{"id":113361,"date":"2024-02-02T13:41:16","date_gmt":"2024-02-02T11:41:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov"},"modified":"2024-02-02T13:41:16","modified_gmt":"2024-02-02T11:41:16","slug":"kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","title":{"rendered":"Cloudflare has revealed details about the breach of one of its servers.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare, der leverer et indholdleveringsnetv\u00e6rk, som st\u00e5r for cirka 20% af internettets trafik, offentliggjorde en rapport om et hack af en af serverne i deres infrastruktur, hvor der k\u00f8rte et internt wiki-websted baseret p\u00e5 Atlassian Confluence, fejlh\u00e5ndteringssystemet Atlassian Jira og kildekodelageret Bitbucket. Unders\u00f8gelsen viste, at angriberen havde f\u00e5et adgang til serveren ved at udnytte tokens, der blev opn\u00e5et som resultat af oktober-hacket af virksomheden Okta, hvilket resulterede i l\u00e6kage af adgangstokens. <\/p>\n

Efter offentligg\u00f8relsen af hacket af Okta om efter\u00e5ret, indledte Cloudflare en proces til opdatering af de credentials, n\u00f8gler og tokens, der anvendes gennem Okta-tjenesterne, men det viste sig, at \u00e9t token og tre konti (ud af flere tusinde), der var kompromitteret som f\u00f8lge af Okta-hacket, ikke blev udskiftet og fortsatte med at v\u00e6re aktive, hvilket angriberen udnyttede. De n\u00e6vnte credentials blev anset for ikke at v\u00e6re i brug, men muliggav faktisk adgang til Atlassian-platformen, kildekode management-systemet Bitbucket, et SaaS-program med administrativ adgang til milj\u00f8et Atlassian Jira, samt et setup i AWS, der betjente kataloget Cloudflare Apps, men som ikke havde adgang til CDN-infrastrukturen og ikke opbevarede fortrolige data. <\/p>\n

H\u00e6ndelsen p\u00e5virkede ikke Cloudflares brugerdata og -systemer. En gennemgang fastslog, at angrebet var begr\u00e6nset til systemerne med Atlassian-produkter og ikke spredte sig til andre. servere<\/a>, takket v\u00e6re anvendelsen af Cloudflares zero trust-model og isoleringen af infrastruktursystemerne. <\/p>\n

Hack af Cloudflares server blev opdaget den 23. november, mens de f\u00f8rste spor af uautoriseret adgang til wiki'en og fejlh\u00e5ndteringssystemet blev registreret den 14. november. Den 22. november etablerede angriberen en backdoor for at f\u00e5 permanent adgang, oprettet ved hj\u00e6lp af ScriptRunner til Jira. Samme dag fik angriberen adgang til kildekodeh\u00e5ndteringssystemet, der benyttede Atlassian Bitbucket. Herefter blev der fors\u00f8gt forbindelse til konsollen server<\/a>, som blev brugt til at f\u00e5 adgang til det endnu ikke operationelle datacenter i Brasilien, men alle forbindelsesfors\u00f8g viste sig at v\u00e6re mislykkede. <\/p>\n

Det ser ud til, at angrebshandlerens aktivitet begr\u00e6nsede sig til at studere arkitekturen for indholdsleveringsnetv\u00e6rket og lede efter svagheder. Under sin aktivitet anvendte angriberen wiki-s\u00f8gning med n\u00f8gleord relateret til fjernadgang, hemmeligheder, openconnect, cloudflared og tokens. Der er registreret, at gerningsmanden \u00e5bnede 202 wiki-sider (ud af 194100) og 36 fejlrapporter (ud af 2059357), relateret til forvaltningen af s\u00e5rbarhedsafhj\u00e6lpning og rotationsn\u00f8gler. Derudover blev 120 kode-repositorier (ud af 11904) downloadet, hvoraf de fleste er relateret til backup, ops\u00e6tning og administration af CDN, identifikationssystemer, fjernadgang samt brugen af Terraform og Kubernetes platforme. I nogle af repository'erne var der efterladte krypterede n\u00f8gler i koden, som blev erstattet umiddelbart efter h\u00e6ndelsen, p\u00e5 trods af brugen af p\u00e5lidelige krypteringsmetoder.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 wiki-\u0441\u0430\u0439\u0442 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Atlassian Confluence, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a Atlassian Jira \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u043e\u043c Bitbucket. \u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113361","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare afsl\u00f8rede oplysninger om hackingen af en af deres servere | ProHoster","description":"Cloudflare, som leverer et indholdsleveringsnetv\u00e6rk, der h\u00e5ndterer omkring 20% af internettrafikken, har offentliggjort en rapport om hackingen af en af deres interne servere.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T11:41:16+00:00","article:modified_time":"2024-02-02T11:41:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113361","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/113361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=113361"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/113361\/revisions"}],"predecessor-version":[{"id":160155,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/113361\/revisions\/160155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=113361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=113361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=113361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}