{"id":112852,"date":"2024-01-12T15:10:15","date_gmt":"2024-01-12T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy"},"modified":"2026-02-13T23:24:49","modified_gmt":"2026-02-13T21:24:49","slug":"ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","title":{"rendered":"R\u00fcnnak PyTorch infrastruktuurile, mis kompromiteerib hoidlaid ja versioonid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on \u00fcksikasjad r\u00fcnnaku kohta infrastruktuurile, mida kasutati PyTorchi masin\u00f5ppe raamistikku arendamisel, mis v\u00f5imaldas p\u00e4\u00e4sud v\u00f5tmed, mis on piisavad, et paigutada suvalisi andmeid projekti GitHub'i ja AWS'i versioonide hoidlasse, samuti koodi asendamiseks p\u00f5hiharusse ja tagaukse lisamiseks s\u00f5ltuvuste kaudu. PyTorchi versioonide valeesitamine v\u00f5iks olla kasutatud r\u00fcnnakute teostamiseks suurtele ettev\u00f5tetele, nagu Google, Meta, Boeing ja Lockheed Martin, kes kasutavad PyTorchi oma projektides. Bug Bounty programmi raames maksis ettev\u00f5te Meta teadlastele 16250 dollarit teabe eest probleemist. <\/p>\n

R\u00fcnnaku sisuks on v\u00f5imalus k\u00e4ivitada oma kood serverites<\/a> katkestusteta integreerimise, mis teostavad \u00fcmberkompileerimist ja \u00fclesannete t\u00e4itmist uute muudatuste testimiseks, mis saadetakse hoidlasse. Probleem puudutab projekte, mis kasutavad oma v\u00e4liseid t\u00f6\u00f6tlejat \"Self-Hosted Runner\" GitHub Actions'i abil. Erinevalt traditsioonilistest GitHub Actions'i t\u00f6\u00f6tlejatest, toimuvad Self-Hosted t\u00f6\u00f6tlemised mitte GitHubi infrastruktuuris, vaid nende enda serverites v\u00f5i virtuaalsetes<\/a> masinates, mida toetavad arendajad. <\/p>\n

Kogumiste \u00fclesannete t\u00e4itmine oma serverites v\u00f5imaldab korraldada koodi k\u00e4ivitamist, mis v\u00f5ib skaneerida ettev\u00f5tte sisev\u00f5rku, otsida kohalikust failis\u00fcsteemist kr\u00fcptov\u00f5tmeid ja p\u00e4\u00e4sulube, anal\u00fc\u00fcsida keskkonnamuutujaid, mis sisaldavad v\u00e4liste ladustamis- v\u00f5i pilveteenuste juurde p\u00e4\u00e4semise parameetreid. Ilma piisava eraldatuseta kogumiskeskkondadest v\u00f5ivad leitud konfidentsiaalsed andmed j\u00f5uda r\u00fcndajateni, n\u00e4iteks l\u00e4bi v\u00e4liste API-de. Projektide \"Self-Hosted Runner\" rakenduse m\u00e4\u00e4ramiseks v\u00f5ib kasutada Gato t\u00f6\u00f6riista, mis anal\u00fc\u00fcsib avalikult olemasolevaid t\u00f6\u00f6voofailide ja CI-\u00fclesannete k\u00e4ivitamise logisid. <\/p>\n

PyTorchis ja paljudes teistes projektides, mis kasutavad \"Self-Hosted Runner\"-it, on kogumiste \u00fclesannete k\u00e4ivitamine lubatud ainult arendajatele, kelle muudatused on varem l\u00e4bi vaadatud ja lisatud projekti koodibaasi. 'Contributor' staatuse omamine vaikeseadete kasutamisel hoidlas v\u00f5imaldab k\u00e4ivitada GitHub Actions t\u00f6\u00f6tlejat, kui esitatakse pull-request'e, ja seega k\u00e4ivitada oma koodi mis tahes keskkonnas, mis on seotud GitHub Actions Runner'iga, mis on seotud hoidla v\u00f5i projekti korraldava organisatsiooniga. <\/p>\n

Seosus$status$ \"contributor\" oli lihtne \u00fcmber minna \u2014 piisab, kui saata eelnevalt v\u00e4ike muudatus ja oodata, et see aktsepteeritakse koodibaasi. P\u00e4rast seda sai arendaja automaatselt aktiivse osaleja staatuse, mille pull-p\u00e4ringute testimine CI-infrastruktuuris on lubatud ilma eraldi kontrollita. Eksperimendi k\u00e4igus kasutati aktiivse arendaja staatuse saamiseks v\u00e4ikesi kosmeetilisi muudatusi, mis olid seotud dokumentatsioonis tr\u00fckivigade k\u00f5rvaldamisega. PyTorch'i hoidla ja v\u00e4ljalaskehoidla juurde p\u00e4\u00e4semiseks toimus r\u00fcnnaku k\u00e4igus koodi t\u00e4itmisel \"Self-Hosted Runner\" alla GitHub'i tokeni kuulamine, mis oli ette n\u00e4htud hoidla juurdep\u00e4\u00e4suks koostamisprotsessides, samuti AWS v\u00f5tmete, mida kasutati koostamisprotsesside tulemuste salvestamiseks, kuulamine. <\/p>\n

Probleem ei ole spetsiifiline PyTorch'ile ja m\u00f5jutab paljusid teisi suuri projekte, mis kasutavad GitHub Actions \"Self-Hosted Runner\" vaikeseadeid. N\u00e4iteks on sarnaste r\u00fcnnakute k\u00e4igus aset leidnud, et m\u00f5nede suurte kr\u00fcptorahakottide ja miljardite dollarite \u00e4riprojektide blokki, Microsoft Deepspeed'i ja TensorFlow v\u00e4ljalasetesse sisestatakse tagak\u00e4si, CloudFlare'i ettev\u00f5tte \u00fche rakenduse kompromiteerimisega ja kood dekodeeritakse Microsofti v\u00f5rgu arvutis. Nende juhtumite \u00fcksikasjad ei ole veel avalikustatud. Bug Bounty programmide raames on teadlased esitanud enam kui 20 taotlust, et saada h\u00fcvitisi, mis kokku moodustavad mitu sada tuhat dollarit.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f PyTorch, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0443\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432 GitHub \u0438 AWS, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 PyTorch \u043c\u043e\u0433\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112852","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnak PyTorchi infrastruktuurile, mis kompromiteerib hoidla ja v\u00e4ljalasked | ProHoster","description":"Avalikustati r\u00fcnnaku \u00fcksikasjad PyTorchi masin\u00f5ppe raamistiku arendamiseks kasutatava infrastruktuuri kohta, mis v\u00f5imaldas hankida juurdep\u00e4\u00e4suv\u00f5tmed, mis on piisavad, et paigutada juhuslikke andmeid v\u00e4ljalaskete hoidlas.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 PyTorch, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0430\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0438 \u0440\u0435\u043b\u0438\u0437\u044b | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f PyTorch, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0443\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-12T13:10:15+00:00","article:modified_time":"2026-02-13T21:24:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112852","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-13 21:24:49","updated":"2026-02-13 21:24:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112852"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112852\/revisions"}],"predecessor-version":[{"id":164381,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112852\/revisions\/164381"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}