Yanayin Gaggawa na dindindin: Lokacin da "Mahimmanci" Ya Zama Farin Surutu
Idan har yanzu ƙungiyar ku tana gudana Citrix NetScaler ADCs ko Ƙofar ƙofofin da ba a buɗe ba, ba kawai kuna cikin haɗari ba; kuna gayyata bala'i sosai. Faɗakarwar gaggawa ta CISA don mahimmancin ranar sifili, CVE-2023-4966, wanda aka fi sani da "Citrix Bleed," ba motsa jiki ba ne a cikin sarrafa haɗari [1, 2]. Gargadi ne mai tsauri, tabbatar da kai tsaye cewa maharan sun riga sun kasance * cikin * cibiyoyin sadarwar wadanda suka jinkirta faci. Ranar 27 ga Oktoba, 2023, ranar ƙarshe ga hukumomin tarayya don faci, wanda umarnin CISA na gaggawa 23-02 ya ba da umarni, ya zo ya tafi [3]. Idan ƙungiyoyin tarayya, tare da ɗimbin albarkatunsu da ƙungiyoyin tsaro masu sadaukarwa, sun fuskanci ƙalubalen cimma irin wannan manufa, hakan yana nuna babban matsin lamba ga kowa.
Wannan ba game da guda ɗaya bane, kwaro mara kyau. Wannan shine game da gazawar tsari don fahimtar girman "mahimman abubuwan more rayuwa" a zamanin dijital. Na'urorin NetScaler sune na dijital daidai da babban ƙofar ginin ku, wurin binciken tsaro, da tsarin HVAC duk an mirgine su ɗaya. Suna zaune a kewaye, suna sarrafa tantancewa, daidaita kaya, da sarrafa zirga-zirga. RCE (Kisa Lambobin Nesa) akan irin wannan na'urar ba karya ce kawai ba; yana da cikakken tsarin kwace, babban maɓalli wanda aka mika kai tsaye ga abokin gaba. Muna magana ne game da irin damar da ke bawa maharan damar shiga cikin cibiyoyin sadarwa na ciki, fitar da bayanai masu mahimmanci, ko tura ransomware tare da madaidaicin tiyata. Gaskiyar cewa CVE-2023-4966 * an yi amfani da shi sosai *, yanzu an sanya shi a cikin kundin CISA's KEV, yana nufin taga don kare kariya da sauri [1]. Kungiyoyi sun daina hana kai hari; suna sassauta wani lamari da ke gudana.
Mai Rarraba Mai Rarraba A Matsayin Sabon Wuta: Chrome's Cycle Vulnerability Mararshe
Kuma daidai lokacin da kuka yi tunanin kewayen hanyar sadarwar ku shine kawai abin da ke ƙarƙashin kewaye, Google a kai a kai yana ba da sanarwar wani bam: kwanakin da aka yi amfani da shi a cikin Chrome. Misali, CVE-2024-4947, nau'in nau'in rudani na V8 mai mahimmanci, ɗaya ne kawai daga cikin raunin raunin da aka yi amfani da shi sosai * a wannan shekara* [4]. Wannan ba fasikanci ba ne; daidaitaccen tsari ne. Kowane sabon faci, sau da yawa yana tare da roƙon gaggawa don "sabuntawa nan da nan," yana haskaka wani daban, duk da haka madaidaici, yanayin sasantawa. Yayin da NetScaler ke gadin ƙofofin, Chrome shine wurin shiga ko'ina a cikin aljihun kowane ma'aikaci, akan kowane wurin aiki, kuma a cikin kowane tebur mai kama da girgije.
Tsawon shekaru, mun jaddada tsaron ƙarshen ƙarshen, amma tsananin saurin kwanakin sifili na Chrome yana sa ya zama kamar koyaushe muna ƙoƙarin ci gaba. Kowane ɗayan waɗannan raunin yana wakiltar yuwuwar harin tuƙi, gidan yanar gizo mara kyau, ko wata hanyar sadarwar talla da ke da ikon aiwatar da lambar sabani akan na'urar mai amfani. Daga can, ɗan gajeren bege ne ga sata na gaskiya, motsi a gefe, ko tura ƙarin nagartaccen malware. "Mafi shaharar gidan yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizon yanar gizo" kuma, a tsawo, shine mafi shaharar saman kai hari a duniya.
Haƙiƙan Ƙarfafawa: Me Yasa Muke Ci Gaba Da Faduwa A Baya
To, mene ne zaren gama gari a nan? Ba wai kawai waɗannan lahani ne na "masu mahimmanci" ba. Yana da abin da ake iya faɗi, kusan dabi'ar al'ada na gano su da cin gajiyar su. An kama mu a cikin madawwamin dokar ta-baci, inda "faci cikin gaggawa" ya zama yanayin aiki na asali, maimakon keɓantawa.
Me yasa?
- ** Bashi Mai Haɗuwa:** Dukansu NetScaler da Chrome suna da sarƙaƙƙiya na software. NetScaler, tare da ɗimbin fasalulluka da haɗe-haɗe, yana gabatar da sararin kai hari. Chrome, tare da injinsa na JavaScript (V8), injin mai samarwa, da ƙari na fasali akai-akai, manufa ce mai motsi ga masu binciken tsaro da masu kai hari iri ɗaya. Rudani yana haifar da kwari, kuma kwari, babu makawa, suna haifar da rashin ƙarfi.
- Fa'idar Maharin: Kasashe-kasashe da manyan kungiyoyin masu aikata laifuka ba sa jiran fitowar jama'a. Suna farautar waɗannan kurakuran, galibi tare da mahimman albarkatu. Da zarar an same shi, ranar sifili tikitin zinare ne, ana amfani da shi a hankali har sai wani faci ya tilasta musu hannu. Kasancewar waɗannan an yi amfani da su sosai yana nufin maƙiyan sun riga sun riga sun yi gaba.
