citrix NetScaler ADC-yada ama Gateways-yada dayrtii hore, ma aadan ahayn halis; waxaad si firfircoon u casuuntay musiibo. Digniinta degdega ah ee CISA ee eber-maalinta xasaasiga ah, CVE-2023-4966, oo si weyn loogu yaqaan "Citrix Bleed," ma ahayn jimicsi aragtiyeed maaraynta khatarta [1, 2]. Waxay ahayd digniin culus, oo si toos ah u xaqiijinaysa in weerarradu ay horeba ugu jireen shabakadaha kuwa dib u dhigay balastarrada. Oktoobar 27, 2023, kama dambaysta ah ee wakaaladaha federaalku inay balastar ku sameeyaan, oo ay waajibisay Awaamiirta Degdegga ah ee CISA 23-02, way timid oo tagtay [3]. Haddii hay'adaha federaaliga ah, oo wata kheyraadkooda la taaban karo iyo kooxaha amniga u heellan, ay la kulmaan caqabado ka hortagaya bartilmaameedyadaas, waxay muujineysaa cadaadiska weyn ee saaran qof kasta oo kale.
Kani maaha oo kaliya hal, kutaan xun. Tani waxay ku saabsan tahay guuldarada habaysan ee lagu ogaanayo culayska "kaabayaasha muhiimka ah" ee da'da dhijitaalka ah. Qalabka NetScaler waa dhijitaalka u dhigma albaabka weyn ee dhismahaaga, barta koontaroolka, iyo nidaamka HVAC dhamaantood mid baa la isku rogay. Waxay fadhiyaan hareeraha, iyagoo gacanta ku haya xaqiijinta, isku dheelitirnaanta rarka, iyo maamulka taraafikada. RCE (Execution Code Fog) ee qalabkan oo kale kaliya ma aha jebinta; waa nidaam buuxa oo la wareegay, fure sayid ah oo si toos ah loogu dhiibay cadawga. Waxaan ka hadlaynaa nooca gelitaanka u oggolaanaya weeraryahannada inay si dadaal la'aan ah u galaan shabakadaha gudaha, ka faa'iidaystaan xogta xasaasiga ah, ama geeyaan ransomware si sax ah qalliin. Xaqiiqda ah in CVE-2023-4966 * si firfircoon looga faa'iidaysanayay*, oo hadda lagu xardhay buug-yaraha CISA's KEV, macneheedu waxa weeye in daaqadda difaaca firfircooni ay si degdeg ah u xidhan tahay [1]. Ururadu hadda kama ay hortagayn weerar; waxay yareeyeen dhacdo socota.
Browser-ka oo ah Wareegta Cusub: Wareegga Nuglaanta aan dhamaadka lahayn ee Chrome
Oo kaliya markii aad u malaysay in wareegga shabakadaada ay tahay waxa kaliya ee lagu hareeraysan yahay, Google ayaa si joogto ah ugu dhawaaqaysa bam kale: si firfircoon looga faa'iidaysto eber-maalmood gudaha Chrome. Tusaale ahaan, CVE-2024-4947, oo ah cillad jahawareerka nooca V8 ee muhiimka ah, wuxuu ahaa mid ka mid ah dhowr dayacan oo si firfircoon looga faa'iideystay oo la dhejiyay sanadkan [4]. Kani ma aha qalqal; waa qaab joogto ah. Qalab kasta oo cusub, oo inta badan ay la socoto codsiga degdegga ah ee ah " isla markiiba dib u cusboonaysii," waxay muujinaysaa mid ka duwan, laakiin si siman u dhaga-nuglaaday, oo ah fal-celinta tanaasulka. Iyadoo NetScaler ay ilaaliso albaabbada, Chrome waa meesha laga soo galo jeebka shaqaale kasta, goob kasta oo shaqo, iyo miis kasta oo daruuri ku salaysan.
