{"id":104377,"date":"2022-06-13T21:36:53","date_gmt":"2022-06-13T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov"},"modified":"2022-06-13T21:36:53","modified_gmt":"2022-06-13T19:36:53","slug":"v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","title":{"rendered":"Ve ve\u0159ejn\u00fdch log\u00e1ch Travis CI bylo nalezeno kolem 73 tis\u00edc token\u016f a hesel otev\u0159en\u00fdch projekt\u016f.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Aqua Security zve\u0159ejnila v\u00fdsledky v\u00fdzkumu p\u0159\u00edtomnosti citliv\u00fdch \u00fadaj\u016f ve stavebn\u00edch logech, kter\u00e9 jsou ve\u0159ejn\u011b dostupn\u00e9 v syst\u00e9mu kontinu\u00e1ln\u00ed integrace Travis CI. V\u00fdzkumn\u00edci na\u0161li zp\u016fsob, jak extrahovat 770 milion\u016f log\u016f r\u016fzn\u00fdch projekt\u016f. P\u0159i testovac\u00edm nahr\u00e1v\u00e1n\u00ed 8 milion\u016f log\u016f bylo v z\u00edskan\u00fdch datech zji\u0161t\u011bno p\u0159ibli\u017en\u011b 73 tis\u00edc token\u016f, u\u017eivatelsk\u00fdch \u00fadaj\u016f a p\u0159\u00edstupov\u00fdch kl\u00ed\u010d\u016f spojen\u00fdch s r\u016fzn\u00fdmi popul\u00e1rn\u00edmi slu\u017ebami, v\u010detn\u011b GitHub, AWS a Docker Hub. Z\u00edskan\u00e9 informace umo\u017e\u0148uj\u00ed kompromitovat infrastrukturu mnoha otev\u0159en\u00fdch projekt\u016f; podobn\u00e1 \u00fanik ned\u00e1vno vedla k \u00fatoku na infrastrukturu projektu NPM. <\/p>\n

\u00danik souvis\u00ed s mo\u017enost\u00ed p\u0159\u00edstupu k log\u016fm u\u017eivatel\u016f bezplatn\u00e9 slu\u017eby Travis CI prost\u0159ednictv\u00edm standardn\u00edho API (nap\u0159\u00edklad, sestavovac\u00ed log lze st\u00e1hnout p\u0159es URL ve tvaru \u201ehttps:\/\/api.travis-ci.org\/v3\/job\/5248126\/log.txt\u201c, kde \u010d\u00edslo 5248126 je identifik\u00e1tor logu). Pro ur\u010den\u00ed rozsahu mo\u017en\u00fdch identifik\u00e1tor\u016f log\u016f byl pou\u017eit je\u0161t\u011b jeden API (\u201ehttps:\/\/api.travis-ci.org\/logs\/6976822\u201c), kter\u00fd zaji\u0161\u0165uje p\u0159esm\u011brov\u00e1n\u00ed na sta\u017een\u00ed logu podle po\u0159adov\u00e9ho \u010d\u00edsla. Metodou pokusu a omylu se b\u011bhem v\u00fdzkumu poda\u0159ilo bez autentizace ur\u010dit p\u0159ibli\u017en\u011b 770 milion\u016f log\u016f, kter\u00e9 byly vytvo\u0159eny od roku 2013 do kv\u011btna 2022 b\u011bhem sestavov\u00e1n\u00ed projekt\u016f, kter\u00e9 spadaj\u00ed pod bezplatn\u00fd tarif. <\/p>\n

