Zero-Iintsuku kunye Nokongamela: Ibali leeNyaniso ezimbini zobuGcisa
Yiba nomfanekiso weqela lakho le-SOC, lithe ntsho ngamehlo, lijonge kwisilumkiso esibomvu esidanyazayo. Yi-3 AM ngo-Okthobha ka-2023, kwaye iindaba azilungile: iintsuku ezimbini ezibalulekileyo zero-zero kwi-Citrix NetScaler ADC kunye ne-Gateway, ixhatshazwe ngokusebenzayo, ivumela ukuPhathwa kweKhowudi ekude (RCE), kunye ne-malware yesiko ebonwe endle. Ikhathalogu ye-CISA eyaziwayo eSebenzisiweyo yoBugcisa (KEV) isanda kubongeza [1, 2, 3, 4]. Le ayisosisongelo sethiyori; sisiganeko esibalulekileyo, samazwe ngamazwe esichaphazela iziseko ezingundoqo zeshishini kurhulumente wonke, ezemali, ezemfundo, kunye namacandelo ezomthetho kuMntla Melika naseYurophu. Ngelixa amaqela akho ezama ukuqulatha ukopha, ukumbamba ngomsindo, kunye nokuqalisa uphando lwasenkundleni malunga nokuba yintoni enokuba lulwaphulo-mthetho oluyintlekele, esinye isihloko siyehla: Umongameli uTrump ukhusele "isivumelwano sokuzithandela" kunye neefemu eziphezulu zetekhnoloji kuphuhliso lwe-AI, ethembisa ukuzenzela ubupolisa kwishishini [5].
I-juxtaposition ayihambelani ngokumangalisayo. Kwelinye icala, sijongana nenyani ekhohlakeleyo, engenakuphikiswa yendawo esihlala kuyo yedijithali yangoku: umlo ongaguqukiyo, okwinqanaba eliphezulu ngokuchasene neentshaba ezintsonkothileyo usebenzisa ubuthathaka obusisiseko kwiziseko ezingundoqo ezixhasa ihlabathi lethu lanamhlanje. Kwelinye icala, umbono wezopolitiko ocebisa ukuba ikamva lelona tshintsho, kodwa lingaqinisekanga kakhulu, itekhnoloji inokulawulwa ngokukhuselekileyo lishishini elifanayo elihlala lisokola ngokhuseleko olusisiseko kunye nokuzilawula okusesikweni.
Intlekele yeCitrix: Uphawu lokuBola Okunzulu
Masicace: i-Citrix zero-days, ezifana ne-CVE-2023-4966 (eyaziwa ngokuba yiCitrix Bleed) kunye ne-CVE-2023-3519, kungekhona nje "obunye ubuthathaka." Bamele inkathazo engxamisekileyo kwiziko ledatha, umkhankaso wokuhlaselwa ngokuthe ngqo, oqhubekayo ofuna ngokukhawuleza, zonke-izandla-kwi-deck impendulo [1, 2, 3, 4]. Ukwenziwa kweKhowudi ekude kwi-ADC okanye kwi-Gateway yidijithali elingana nendawo yofikelelo ebalulekileyo eshiywe ibhengeziwe. Oku akukho malunga nokuchwetheza nje; imalunga nenkqubo ebuthathaka yoyilo lweshishini lethu.
Kangangeminyaka, sakha iinkqubo ezintsonkothileyo, ezinxibeleleneyo, ezihlala zixhomekeke kwiqaqobana labathengisi ababalulekileyo kwiziseko ezingundoqo. ICitrix, njengabanye abaninzi, ibonelela ngeenkonzo eziyimfuneko, kodwa ngobo kubaluleka kuza nomngcipheko omkhulu. Xa icandelo elisisiseko elifana ne-NetScaler lithotyelwe kwinqanaba le-zero-day, umphumo we-ripple uyingozi. Iveza isiphene esingokwemvelo ekuthembeleni kwinqaku elinye lokusilela, akukhathaliseki nokuba yomelele kangakanani na ifanele ukuba. Umyalelo othi "isiqwenga ngokukhawuleza", ngelixa uyimfuneko, uvakala ngathi sisicombululo esingaphezulu kumbandela wenkqubo. Ayizisombululi iingxaki ezisisiseko: ubunzima obuvelisa ubuthathaka, isantya esicothayo sohlaziyo lokhuseleko oluvela kwabanye abathengisi, kunye neendlela ezihlala zingonelanga zokhuselo-bunzulu ezisilelayo xa iperimeter isaphulwa kweyona ndawo ibalulekileyo.
