{"id":33499,"date":"2019-10-31T21:52:57","date_gmt":"2019-10-31T18:52:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/podmena-koda-proektov-picreel-i-alpaca-forms-privela-k-komprometatsii-4684-sajtov\/"},"modified":"2019-10-31T21:52:57","modified_gmt":"2019-10-31T18:52:57","slug":"podmena-koda-proektov-picreel-i-alpaca-forms-privela-k-komprometatsii-4684-sajtov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/podmena-koda-proektov-picreel-i-alpaca-forms-privela-k-komprometatsii-4684-sajtov","title":{"rendered":"Z\u00e1m\u011bna k\u00f3du projekt\u016f Picreel a Alpaca Forms vedla k naru\u0161en\u00ed bezpe\u010dnosti 4684 webov\u00fdch str\u00e1nek","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edk Willem de Groot uvedl<\/a><\/noindex>, v d\u016fsledku \u010deho\u017e \u00fato\u010dn\u00edci mohli do k\u00f3du syst\u00e9mu webov\u00e9 analytiky vlo\u017eit \u0161kodliv\u00e9 komponenty Picreel<\/a><\/noindex> a otev\u0159en\u00e9 platformy pro generov\u00e1n\u00ed interaktivn\u00edch webov\u00fdch formul\u00e1\u0159\u016f Alpaca Forms<\/a><\/noindex>. Z\u00e1m\u011bna JavaScriptov\u00e9ho k\u00f3du vedla k kompromitaci 4684 webov\u00fdch str\u00e1nek, kter\u00e9 vyu\u017e\u00edvaly tyto syst\u00e9my (1249<\/a><\/noindex> \u2014 Picreel a 3435<\/a><\/noindex> \u2014 Alpaca Forms). <\/p>\n

Vlo\u017een\u00fd \u0161kodliv\u00fd k\u00f3d<\/a><\/noindex> sb\u00edral informace o vypl\u0148ov\u00e1n\u00ed v\u0161ech webov\u00fdch formul\u00e1\u0159\u016f na str\u00e1nk\u00e1ch a mohl tak\u00e9 v\u00e9st k zachycen\u00ed platebn\u00edch informac\u00ed a autentiza\u010dn\u00edch parametr\u016f. Zachycen\u00e9 informace byly pos\u00edl\u00e1ny na server font-assets.com jako po\u017eadavek na obr\u00e1zky. Zat\u00edm nejsou k dispozici informace o tom, jak p\u0159esn\u011b byla infrastruktura Picreel a CDN s\u00ed\u0165 pro doru\u010dov\u00e1n\u00ed skriptu Alpaca Forms kompromitov\u00e1na. Je zn\u00e1mo pouze to, \u017ee b\u011bhem \u00fatoku na Alpaca Forms byly pozm\u011bn\u011bny skripty dod\u00e1van\u00e9 p\u0159es s\u00ed\u0165 pro doru\u010dov\u00e1n\u00ed obsahu Cloud CMS. \u0160kodliv\u00e1 komponenta<\/a><\/noindex> byla zakamuflov\u00e1na jako datov\u00e9 pole v minimalizovan\u00e9 verzi<\/a><\/noindex> skriptu (de\u0161ifrov\u00e1n\u00ed k\u00f3du m\u016f\u017eete vid\u011bt zde<\/a><\/noindex>).<\/p>\n

\"Z\u00e1m\u011bna<\/a><\/noindex><\/center><\/p>\n

Mezi u\u017eivateli kompromitovan\u00fdch projekt\u016f je mnoho velk\u00fdch spole\u010dnost\u00ed, v\u010detn\u011b Sony, Forbes, Trustico, FOX, ClassesUSA, 3Dcart, Saxo Bank, Foundr, RocketInternet, Sprit a Virgin Mobile. Vzhledem k tomu, \u017ee se nejedn\u00e1 o prvn\u00ed \u00fatok tohoto druhu (viz incident<\/a><\/noindex> se z\u00e1m\u011bnou po\u010ditadla StatCounter), doporu\u010duje se spr\u00e1vc\u016fm webov\u00fdch str\u00e1nek velmi pe\u010dliv\u011b zva\u017eovat um\u00eds\u0165ov\u00e1n\u00ed extern\u00edho JavaScriptov\u00e9ho k\u00f3du, zejm\u00e9na na str\u00e1nk\u00e1ch souvisej\u00edc\u00edch s platbami a autentizac\u00ed.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0412\u0438\u043b\u043b\u0435\u043c \u0434\u0435 \u0413\u0440\u043e\u043e\u0442 (Willem de Groot) \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0432\u0441\u0442\u0430\u0432\u043a\u0443 \u0432 \u043a\u043e\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u044b web-\u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 Picreel \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 web-\u0444\u043e\u0440\u043c Alpaca Forms. \u041f\u043e\u0434\u043c\u0435\u043d\u0430 JavaScript-\u043a\u043e\u0434\u0430 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 4684 \u0441\u0430\u0439\u0442\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0441\u0432\u043e\u0438\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (1249 — Picreel \u0438 3435 — Alpaca Forms). \u0412\u043d\u0435\u0434\u0440\u0451\u043d\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25200,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33499","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Z\u00e1m\u011bna k\u00f3du projekt\u016f Picreel a Alpaca Forms vedla k kompromitaci 4684 webov\u00fdch str\u00e1nek | ProHoster","description":"Bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edk Willem de Groot uvedl, \u017ee v d\u016fsledku kompromitace infrastruktury.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/podmena-koda-proektov-picreel-i-alpaca-forms-privela-k-komprometatsii-4684-sajtov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043a\u043e\u0434\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 Picreel \u0438 Alpaca Forms \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 4684 \u0441\u0430\u0439\u0442\u043e\u0432 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0412\u0438\u043b\u043b\u0435\u043c \u0434\u0435 \u0413\u0440\u043e\u043e\u0442 (Willem de Groot) \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/podmena-koda-proektov-picreel-i-alpaca-forms-privela-k-komprometatsii-4684-sajtov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:57+00:00","article:modified_time":"2019-10-31T18:52:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33499","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:31:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:39:23","updated":"2026-01-21 15:31:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=33499"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33499\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/25200"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=33499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=33499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=33499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}