Muddo sanado ah, waxaan xooga saarnay amniga barta dhamaadka, laakiin xawaraha badan ee maalmaha eber-ka Chrome ayaa ka dhigaya inaan dareemeyno inaan si joogto ah ugu halgameyno inaan sii wadno. Mid kasta oo ka mid ah dayacankaani wuxuu u taagan yahay weerar lagu kaxeyn karo, degel xaasidnimo ah, ama shabakad xayeysiis ah oo la dhibay oo awood u leh inay fuliso kood aan sabab lahayn mashiinka isticmaalaha. Halkaa, waa rajo gaaban oo ku saabsan xatooyada aqoonsiga, dhaqdhaqaaq lateral, ama dirida malware aad u casrisan. "Brawsarraha shabakadda ugu caansan adduunka" sidoo kale, kordhinta, dusha sare ee weerarka ugu caansan adduunka.
dhalanteedka Xakamaynta: Waa maxay sababta aan gadaal uga dhacayno
Haddaba, waa maxay mawduuca guud ee halkan? Kaliya maaha inay kuwani yihiin baylahda "muhiimka ah". Waa saadaasha la saadaalin karo, oo ku dhow dabeecadda dhaqan ee helitaankooda iyo ka faa'iidaysigooda. Waxa aanu ku jirnaa xaalad degdeg ah oo weligeed jirta, halkaas oo "bogdhig deg-deg ah" ay noqotay habka hawlgelinta ee caadiga ah, halkii ay ka reebi lahayd.
Waa maxay sababtu?
- ** Amaah Kakanaanta:** NetScaler iyo Chrome labaduba waa qaybo software ah oo aad u adag. NetScaler, oo leh sifooyinkeeda tirada badan iyo isku-dhafka, waxay soo bandhigaysaa weerar ballaaran. Chrome, oo wata mishiinkiisa JavaScript (V8), mishiin wax-soo-saarka, iyo ku-kordhinta joogtada ah, waa bartilmaameed dhaqaaqa ee cilmi-baarayaasha amniga iyo kuwa weerarka soo qaadayba. Kakanaanta waxay dhalisaa dhiqlaha, iyo dhiqlaha, lama huraan, waxay horseedaan baylahda.
- Faa'iidada Weeraryahan: Waddamada-Qaranka iyo kooxaha dambiilayaasha ah ee casriga ah ma sugayaan siidaynta dadweynaha. Waxay si firfircoon u ugaarsanayaan cilladahan, oo inta badan leh ilo muhiim ah. Marka la helo, eber-maalin waa tigidh dahabi ah, oo si degan looga faa'iidaysto ilaa balastar gacantooda ku xoogaysato. Xaqiiqda ah in kuwan si firfircoon looga faa'iidaysto waxay la macno tahay in cadawgu mar horeba ka horreeyaan qalooca.
- Patching Paralysis: Kaabayaasha muhiimka ah sida NetScaler, balaadhintu waxay inta badan la macno tahay wakhti dhimis, qorshayn taxadir leh, iyo iskudubarid kooxo badan. Shirkadaha waaweyn, tani waxay noqon kartaa qarow xafiiseed. Chrome-ka, way u fududdahay, laakiin wali waxay ku tiirsan tahay u hoggaansanaanta isticmaalaha ama maamulka dhexe ee adag. Maskaxda "deji oo iska ilow", ama ka sii daran, habka "waxaan gaari doonaa rubuc soo socda", waa hab lagu helo tanaasul. Wakhtiga kama dambaysta ah ee CISA ee NetScaler, hadda waa la dhaafay, waa xasuusin adag oo ku saabsan firfircooni-darradan.
- Amniga sida Fikirka Dabadeed: In kasta oo ay jiraan dhammaan hal-ku-dhigyada, amniga ayaa weli inta badan loo arkaa xarun kharash, caqabad ku ah hal-abuurnimada, ama dhib la xalliyo kadib jebinta. Maalgelinta ugaadhsiga khatarta ah ee firfircoon, maaraynta nuglaanshaha adag, iyo waxbarashada amniga ee joogtada ah ayaa badanaa la barbar dhigo falcelinta falcelinta kacdoonka ka dib dhacdada.
Marka laga reebo balastar: Baaq ku saabsan dib-u-habayn istaraatiijiyadeed
Kaliya u sheeg ururku inuu "dhakhso u balaadho" waxay la mid tahay inaad u sheegto qof ku dhibtoonaya biyo qoto dheer inuu "si adag u dabaasho." Waa lagama maarmaan, laakiin ma xallinayso dhibaatada hoose. Waxaan u baahanahay isbedel aasaasi ah oo ku saabsan sida aan u wajaheyno amniga.