Anal\u00fdza testovac\u00ed vzorky uk\u00e1zala, \u017ee v mnoha p\u0159\u00edpadech se v logu otev\u0159en\u011b odr\u00e1\u017eej\u00ed p\u0159\u00edstupov\u00e9 parametry k repozit\u00e1\u0159\u016fm, API a \u00falo\u017ei\u0161t\u00edm, dostate\u010dn\u00e9 pro p\u0159\u00edstup k priv\u00e1tn\u00edm repozit\u00e1\u0159\u016fm, prov\u00e1d\u011bn\u00ed zm\u011bn v k\u00f3du nebo p\u0159ipojen\u00ed k cloudov\u00fdm prost\u0159ed\u00edm pou\u017e\u00edvan\u00fdm v infrastruktu\u0159e. Nap\u0159\u00edklad v logech byly nalezeny tokeny pro p\u0159ipojen\u00ed k repozit\u00e1\u0159\u016fm na GitHubu, hesla pro ukl\u00e1d\u00e1n\u00ed sestaven\u00ed v Docker Hubu, kl\u00ed\u010de pro p\u0159\u00edstup k prost\u0159ed\u00edm Amazon Web Services (AWS), a parametry pro p\u0159ipojen\u00ed k datab\u00e1z\u00edm MySQL a PostgreSQL. <\/p>\n

Je zaj\u00edmav\u00e9, \u017ee podobn\u00e9 \u00faniky p\u0159es API byly zaregistrov\u00e1ny v\u00fdzkumn\u00edky v letech 2015 a 2019. Po p\u0159edchoz\u00edch incidentech spole\u010dnost Travis p\u0159idala ur\u010dit\u00e1 omezen\u00ed, aby zt\u00ed\u017eila hromadn\u00e9 stahov\u00e1n\u00ed dat, a omezila p\u0159\u00edstup k API, ale tato omezen\u00ed se poda\u0159ilo obej\u00edt. Krom\u011b toho spole\u010dnost Travis uskute\u010dnila pokus o odstran\u011bn\u00ed citliv\u00fdch \u00fadaj\u016f z log\u016f, av\u0161ak tato data byla vymaz\u00e1na pouze \u010d\u00e1ste\u010dn\u011b. <\/p>\n

\u00danik se p\u0159edev\u0161\u00edm dotkl u\u017eivatel\u016f otev\u0159en\u00fdch projekt\u016f, kter\u00fdm Travis poskytuje bezplatn\u00fd p\u0159\u00edstup ke sv\u00e9 slu\u017eb\u011b kontinu\u00e1ln\u00ed integrace. P\u0159i kontrole proveden\u00e9 n\u011bkter\u00fdmi poskytovateli slu\u017eeb bylo potvrzeno, \u017ee p\u0159ibli\u017en\u011b polovina ze z\u00edskan\u00fdch token\u016f a kl\u00ed\u010d\u016f z log\u016f z\u016fst\u00e1v\u00e1 funk\u010dn\u00ed. V\u0161em u\u017eivatel\u016fm bezplatn\u00e9 verze slu\u017eby Travis CI se doporu\u010duje urgentn\u011b zm\u011bnit p\u0159\u00edstupov\u00e9 kl\u00ed\u010de, nastavit odstran\u011bn\u00ed log\u016f sestaven\u00ed a zkontrolovat, zda v logu nedoch\u00e1z\u00ed k v\u00fdstupu citliv\u00fdch \u00fadaj\u016f.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Aqua Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f 770 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 8 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432 \u0432 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 73 \u0442\u044b\u0441\u044f\u0447 \u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104377","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V ve\u0159ejn\u00fdch log\u00e1ch Travis CI bylo odhaleno p\u0159ibli\u017en\u011b 73 tis\u00edc token\u016f a hesel otev\u0159en\u00fdch projekt\u016f | ProHoster","description":"Spole\u010dnost Aqua Security publikovala v\u00fdsledky studie o p\u0159\u00edtomnosti citliv\u00fdch \u00fadaj\u016f v logech sestaven\u00ed, kter\u00e9 jsou ve\u0159ejn\u011b dostupn\u00e9 v syst\u00e9mu kontinu\u00e1ln\u00ed integrace Travis CI.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445 Travis CI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 73 \u0442\u044b\u0441\u044f\u0447 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Aqua Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-13T19:36:53+00:00","article:modified_time":"2022-06-13T19:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104377","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-03-08 16:34:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-13 19:37:58","updated":"2026-03-08 16:34:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/104377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=104377"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/104377\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=104377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=104377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=104377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}