Kwanaki Sifili da Kulawar Sifili: Labarin Haƙiƙanin Fasaha Biyu
Ka yi tunanin ƙungiyar SOC ɗin ku, masu ɓarkewar ido, suna kallon faɗakarwa ja mai walƙiya. Yana da 3 AM a cikin Oktoba 2023, kuma labarin ba shi da kyau: kwanaki biyu masu mahimmanci a cikin Citrix NetScaler ADC da Ƙofar ku, an yi amfani da su sosai, suna ba da damar aiwatar da Kashe Code Remote (RCE), tare da al'ada malware da aka lura a cikin daji. Kas ɗin CISA Known Exploited Vulnerabilities (KEV) kawai ya ƙara su [1, 2, 3, 4]. Wannan ba barazana ba ce; lamari ne mai mahimmanci, al'amari na kasa da kasa da ke tasiri ga muhimman ababen more rayuwa a fadin gwamnati, kudi, ilimi, da sassan shari'a a Arewacin Amurka da Turai. Yayin da ƙungiyoyin ku ke fafutuka don ɗaukar zubar da jini, cike da fushi, da fara binciken bincike kan abin da zai iya zama babban bala'i, wani kanun labarai ya faɗo: Shugaba Trump ya amince da "yarjejeniya ta son rai" tare da manyan kamfanonin fasaha don ci gaban AI, mai ba da tabbacin masana'antu masu zaman kansu [5].
Juxtaposition ɗin ba daidai ba ne. A gefe guda, muna fuskantar mummunan yanayi, gaskiyar da ba za a iya musantawa ba na yanayin dijital ɗinmu na yanzu: ci gaba da yaƙi mai ƙarfi da ƙwararrun maƙiya masu cin gajiyar asali a cikin abubuwan more rayuwa waɗanda ke ƙarƙashin duniyarmu ta zamani. A gefe guda kuma, wani abin kallo na siyasa wanda ke nuna cewa makomar mafi yawan sauye-sauye, duk da haka ba ta da tabbas, fasahar za ta iya sarrafa ta cikin aminci ta hanyar masana'antar da ke gwagwarmaya tare da tsaro na asali da mulkin kai na ɗabi'a.
Bala'in Citrix: Alamar Rot mai zurfi
Bari mu bayyana a sarari: Citrix zero-days, kamar CVE-2023-4966 (wanda aka sani da Citrix Bleed) da CVE-2023-3519, ba kawai "wani rauni bane." Suna wakiltar rikicin gaggawa a cikin cibiyar bayanai, kai tsaye, yaƙin neman zaɓe na kai tsaye wanda ke buƙatar amsawar hannu-on-deck [1, 2, 3, 4]. Kisa na Code Nesa akan ADC ko Ƙofar ita ce dijital daidai da mahimmin wurin shiga da aka bari. Wannan ba batun faci ba ne kawai; game da raunin tsarin tsarin gine-ginen kasuwancin mu ne.
Tsawon shekaru, mun gina hadaddun tsarin tsarin haɗin kai, galibi muna dogaro da ɗimbin dillalai masu mahimmanci don mahimman abubuwan more rayuwa. Citrix, kamar sauran mutane da yawa, yana ba da sabis masu mahimmanci, amma tare da wannan tsakiya yana zuwa babban haɗari. Lokacin da wani muhimmin abu kamar NetScaler ya lalace a matakin sifili-rana, tasirin ripple yana da muni. Yana fallasa kuskuren da ke tattare da dogaro da fage guda ɗaya na gazawa, komai ƙaƙƙarfan * zato* ya kasance. Umarnin "patch nan da nan", yayin da ya zama dole, yana jin kamar magani na zahiri don batun tsarin. Ba ya magance matsalolin da ke cikin tushe: sarkar da ke haifar da lahani, jinkirin sabunta tsaro daga wasu dillalai, da rashin isasshen tsaro-zurfin dabarun da ke kasawa lokacin da aka keta kewayen a mafi mahimmancin mahimmin lokaci.
Wannan ba matsalar fasaha ba ce kawai; ci gaban kasuwanci ne mai ban tsoro. Rashin karya bayanai, rugujewar aiki, cin tara na tsari, lalacewar mutunci - farashi na taurari ne. Kuma don me? Don gudanar da hanyar sadarwa da inganci? Muna biyan farashi mai tsauri don dacewa da fahimtar inganci, farashin da aka auna a cikin dare marasa barci don CTOs da ƙungiyoyin tsaro, da yuwuwar, cikin rugujewar amanar jama'a. Gaskiyar cewa waɗannan kwanaki ba safai ake amfani da su a zahiri, ta amfani da * malware na al'ada *, yana gaya mana waɗannan ba yaran rubutun ba ne. Waɗannan ƙwararrun ƙwararru ne, masu yin barazanar dagewa da ke niyya ga kadarori masu daraja [3]. Idan ba za mu iya tabbatar da tushen tushe na duniyar dijital da muke da ita ba, wane bege muke da shi don ƙarin hadaddun nan gaba?
AI's Wild West: Amincewa da sha'awar kai don ƙaddamar da aminci
Kuma da yake magana game da wannan makomar, bari mu yi la'akari da yarjejeniyar "'yan sanda" ta AI. Sanarwar Shugaba Trump, yayin da take da mahimmanci a siyasance, misali ne na littafin karatu na ba da gaskiya [5]. "Na son rai" da "'yan sandan kai" kalmomi ne da ya kamata su haifar da tsoro ga duk wanda ya kalli masana'antar fasahar ke aiki a cikin shekaru ashirin da suka gabata. Mun lura da wannan tsarin a baya, ko ba haka ba? Kamfanonin kafofin watsa labarun "da son rai" suna 'yan sanda maganganun ƙiyayya, injunan bincike "mai sarrafa kansa" sirrin bayanan, da kuma kantin sayar da app "na kansa" yana tabbatar da gasa mai adalci. Rikodin waƙar shine, a sanya shi a hankali, mara kyau.
