{"id":112852,"date":"2024-01-12T15:10:15","date_gmt":"2024-01-12T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy"},"modified":"2026-02-13T23:24:49","modified_gmt":"2026-02-13T21:24:49","slug":"ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","title":{"rendered":"PyTorch infrastruktuuri r\u00fcnnak, mis kompromiteerib hoidlat ja versioone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Paljastatud on r\u00fcnnaku detailid infrastruktuuril, mida kasutatakse masin\u00f5ppe raamistikku PyTorch arendamisel, mis v\u00f5imaldas p\u00e4\u00e4sukoodide v\u00e4ljav\u00f5tmist, mis on piisavad, et hostida juhuslikke andmeid projekti versioonide hoidlas GitHubis ja AWS-is, samuti koodi sisestamine peavoolu hoidlas ja tagaukse lisamine s\u00f5ltuvuste kaudu. PyTorchi versioonide muutmine v\u00f5iks olla kasutusel r\u00fcnnakutes suurte ettev\u00f5tete vastu, nagu Google, Meta, Boeing ja Lockheed Martin, kes kasutavad PyTorchi oma projektides. Meta Bug Bounty programmi raames maksis ettev\u00f5te uurijatele $16,250 probleemi kohta teabe eest. <\/p>\n

R\u00fcnnaku olemus seisneb v\u00f5imaluses k\u00e4itada oma koodi serverites<\/a> katkematu integreerimise, mis teostavad uuesti koostamise ja testimis\u00fclesannete t\u00e4itmise uute muudatuste jaoks, mis saadetakse hoidlasse. Probleem puudutab projekte, mis kasutavad enda v\u00e4liseid t\u00f6\u00f6tlejaid «Self-Hosted Runner» GitHub Actions'i koosseisus. Erinevalt traditsioonilisest GitHub Actions'ist, t\u00f6\u00f6tavad Self-Hosted t\u00f6\u00f6tlejad mitte GitHubi infrastruktuuris, vaid nende enda oma serverites v\u00f5i virtuaalsetes<\/a> arendajate poolt toetatud masinates. <\/p>\n

Koostamis\u00fclesannete t\u00e4itmine oma serverites v\u00f5imaldab korraldada koodi k\u00e4ivitamist, mis v\u00f5ib teostada ettev\u00f5tte sisese v\u00f5rgu skaneerimise, s\u00fcsteemi sisefailidest \u0161ifreerimisv\u00f5tmete ja ligip\u00e4\u00e4sutokenite otsimise, keskkonnamuutujate anal\u00fc\u00fcsi koos parameetritega, mis viitavad v\u00e4listele salvestustele v\u00f5i pilveteenustele. Kui koostamiskeskkonda ei ole piisavalt isoleeritud, v\u00f5ivad leitud konfidentsiaalsed andmed sattuda r\u00fcndajatele v\u00e4ljapoole, n\u00e4iteks t\u00e4nu v\u00e4liste API-dele. Projekti «Self-Hosted Runner» rakendamise m\u00e4\u00e4ratlemiseks v\u00f5ib kasutada Gato t\u00f6\u00f6riistu, mis anal\u00fc\u00fcsivad avalikuks tehtud t\u00f6\u00f6voogude faile ja CI-\u00fclesannete k\u00e4ivitamise logisid. <\/p>\n

PyTorchis ja paljude teiste projektide puhul, mis kasutavad «Self-Hosted Runner», on \u00fclesannete k\u00e4ivitamine lubatud ainult arendajatele, kelle muudatused on eelnevalt l\u00e4binud \u00fclevaatamise ja lisatud projekti koodibaasi. Kui kasutate vaikeseadeid, annab «contributor» staatuse olemasolu v\u00f5imaluse k\u00e4ivitada GitHub Actionsi t\u00f6\u00f6tlejaid pull-requestide esitamisel ning seega k\u00e4ivitada oma koodi mis tahes GitHub Actions Runneri keskkonnas, mis on seotud hoidla v\u00f5i projekti korraldava organisatsiooniga. <\/p>\n

Status \u201econtributor\u201c sidumistamine osutus lihtsaks \u2014 piisab v\u00e4ikesest muudatusest, mille eelnevalt saadetakse ja oodatakse selle vastuv\u00f5tmist koodibaasi, p\u00e4rast mida arendaja saab automaatselt aktiivse osalise staatuse, kelle pull-p\u00e4ringute testimine CI-infrastruktuuris on lubatud ilma eraldi kontrollita. Aktiivse arendaja staatuse saamiseks kasutati eksperimendi k\u00e4igus v\u00e4ikeseid kosmeetilisi muudatusi, mis olid seotud dokumentatsiooni tr\u00fckivigade k\u00f5rvaldamisega. PyTorch'i hoidla ja v\u00e4ljalaske hoidla juurde p\u00e4\u00e4semiseks r\u00fcnnaku k\u00e4igus, k\u00e4ivitades koodi \u201eSelf-Hosted Runner'is\u201c, tehti GitHub'i tokeni pealtkuulamine, mida kasutas hoidla juurdep\u00e4\u00e4suks koostamisprotsessidest, samuti AWS-i v\u00f5tmeid, mis olid kaasatud ehitustulemuste salvestamisse. <\/p>\n

Probleem ei ole spetsiifiline PyTorchile ja puudutab paljusid teisi suuri projekte, mis kasutavad GitHub Actionsi \u00abSelf-Hosted Runner\u00bb vaikeseadeid. N\u00e4iteks on sarnaste r\u00fcnnakute puhul mainitud tagavarav\u00f5tmete sisestamist mitmetesse suurtesse kr\u00fcptovaluuta rahakottidesse ja miljarditega kapitaliseeritud plokiahela projektidesse, muudatusi Microsoft Deepspeed ja TensorFlow v\u00e4ljalaskes, CloudFlare'i rakenduse kompromiteerimist ning koodi t\u00e4itmist Microsofti v\u00f5rgus. Need juhtumid on praegu veel avalikustamata. Bug Bounty programmide raames on teadlased esitanud \u00fcle 20 taotluse, et saada preemiaid kokku sadade tuhandete dollarite ulatuses.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f PyTorch, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0443\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432 GitHub \u0438 AWS, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 PyTorch \u043c\u043e\u0433\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112852","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 R\u00fcnnak PyTorch'i infrastruktuurile, mis ohustab repot ja v\u00e4ljaandeid | ProHoster","description":"Avaldati \u00fcksikasjad r\u00fcnnakust PyTorch'i masin\u00f5ppe raamistikku toetavale infrale, mis v\u00f5imaldas juurdep\u00e4\u00e4suv\u00f5tmete hankimist, piisavaid andmete paigutamiseks projekti v\u00e4ljaande repo GitHubis ja AWS-is, samuti koodi sisestamiseks peavoolu ja tagaveebi lisamiseks s\u00f5ltuvuste kaudu. PyTorch'i v\u00e4ljaannete asendamine v\u00f5is olla suunatud suurtele ettev\u00f5tetele.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 PyTorch, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0430\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0438 \u0440\u0435\u043b\u0438\u0437\u044b | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f PyTorch, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0443\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432 GitHub \u0438 AWS, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 PyTorch \u043c\u043e\u0433\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-12T13:10:15+00:00","article:modified_time":"2026-02-13T21:24:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112852","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-13 21:24:49","updated":"2026-02-13 21:24:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112852"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112852\/revisions"}],"predecessor-version":[{"id":164381,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112852\/revisions\/164381"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}