{"id":8536,"date":"2020-07-14T11:44:29","date_gmt":"2020-07-14T08:44:29","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=8536"},"modified":"2020-07-14T11:44:29","modified_gmt":"2020-07-14T08:44:29","slug":"devops-security-hybrid","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/devops-security-hybrid\/8536\/","title":{"rendered":"DevOps g\u00fcvenli\u011fi nas\u0131l sa\u011flan\u0131r"},"content":{"rendered":"

Ge\u00e7ti\u011fimiz Nisan ay\u0131nda BT haber siteleri Ruby programlama dilinin k\u00fct\u00fcphanelerinin resmi da\u011f\u0131t\u0131m kanal\u0131 olan RubyGems\u2019in zehirlendi\u011fi haberini yay\u0131nlad\u0131<\/a>. Habere g\u00f6re bir sald\u0131rgan, i\u00e7erisinde k\u00f6t\u00fc ama\u00e7l\u0131 bir komut dosyas\u0131 bulunan sahte paketler y\u00fckledi ve bu kodu projelerinde kullanan programc\u0131lar fark\u0131nda olmadan kullan\u0131c\u0131lar\u0131n bilgisayar\u0131na kripto para birimi c\u00fczdan adreslerini de\u011fi\u015ftiren k\u00f6t\u00fc ama\u00e7l\u0131 bir yaz\u0131l\u0131m bula\u015ft\u0131rd\u0131.<\/p>\n

Elbette bu sald\u0131r\u0131 herkese a\u00e7\u0131k bir kayna\u011f\u0131n istismar edildi\u011fi ilk tedarik zinciri sald\u0131r\u0131s\u0131 de\u011fil. Ama g\u00f6r\u00fcn\u00fc\u015fe g\u00f6re bu t\u00fcr senaryolar pop\u00fcler olmaya ba\u015flad\u0131 ve bu sald\u0131r\u0131lardan birinin ba\u015far\u0131l\u0131 olmas\u0131, on binlerce ya da y\u00fcz binlerce kullan\u0131c\u0131n\u0131n tehlikeye at\u0131lmas\u0131 anlam\u0131na geliyor. Bu tehlikenin b\u00fcy\u00fckl\u00fc\u011f\u00fc, zehirlenen kaynaktan al\u0131nan kodu kullanan yaz\u0131l\u0131m\u0131n ne kadar pop\u00fcler oldu\u011funa ba\u011fl\u0131.<\/p>\n

K\u00f6t\u00fc ama\u00e7l\u0131 paketler kaynaklara nas\u0131l giriyor?<\/h2>\n

RubyGems olay\u0131n\u0131n sorumlusu olan siber su\u00e7lu, ilgili kaynakta yay\u0131nlanan pop\u00fcler me\u015fru paketlere benzer isimde bir s\u00fcr\u00fc proje olu\u015fturmu\u015f. Alan ad\u0131 benzerli\u011fi (typosquatting) olarak bilinen bu y\u00f6ntem, geli\u015ftiricilerin paketin ad\u0131n\u0131 yanl\u0131\u015f yazmas\u0131na ve yanl\u0131\u015fl\u0131kla k\u00f6t\u00fc ama\u00e7l\u0131 bir paket indirmesine ya da arama sonu\u00e7lar\u0131nda \u00e7\u0131kan bir dizi paket isminden hangisinin ger\u00e7ek pakete ait oldu\u011funu bilmemesine dayan\u0131yor. Genel olarak en yayg\u0131n siber zehirleme y\u00f6ntemlerinden biri olarak kabul edilen bu taktik, Python Package Index<\/a>\u2018e yap\u0131lan sald\u0131r\u0131larda ve Docker Hub<\/a>\u2018a sahte g\u00f6rseller y\u00fcklemek i\u00e7in kullan\u0131ld\u0131.<\/p>\n

Copay kripto para birimi c\u00fczdan\u0131 olay\u0131nda<\/a> ise sald\u0131rganlar, kayna\u011f\u0131 GitHub\u2019da bulunan bir k\u00fct\u00fcphane kulland\u0131. K\u00fct\u00fcphanenin yarat\u0131c\u0131s\u0131 hevesini kaybedince y\u00f6netici haklar\u0131n\u0131 devretti ve dolay\u0131s\u0131yla bir\u00e7ok geli\u015ftiricinin \u00fcr\u00fcnlerinde kulland\u0131\u011f\u0131 bu pop\u00fcler k\u00fct\u00fcphaneyi tehlikelere a\u00e7\u0131k hale getirdi.<\/p>\n

Baz\u0131 olaylarda siber su\u00e7lular me\u015fru bir geli\u015ftiricinin hesab\u0131n\u0131 kendisinin haberi olmadan kullanabiliyor ve ger\u00e7ek paketleri sahteleriyle de\u011fi\u015ftiriyor. Bunun bir \u00f6rne\u011fi, k\u00fct\u00fcphaneleri npm (Node Package Manager) \u00e7evrimi\u00e7i veri taban\u0131nda bar\u0131nd\u0131r\u0131lan ESLint<\/a>\u2018e d\u00fczenlenen sald\u0131r\u0131da ya\u015fanm\u0131\u015ft\u0131.<\/p>\n

Derleme ortam\u0131n\u0131n zay\u0131f b\u0131rak\u0131lmas\u0131<\/h2>\n

Yaz\u0131l\u0131m \u00fcr\u00fcnleri geli\u015ftiren \u015firketler de APT sald\u0131rganlar\u0131n\u0131n ilgisini \u00e7ekebiliyor. Bu sald\u0131rganlar\u0131n yaz\u0131l\u0131m geli\u015ftiren \u015firketlerin m\u00fc\u015fterilerini hedef ald\u0131\u011f\u0131 olaylar zaman zaman g\u00fcvenlik uzmanlar\u0131n\u0131n dikkatini \u00e7ekiyor:<\/p>\n