Tunanin cewa kamfanonin da ke tsere don haɓakawa da tura tsarin AI mai ƙarfi - tsarin da ke da yuwuwar sake fasalin tattalin arziƙin, tasiri zaɓe, har ma da haifar da sabbin nau'ikan haɗarin al'umma - ana iya amincewa da su don saitawa da aiwatar da jagororin ɗabi'a da aminci na kansu butulci ne a mafi kyau, kuma mai haɗari mara nauyi a mafi muni. Waɗannan kamfanoni ne da ke haifar da riba da rinjayen kasuwa. Babban aikinsu na amana shine ga masu hannun jari, ba ga mahimmin ra'ayi na amfanin jama'a ko ɗa'a AI ba.
Wannan "yarjejeniyar" nasara ce ta siyasa ga gwamnati, yana ba su damar yin iƙirarin aiki akan AI ba tare da kasuwanci mara kyau na ainihin doka ko kulawa ba. Hakanan babbar nasara ce ga Big Tech, siyan su lokaci da 'yanci daga ƙa'idodi masu nauyi waɗanda za su iya rage ƙirƙira su ko tasiri layin ƙasa. Amma ga sauran mu - ga ƙwararrun ƙwararrun fasahar gina waɗannan tsarin, ga kasuwancin da za su dogara da su, da kuma ga al'umma gabaɗaya - abin koyi ne mai haɗari. Yana nuna wata hanyar da aka fi so ga shugabancin AI wanda ke ba da fifiko ga cin gashin kai na kamfanoni akan amincin jama'a da ba da lissafi.
Cire Haɗin kai: Gina Kan Tushen Mara ƙarfi
Ga gaskiya mara dadi: a lokaci guda muna kasa tabbatar da halin da muke ciki da kuma rashin sarrafa makomarmu cikin haɗari. Muna gina ingantattun tsarin AI akan tushe na rashin zaman lafiya na dijital, inda ƙwararrun maƙiya ke lalata kayan more rayuwa akai-akai. Shugabannin masana'antu iri ɗaya waɗanda ba za su iya hana samfuran su zama masu kai hare-hare a duniya yanzu ana neman su "'yan sanda da kansu" abubuwan ɗabi'a da aminci na bayanan sirri na gabaɗaya.
Wannan ba kawai cire haɗin gwiwa ba ne; gibi ne mai zurfi. Kamar yadda CTOs da injiniya ke jagorantar, an kama mu a tsakiya. An ba mu alhakin daidaita barazanar nan take, na wanzuwa kamar Citrix zero-days, yayin da ake gaya mana lokaci guda mu shirya don makomar AI ta gaba inda aka tsara dokoki yayin da muke tafiya, galibi ta 'yan wasan da kansu.
Yarjejeniyar AI ta son rai ba mafita ba ce; dabara ce ta jinkirtawa. Yana jinkirta yin lissafi, yana tabbatar da cewa lokacin da ba makawa ya saba wa ɗabi'a, son rai, ko ma faɗuwar bala'i na AI ya faru, jama'a za a bar su suna mamakin dalilin da yasa ba a sami ƙarfi ba, sa ido mai zaman kansa daga farkon. Kuma lokacin da waɗannan gazawar suka faru, ba za su kasance da ƙima ba. Za su zama na gaske kuma suna lalata kamar RCE akan NetScaler ɗin ku, kawai tare da yuwuwar tasirin al'umma mai nisa.
Muna buƙatar ƙarin buƙata. Muna buƙatar ƙaƙƙarfan tsaro, ingantaccen tsaro daga masu siyar da mu, ba kawai faci masu amsawa ba bayan gaskiyar. Kuma muna buƙatar ƙa'ida ta gaskiya, mai zaman kanta ga AI, ba kawai yarjejeniya ta musafaha tsakanin 'yan siyasa da kamfanoni ba. Domin idan har ba za mu iya tabbatar da ainihin kayan aikin mu ba, ta yaya za mu iya amincewa da masu gine-ginen don gina tsararrun wayewa na gaba da mutunci? Amsar, a yanzu, ba za mu iya ba.
Sources
[1] CISA Yana Ƙara Citrix NetScaler ADC da Ƙofar Lalacewar Ƙofar (CVE-2023-4966) zuwa Kas ɗin Abubuwan Rashin Lafiya da Aka Sani - https://www.cisa.gov/news-events/alerts/2023/10/24/cisa-adds-citrix-netscaler-adc-and-gateway-vulnerability-known-exploited-vulnerabilities-catalog [2] Citrix Tsaro Bulletin na CVE-2023-4966 da CVE-2023-4967 - https://support.citrix.com/article/CTX579459/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202and-349620 [3] Mandiant: UNC4841 Yana Amfani da Citrix NetScaler ADC da Ƙofar Zero-Day (CVE-2023-4966) - https://www.mandiant.com/resources/blog/citrix-bleed-zero-day-exploitation [4] CISA Yana Ƙara Citrix NetScaler ADC da Ƙofar Lalacewar Ƙofar (CVE-2023-3519) zuwa Katalogin Abubuwan Rashin Lafiya da Aka Sani - https://www.cisa.gov/news-events/alerts/2023/07/21/cisa-adds-citrix-netscaler-adc-and-gateway-vulnerability-known-exploited-vulnerabilities-catalog [5] Sabuntawa kai tsaye: Trump ya sanya hannu kan yarjejeniyar son rai tare da shugabannin AI don fasaha… - https://apnews.com/live/trump-cnn-media-midterm-elections-news-updates-09-29-2026