Oku akuyongxaki yobugcisa kuphela; liphupha elibi lokuqhubeka kweshishini. Ukuphulwa kwedatha, ukuphazamiseka kokusebenza, iintlawulo zokulawula, umonakalo owaziwayo - iindleko zeenkwenkwezi. Kwaye ngenxa yantoni? Ukuqhuba inethiwekhi ngokufanelekileyo? Sihlawula ixabiso elinyukayo ukuze kube lula kunye nokusebenza okubonwayo, ixabiso elilinganiswe ngobusuku bokungalali kwii-CTO kunye namaqela okhuseleko, kwaye kunokwenzeka, ekuphelisweni kwentembeko yoluntu. Inyani yokuba ezi zixhatshaziwe ngeentsuku eziqandayo, kusetyenziswa i-malware eyenzekileyo, isixelela ukuba aba ayingobantwana abashicilelweyo. Ezi zizixhobo ezifanelekileyo, abadlali bezoyikiso eziqhubekayo ezijolise kwii-asethi zexabiso eliphezulu [3]. Ukuba asikwazi ukukhusela isiseko selizwe lethu ledijithali elikhoyo, leliphi ithemba esinalo ngekamva elintsonkothe ngakumbi?
I-AI's Wild West: Ukuthembela kuMdla wesiqu sakho ukuyalela uKhuseleko
Kwaye sithetha ngelo xesha elizayo, makhe sijonge kwisivumelwano se-AI “sobupolisa”. Isibhengezo sikaMongameli uTrump, ngelixa sibalulekile kwezopolitiko, ngumzekelo wencwadi yokuchasa uxanduva lokuphendula [5]. "Ukuzithandela" kunye "nokuzenzela ubupolisa" ngamagama ekufuneka avuse uloyiko kuye nabani na obukele ishishini lobugcisa lisebenza kule minyaka ingamashumi amabini idlulileyo. Sikhe sawubona lo mzekelo ngaphambili, akunjalo? Iinkampani zemidiya yoluntu "ngokuzithandela" intetho yamapolisa enentiyo, iinjini zokukhangela "ezizilawulayo" ubumfihlo bedatha, kunye neevenkile zeapp "ngokuzimela" ziqinisekisa ukhuphiswano olufanelekileyo. Ingxelo yomzila, ukuyibeka kakuhle, ihlazo.
Ingcinga yokuba kwaezona nkampani zibalekayo ukuphuhlisa nokuhambisa iinkqubo ze-AI ezinamandla - iinkqubo ezinokuthi zibumbe uqoqosho ngokutsha, zibe nefuthe kunyulo, kwaye zidale iindlela ezintsha zomngcipheko woluntu - zinokuthenjwa ukuba zisete kwaye zinyanzelise ezazo izikhokelo zeenqobo ezisesikweni kunye nokhuseleko zibubudenge ngeyona ndlela, kwaye ziyingozi ngokungakhathali kakhulu. La ngamaqumrhu aqhutywa yinzuzo kunye nolawulo lwemarike. Owona msebenzi wabo uphambili kubaphathi-zabelo, hayi kwingqikelelo engabonakaliyo yezinto ezilungileyo zoluntu okanye i-AI esesikweni.
Le "mvumelwano" kukuphumelela kwezopolitiko kulawulo, okubavumela ukuba bafake ibango lesenzo kwi-AI ngaphandle kweshishini elimdaka lomthetho wokwenyani okanye ulongamelo lolawulo. Ikwaluloyiso olukhulu lweBig Tech, ukubathengela ixesha kunye nenkululeko kwimithetho enokuba ngumthwalo enokuthi icothise ukuvela kwabo okanye ichaphazele umgca wabo osezantsi. Kodwa kuthi sonke - kwiingcali zobuchwepheshe ezakha ezi nkqubo, kumashishini aza kuxhomekeka kuzo, kunye noluntu ngokubanzi - ngumzekelo oyingozi. Ibonisa indlela ekhethwayo yolawulo lwe-AI ebeka phambili ukuzimela kwequmrhu kunokhuseleko loluntu kunye noxanduva.
