{"id":113361,"date":"2024-02-02T13:41:16","date_gmt":"2024-02-02T11:41:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov"},"modified":"2024-02-02T13:41:16","modified_gmt":"2024-02-02T11:41:16","slug":"kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","title":{"rendered":"Cloudflare avaldas teavet oma serverite h\u00e4kkimise kohta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare, mis pakub sisu edastamise v\u00f5rguteenuseid, mis teenindavad umbes 20% interneti liiklusest, avaldas aruande \u00fche oma infrastruktuuri serveri h\u00e4kkimisest, kus t\u00f6\u00f6tas sisemine wiki-sait Atlassiani Confluence platvormil, veahalduss\u00fcsteem Atlassian Jira ja koodihalduse s\u00fcsteem Bitbucket. Anal\u00fc\u00fcs n\u00e4itas, et r\u00fcndaja sai serverisse ligip\u00e4\u00e4su, kasutades Okta oktobris toimunud h\u00e4kkimise k\u00e4igus saadud tokenite v\u00f5imalusi, mis viisid juurdep\u00e4\u00e4su tokenite lekkimiseni. <\/p>\n

P\u00e4rast Okta h\u00e4kkimise teabe avalikustamist s\u00fcgisel alustas Cloudflare Okta teenuste kaudu kasutatavate mandaadi, v\u00f5tmete ja tokenite uuendamise protsessi. Kuid selgus, et \u00fcks token ja kolm kontot (tuhandete seast), mis Okta h\u00e4kkimise tulemusena olid kompromiteeritud, ei olnud asendatud ja j\u00e4tkasid tegevust, mida r\u00fcndaja kasutas. Need mandaadid peeti kasutamata, kuid v\u00f5imaldasid paraku juurdep\u00e4\u00e4su Atlassiani platvormile, koodihalduse s\u00fcsteemile Bitbucket, SaaS-rakendusele, millel oli halduskontroll Atlassiani Jira keskkonna \u00fcle ja AWS keskkonnale, mis teenindas Cloudflare Apps katalooge, kuid ei p\u00e4\u00e4senud CDN infrastruktuuri ja ei hoidnud konfidentsiaalseid andmeid. <\/p>\n

Juhtum ei m\u00f5jutanud Cloudflare'i kasutajate andmeid ja s\u00fcsteeme. Tehtud audit tuvastas, et r\u00fcnnak piirines Atlassiani toodete s\u00fcsteemidega ning ei levinud mujale serverid<\/a>, t\u00e4nu Cloudflare'i rakendatud null usalduse (Zero Trust) mudelile ja infrastruktuuri osade isolatsioonile. <\/p>\n

Cloudflare'i serveri h\u00e4kkimine tuvastati 23. novembril ja esimesed t\u00f5endid volitamata juurdep\u00e4\u00e4sust wiki ja veahalduss\u00fcsteemi tuvastati 14. novembril. 22. novembril paigaldas r\u00fcndaja tagaukse, et saada pidev ligip\u00e4\u00e4s, mis loodi Jira jaoks m\u00f5eldud ScriptRunner'i abil. Samal p\u00e4eval sai r\u00fcndaja juurdep\u00e4\u00e4su l\u00e4htekoodi haldamise s\u00fcsteemile, kus kasutati Atlassiani Bitbucket platvormi. Seej\u00e4rel tehti katseid \u00fchenduste loomiseks konsooli serverile<\/a>, mis oli m\u00f5eldud veel avamata andmekeskusesse Brasiilias p\u00e4\u00e4semiseks, kuid k\u00f5ik \u00fchenduse loomise katsed olid eba\u00f5nnestunud. <\/p>\n

Tundub, et r\u00fcndaja tegevus piirdus sisu edastamise v\u00f5rgustiku arhitektuuri uurimise ja n\u00f5rkade kohtade otsimisega. Oma tegevuse k\u00e4igus kasutas r\u00fcndaja wiki otsingut, et leida kaugrakenduse, saladuste, openconnecti, cloudflared ja tokenitega seotud m\u00e4rks\u00f5nu. Tuvastati, et kurjategija avas 202 wiki-lehte (194100-st) ja 36 probleemiraportit (2059357-st), mis olid seotud turvaaukude k\u00f5rvaldamise ja v\u00f5tmete rotatsiooni haldamisega. Samuti avastati 120 koodihoidla allalaadimist (11904-st), millest enamik oli seotud varundamise, seadistamise ja CDN haldamise, identifitseerimise s\u00fcsteemide, kaugrakenduse ja Terraformi ja Kubernetes'i platvormide kasutamisega. M\u00f5nes hoidlas esinesid koodis j\u00e4tnud kr\u00fcpteeritud v\u00f5tmed, mis asendati kohe p\u00e4rast juhtumit, hoolimata usaldusv\u00e4\u00e4rsete kr\u00fcpteerimismeetodite kasutamisest.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 wiki-\u0441\u0430\u0439\u0442 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Atlassian Confluence, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a Atlassian Jira \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u043e\u043c Bitbucket. \u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113361","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare avaldas teavet \u00fche oma serveri h\u00e4kkimise kohta | ProHoster","description":"Cloudflare, mis pakub sisu edastamise v\u00f5rguteenuseid, mis teenindavad umbes 20% interneti liiklusest, avaldas aruande \u00fche oma infrastruktuuri serveri h\u00e4kkimisest, kus t\u00f6\u00f6tas sisemine wiki-sait Atlassiani Confluence platvormil, veahalduss\u00fcsteem Atlassian Jira ja koodihalduse s\u00fcsteem Bitbucket. Anal\u00fc\u00fcs n\u00e4itas, et r\u00fcndaja sai serverisse ligip\u00e4\u00e4su, kasutades tokenite v\u00f5imalusi, mis sai saadud oktoobris.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 wiki-\u0441\u0430\u0439\u0442 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Atlassian Confluence, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a Atlassian Jira \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u043e\u043c Bitbucket. \u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T11:41:16+00:00","article:modified_time":"2024-02-02T11:41:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113361","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=113361"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113361\/revisions"}],"predecessor-version":[{"id":160155,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113361\/revisions\/160155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=113361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=113361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=113361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}