- Patching Paralysis: Don mahimman abubuwan more rayuwa kamar NetScaler, faci sau da yawa yana nufin raguwar lokaci, tsarawa a hankali, da daidaitawa tsakanin ƙungiyoyi da yawa. A cikin manyan kamfanoni, wannan na iya zama mafarki mai ban tsoro na bureaucratic. Ga Chrome, ya fi sauƙi, amma har yanzu yana dogara ga bin mai amfani ko ingantaccen tsarin gudanarwa. Hankalin "saita shi kuma manta da shi", ko mafi muni, "za mu kai shi kwata na gaba", tsari ne na sasantawa. Ƙayyadaddun lokaci na CISA na NetScaler, yanzu ya wuce, babban tunatarwa ne na wannan rashin aiki.
- Tsaro A Matsayin Bayan Tunani: Duk da irin maganganun da ake yi, har yanzu ana yawan kallon tsaro a matsayin cibiyar tsadar kayayyaki, ko cikas ga ƙirƙira, ko kuma wata matsala da za a iya magance ta bayan an warware ta. Saka hannun jari a farautar barazanar farauta, ingantaccen sarrafa rauni, da ci gaba da ilimin tsaro sau da yawa ba su da kyau idan aka kwatanta da abin da ya faru bayan aukuwar lamarin.
Bayan Faci: Kira don Gyara Dabarun
Kawai gaya wa ƙungiya ta “faci nan da nan” kamar gaya wa wanda ke fafitikar a cikin ruwa mai zurfi ya “yi iyo sosai.” Ya zama dole, amma baya magance matsalar da ke cikin tushe. Muna buƙatar canji na asali kan yadda muke fuskantar tsaro.
- Daukacin Rarraba: Tsohon tsarin tsaro na kewaye ya mutu. A ɗauka cewa NetScaler * an keta shi. A ɗauka * za a yi amfani da masu binciken Chrome ɗin ku. Aiwatar da ƙaƙƙarfan rabuwar hanyar sadarwa, mafi ƙarancin dama, da ci gaba da sa ido don ayyukan da ba su da kyau. Barazana farauta ba abin alatu ba ne; larura ce. Nemo alamomin dabara: hanyoyin haɗin waje da ba a saba gani ba daga NetScaler ɗinku, sabbin asusun mai amfani, aiwatar da aiwatar da ba zato ba tsammani.
- Mai sarrafa duk abin da zai yiwu: Gudanar da facin don wuraren ƙarewa kamar Chrome yakamata ya zama mai sarrafa kansa da aiwatar da shi gabaɗaya. Don mahimman abubuwan more rayuwa kamar NetScaler, yayin da ya fi rikitarwa, tsarin yana buƙatar daidaitawa, gwadawa, da maimaitawa. Yakamata a shirya kuma a yarda da ƙarshen lokacin sabunta tsaro a matsayin farashin yin kasuwanci, ba a guje wa kowane farashi ba.
- ** Zuba hannun jari a cikin juriya, Ba Rigakafi kawai ba: ** Ana buƙatar gwajin yaƙi da shirye-shiryen martanin aukuwa. Shin za ku iya gano karya da sauri? Za ku iya ɗaukar shi? Za ku iya murmurewa ba tare da biyan fansa ba? Waɗannan su ne tambayoyin da ke da mahimmanci lokacin da rigakafin ya gaza.
- ** Buƙatar Mafi Kyau daga Dillalai:** Yayin da Google ke yin faci, yawan adadin kwanakin sifili a cikin Chrome yana nuna buƙatar zurfin sake dubawa na gine-gine da watakila ƙarin shirin fa'idar bug na ciki. Ga masu siyar da kayan more rayuwa masu mahimmanci kamar Citrix, tsammanin yakamata ya zama mafi girma. Samfuran su a zahiri su ne ƙashin bayan ayyukan kasuwanci.
Gaskiyar ita ce, waɗannan ba warewar al'amura ba ne. Alamun yanayin yanayin dijital ne a ƙarƙashin hari na yau da kullun, nagartaccen hari. Faɗakarwar "mafi mahimmanci" za ta ci gaba da zuwa. Tambayar ba idan ƙungiyar ku za ta yi niyya ba ne, amma lokacin, da kuma ko kun ƙaura fiye da ƙwaƙƙwaran ƙwaƙƙwaran don gina ingantaccen tsaro. Idan lokacin ƙarshe na CISA don NetScaler bai inganta dabarun tsaro ba, lokaci yayi da za a sake kimantawa sosai.
Sources
[1] CISA Sanann An Yi Amfani da Lalacewar Rashin Lafiya - https://www.cisa.gov/known-exploited-vulnerabilities-catalog [2] Masu Barazana Suna Amfani da Citrix NetScaler ADC da Citrix NetScaler Gateway Rauni (CVE-2023-4966) - https://www.cisa.gov/news-events/alerts/2023/10/05/threat-actors-exploiting-citrix-netscaler-adc-and-citrix-netscaler-gateway-vulnerability [3] Umarnin gaggawa 23-02: Rage Citrix NetScaler ADC da Ƙofar Ƙofar - https://www.cisa.gov/news-events/directives/emergency-directive-23-02-mitigate-citrix-netscaler-adc-and-gateway-vulnerability [4] Sabunta tashar Tashoshi don Desktop (CVE-2024-4947) - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html [5] Citrix NetScaler ADC da Citrix NetScaler Gateway Tsaro Bulletin don CVE-2023-4966 da CVE-2023-4967 - https://support.citrix.com/article/CTX579459/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967