Ukuqhawula: Ukwakha kwiziseko ezingazinzanga
Nantsi inyani engathandekiyo: kwangaxeshanye siyasilela ukukhusela ngoku kunye nokuphatha kakubi ikamva lethu. Sakha iinkqubo ze-AI ezihlala ziphucukile kwisiseko sokungazinzi kwedijithali, apho iziseko zophuhliso ezibalulekileyo zihlala zisengozini ngabachasi abantsonkothileyo. Kwaezo nkokheli zoshishino zifanayo nezingabonakalisi ukuthintela iimveliso zazo ekubeni zihlaselwe kwihlabathi jikelele ngoku ziyacelwa ukuba "zibe ngamapolisa" ngokuziphatha kunye nokhuseleko oluchaphazela ubukrelekrele bokwenziwa ngokubanzi.
Oku asikokuphela koqhaqho; ngumsantsa onzulu. Njengoko ii-CTOs kunye nobunjineli zikhokela, sibambeke embindini. Sinikwe umsebenzi wokubamba ezoyikiso zangoku, ezikhoyo njengeCitrix zero-days, ngelixa kwangaxeshanye sixelelwa ukuba silungiselele ikamva eliqhutywa yi-AI apho imithetho yenziwa khona njengoko sihamba, ubukhulu becala ngabadlali ngokwabo.
Isivumelwano se-AI sokuzithandela ayisosisombululo; licebo lokulibazisa. Ibeka elinye ixesha uxanduva lokuphendula, iqinisekisa ukuba xa ukophulwa kweenqobo ezisesikweni ezingenakuthintelwa, ucalucalulo, okanye iintsilelo eziyintlekele ze-AI zisenzeka, uluntu luyakushiyeka luzibuza ukuba kutheni bekungekho luqilima, ukubeka iliso okuzimeleyo kwasekuqaleni. Kwaye xa ezo ntsilelo zisenzeka, aziyi kuba yithiyori. Ziya kuba yinyani kwaye zonakalise njenge-RCE kwi-NetScaler yakho, kuphela ngeempembelelo ezinokuthi zibe zibanzi kuluntu.
Kufuneka sifune ngaphezulu. Sifuna ukhuseleko olomeleleyo, olusebenzayo oluvela kubathengisi bethu, hayi nje iipetshi ezisebenzayo emva kwenyani. Kwaye sifuna umgaqo wokwenyani, ozimeleyo we-AI, hayi nje isivumelwano sokuxhawulana phakathi kwezopolitiko kunye neenkampani. Kuba ukuba asikwazi nokukhusela isiseko sethu esisisiseko, singabathemba njani abayili bokwakha isizukulwana esilandelayo sempucuko ngokuthembekileyo? Impendulo, okwangoku, asikwazi.
Imithombo
[1] I-CISA Yongeza i-Citrix NetScaler ADC kunye ne-Gateway Vulnerability (CVE-2023-4966) kwikhathalogu eyaziwa ngokuba yi-Exploited Vulnerabilities — NONE [2] I-Bulletin yoKhuseleko lwe-Citrix ye-CVE-2023-4966 kunye ne-CVE-2023-4967 [3] I-Mandiant: I-UNC4841 iSebenzisa i-Citrix NetScaler ADC kunye ne-Gateway Zero-Day (CVE-2023-4966) - https://www.mandiant.com/resources/blog/citrix-bleed-zero-day-exploitation [4] I-CISA Yongeza i-Citrix NetScaler ADC kunye ne-Gateway Vulnerability (CVE-2023-3519) kwikhathalogu eyaziwa ngokuba yi-Exploited Vulnerabilities — NONE [5] Uhlaziyo oluphilayo: UTrump utyikitya isivumelwano sokuzithandela kunye neenkokheli ze-AI zetekhnoloji ... - https://apnews.com/live/trump-cnn-media-midterm-elections-news-updates-09-29-2026