- Ka soo qaad tanaasul: Qaabkii hore ee difaaca wareegga waa dhintay. Ka soo qaad NetScaler-kaaga * in la jabiyay. Ka soo qaad isticmaalayaasha Chrome browserka * in* laga faa'iidaysan doono. Hirgeli kala qaybinta shabakada adag, gelitaanka mudnaanta ugu yar, iyo la socodka joogtada ah ee dhaqdhaqaaqa aan caadiga ahayn. Ugaadhsiga khatarta ahi maaha raaxo; waa lama huraan. Ka raadi calaamadaha daahsoon: isku xirka dibadda aan caadiga ahayn ee NetScaler kaaga, xisaabaadka isticmaale ee cusub, nidaamka fulinta lama filaanka ah.
- Automate wax kasta oo suurtagal ah: Maaraynta balastar ee meelaha dhamaadka sida Chrome waa in si buuxda loo toosiyaa oo la dhaqan geliyo. Kaabayaasha muhiimka ah sida NetScaler, iyadoo aad u adag, geeddi-socodku wuxuu u baahan yahay in la hagaajiyo, la tijaabiyo, oo lagu celceliyo. Wakhtiga dhimista ee cusboonaysiinta amniga waa in la qorsheeyaa oo la aqbalaa sidii kharash ganacsi, oo aan laga fogaanin kharash kasta.
- Maalgelinta adkeysiga, kaliya maahan ka-hortagga: Qorshayaasha ka jawaabida dhacdada waxay u baahan yihiin in la tijaabiyo. Dhaqso ma u ogaan kartaa jebinta? Ma ka koobnaan kartaa? Ma bogsan kartaa adigoon bixin madax furasho? Kuwani waa su'aalaha muhiimka ah marka ka-hortagga ay si lama filaan ah u fashilmaan.
- ** Dalbado ka Wanaagsan Iibiyayaal:** Iyadoo Google uu wax ku dhejinayo, tirada maalmaha eber ee Chrome waxay soo jeedinaysaa baahida loo qabo dib u eegista qaab dhismeedka qoto dheer iyo laga yaabee barnaamij deeqsinimo ah oo gudaha ah oo dagaal badan. Iibiyeyaasha kaabayaasha muhiimka ah sida Citrix, rajadu waa inay ahaataa mid ka sii sareysa. Wax soo saarkoodu dhab ahaantii waa laf-dhabarta hawlaha ganacsiga.
Xaqiiqdu waxay tahay, kuwani maaha dhacdooyin gooni-gooni ah. Waxay yihiin calaamadaha nidaamka deegaanka dhijitaalka ah ee hoos yimaada weerarka casriga ah ee joogtada ah. Digniinaha "muhiimka ah" ayaa sii socon doona. Su'aashu maaha haddii ururkaaga la beegsan doono, laakiin goorma, iyo haddii aad ka gudubtay falcelinta falcelinta si aad u dhisto difaac dhab ah oo adkaysi leh. Haddii wakhtiga kama dambaysta ah ee CISA ee NetScaler aysan dajin istiraatiijiyaddaada amniga, waa waqtigii dib-u-qiimeyn dhab ah.
Ilaha
[1] CISA-da la yaqaan ee dayacanka laga faa'iidaysto - https://www.cisa.gov/known-exploited-vulnerabilities-catalog [2] Jilayaasha Khatarta ah ee ka faa'iidaysanaya Citrix NetScaler ADC iyo Citrix NetScaler Gateway Nuglaanta (CVE-2023-4966) - https://www.cisa.gov/news-events/alerts/2023/10/05/threat-actors-exploiting-citrix-netscaler-adc-and-citrix-netscaler-gateway-vulnerability [3] Dardaaranka degdega ah 23-02: Yaraynta Citrix NetScaler ADC iyo Nuglaanta Gateway - https://www.cisa.gov/news-events/directives/emergency-directive-23-02-mitigate-citrix-netscaler-adc-and-gateway-vulnerability [4] Cusboonaysiinta Kanaalka Deggan ee Desktop (CVE-2024-4947) - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html [5] Citrix NetScaler ADC iyo Citrix NetScaler Gateway Bulletin Security ee CVE-2023-4966 iyo CVE-2023-4967 - https://support.citrix.com/article/CTX579459/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967