{"id":103789,"date":"2022-04-16T15:37:02","date_gmt":"2022-04-16T13:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm"},"modified":"2022-04-16T15:37:02","modified_gmt":"2022-04-16T13:37:02","slug":"ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","title":{"rendered":"\u00datok na GitHub, kter\u00fd vedl k \u00faniku soukrom\u00fdch repozit\u00e1\u0159\u016f a p\u0159\u00edstupu k infrastruktu\u0159e NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub varoval u\u017eivatele p\u0159ed \u00fatokem zam\u011b\u0159en\u00fdm na stahov\u00e1n\u00ed dat ze soukrom\u00fdch repozit\u00e1\u0159\u016f pomoc\u00ed kompromitovan\u00fdch token\u016f OAuth, kter\u00e9 byly vytvo\u0159en\u00e9 pro slu\u017eby Heroku a Travis-CI. Podle zpr\u00e1v do\u0161lo b\u011bhem \u00fatoku k \u00faniku dat ze soukrom\u00fdch repozit\u00e1\u0159\u016f n\u011bkter\u00fdch organizac\u00ed, kter\u00e9 t\u011bchto repozit\u00e1\u0159\u016f zp\u0159\u00edstupnily pro PaaS platformu Heroku a syst\u00e9m kontinu\u00e1ln\u00ed integrace Travis-CI. Mezi posti\u017een\u00fdmi byla spole\u010dnost GitHub a projekt NPM. <\/p>\n

\u00dato\u010dn\u00edci se poda\u0159ilo z priv\u00e1tn\u00edch repozit\u00e1\u0159\u016f GitHub z\u00edskat kl\u00ed\u010d pro p\u0159\u00edstup k API Amazon Web Services, kter\u00fd byl pou\u017e\u00edv\u00e1n v infrastruktu\u0159e projektu NPM. Z\u00edskan\u00fd kl\u00ed\u010d umo\u017e\u0148oval p\u0159\u00edstup k NPM bal\u00ed\u010dk\u016fm ulo\u017een\u00fdm v slu\u017eb\u011b AWS S3. GitHub se domn\u00edv\u00e1, \u017ee i p\u0159es z\u00edskan\u00fd p\u0159\u00edstup k repozit\u00e1\u0159\u016fm NPM nedo\u0161lo k modifikaci bal\u00ed\u010dk\u016f ani k z\u00edsk\u00e1n\u00ed dat souvisej\u00edc\u00edch s u\u017eivatelsk\u00fdmi \u00fa\u010dty. Tak\u00e9 bylo poznamen\u00e1no, \u017ee jeliko\u017e jsou infrastruktury GitHub.com a NPM odd\u011blen\u00e9, \u00fato\u010dn\u00edci nestihli st\u00e1hnout obsah intern\u00edch repozit\u00e1\u0159\u016f GitHub, kter\u00e9 se net\u00fdkaly NPM, ne\u017e byly probl\u00e9mov\u00e9 tokeny zablokov\u00e1ny. <\/p>\n

\u00datok byl zaznamen\u00e1n 12. dubna, pot\u00e9 co se \u00fato\u010dn\u00edci pokusili pou\u017e\u00edt kl\u00ed\u010d k API AWS. Pozd\u011bji byly zaznamen\u00e1ny podobn\u00e9 \u00fatoky i na n\u011bkter\u00e9 dal\u0161\u00ed organizace, kter\u00e9 tak\u00e9 pou\u017e\u00edvaly tokeny aplikac\u00ed Heroku a Travis-CI. Posti\u017een\u00e9 organizace nejsou pojmenov\u00e1ny, ale v\u0161em u\u017eivatel\u016fm, kter\u00fdch se \u00fatok dotkl, byly zasl\u00e1ny p\u0159\u00edslu\u0161n\u00e9 individu\u00e1ln\u00ed upozorn\u011bn\u00ed. U\u017eivatel\u016fm aplikac\u00ed Heroku a Travis-CI se doporu\u010duje prozkoumat bezpe\u010dnostn\u00ed a auditn\u00ed logy pro zji\u0161t\u011bn\u00ed anom\u00e1li\u00ed a netypick\u00e9 aktivity. <\/p>\n

Jak\u00fdm zp\u016fsobem se \u00fato\u010dn\u00edk\u016fm poda\u0159ilo z\u00edskat tokeny, zat\u00edm nen\u00ed jasn\u00e9, ale GitHub tvrd\u00ed, \u017ee byly z\u00edsk\u00e1ny bez kompromitace firemn\u00ed infrastruktury, proto\u017ee tokeny pro autorizaci p\u0159\u00edstupu z extern\u00edch syst\u00e9m\u016f nejsou na GitHubu ulo\u017eeny v b\u011b\u017en\u00e9m form\u00e1tu, kter\u00fd by bylo mo\u017en\u00e9 pou\u017e\u00edt. Anal\u00fdza chov\u00e1n\u00ed \u00fato\u010dn\u00edka uk\u00e1zala, \u017ee pravd\u011bpodobn\u011b hlavn\u00edm c\u00edlem stahov\u00e1n\u00ed obsahu soukrom\u00fdch repozit\u00e1\u0159\u016f je anal\u00fdza p\u0159\u00edtomnosti citliv\u00fdch dat, jako jsou p\u0159\u00edstupov\u00e9 kl\u00ed\u010de, kter\u00e9 by mohly b\u00fdt pou\u017eity k pokra\u010dov\u00e1n\u00ed v \u00fatoku na dal\u0161\u00ed prvky infrastruktury.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 Heroku \u0438 Travis-CI. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u043e\u0442\u043a\u0440\u044b\u0432\u0448\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u0434\u043b\u044f PaaS-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Heroku \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis-CI. \u0412 \u0447\u0438\u0441\u043b\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103789","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na GitHub, kter\u00fd vedl k \u00faniku soukrom\u00fdch repozit\u00e1\u0159\u016f a p\u0159\u00edstupu k infrastruktu\u0159e NPM | ProHoster","description":"GitHub varoval u\u017eivatele p\u0159ed \u00fatokem zam\u011b\u0159en\u00fdm na stahov\u00e1n\u00ed dat z priv\u00e1tn\u00edch repozit\u00e1\u0159\u016f pomoc\u00ed zkompromitovan\u00fdch token\u016f OAuth, kter\u00e9 byly vygenerov\u00e1ny pro slu\u017eby Heroku a Travis-CI.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitHub, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0443 \u043a \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 NPM | ProHoster","og:description":"GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 Heroku \u0438 Travis-CI.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-16T13:37:02+00:00","article:modified_time":"2022-04-16T13:37:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103789","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:26:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-16 13:38:06","updated":"2026-01-25 10:26:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/103789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=103789"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/103789\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=103789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=103789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=103789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}