{"id":150625,"date":"2025-12-04T23:12:08","date_gmt":"2025-12-04T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2"},"modified":"2025-12-04T23:12:08","modified_gmt":"2025-12-04T21:12:08","slug":"analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","title":{"rendered":"Anal\u00fc\u00fcs Shai-Hulud 2 ussi poolt haaratud konfidentsiaalsetest andmetest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Wiz avaldas anal\u00fc\u00fcsi tulemused Shai-Hulud 2 ussi tegevuse j\u00e4lgedest. Selle tegevuse k\u00e4igus avaldati NPM-i repositooriumis \u00fcle 800 pahatahtliku paketi, millel kokku oli \u00fcle 100 miljoni allalaadimise. P\u00e4rast nakatunud paketi installimist aktiveerub uss, otsib konfidentsiaalseid andmeid, avaldab uusi pahatahtlikke v\u00e4ljaandeid (leidnud NPM-i kataloogi \u00fchendustokeni) ja avaldab leitud konfidentsiaalsed andmed avatud ligip\u00e4\u00e4suga loodud uusites GitHubi repositooriumites. <\/p>\n

GitHubis on tuvastatud \u00fcle 30 000 hoidla, kus on salvestatud ussiga varastatud andmeid. Umbes 70% neist hoidlatest sisaldavad faili content.json, 50% \u2014 faili truffleSecrets.json, ja 80% \u2014 faili environment.json, mis sisaldavad ligip\u00e4\u00e4sukoode, konfidentsiaalset teavet ja keskkonnaparameetreid, leitud arendaja s\u00fcsteemilt, kes installis pahavaraga paketi. Samuti on nendes hoidlates tuvastatud umbes 400 faili actionsSecrets.json, kus leidub v\u00f5tmeid, mis on leitud GitHub Actions keskkondades. <\/p>\n

Failides contents.json oli rohkem kui 500 ainulaadset sisselogimist ja GitHubi \u00fchendustokenit. Failides truffleSecrets.json sisalduvad konfidentsiaalsed andmed, mis leiti p\u00e4rast TruffleHogi t\u00f6\u00f6riista k\u00e4ivitamist nakatunud s\u00fcsteemis, mis kogub \u00fcle 800 erineva andme t\u00fc\u00fcbi, sealhulgas ligip\u00e4\u00e4su v\u00f5tmed, kr\u00fcpteerimise v\u00f5tmed, paroolid ja tokenid, mida kasutatakse erinevates teenustes, pilvkeskkondades, toodetes ja andmebaasides. Kokku tuvastati truffleSecrets.json-is \u00fcle 400 000 ainulaadse kirje, millest umbes 2,5% (~10 000) oli kinnitatud. <\/p>\n

Eeldatakse, et avalikustatavad konfidentsiaalsed andmed v\u00f5ivad saada uue r\u00fcnnakute laine l\u00e4htepunktiks, kuna paljud andmed on endiselt aktuaalsed. N\u00e4iteks n\u00e4itas kontroll, et 60% NPM-i ligip\u00e4\u00e4su tokenitest, mis on haaratud nakatunud s\u00fcsteemidest, j\u00e4\u00e4b kehtima. <\/p>\n

Aruandes on esitatud ka \u00fcldine statistika, mis on saadud nakatunud s\u00fcsteemide keskkonnaparameetrite anal\u00fc\u00fcsi p\u00f5hjal. 23% ussi k\u00e4ivitamist toimus arendajate arvutites, 77% \u2014 pideva integreerimise s\u00fcsteemide keskkondades (60% GitHub Actions, 5% \u2014 Jenkins, 5% \u2014 GitLab CI, 3% \u2014 AWS CodeBuild). 87% s\u00fcsteemidest kasutas Linuxit, 12% \u2014 macOSi ja 1% \u2014 Windowsi. 76% k\u00e4ivitamist toimus konteinerites, 13% \u2014 p\u00f5hiskeemides. <\/p>\n

60% k\u00f5igist nakatumistest toimus pahatahtlike versioonide installimise t\u00f5ttu pakettidest @postman\/tunnel-agent-0.6.7 ja @asyncapi\/specs-6.8.3. 99% juhtudest aktiveeriti uss k\u00e4su \u201enode setup_bun.js\u201c k\u00e4ivitamisel, mis on m\u00e4rgitud package.json eelinstallimise sektsiooni (\u00fclej\u00e4\u00e4nud 1% kuulub t\u00f5en\u00e4oliselt testimiskatsetele).

\"Anal\u00fc\u00fcs<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0430\u043a\u0442\u0438\u0432\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0447\u0435\u0440\u0432\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043f\u043e\u0438\u0441\u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043b\u0438\u0437\u044b (\u043f\u0440\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 NPM) \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442 \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":150626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150625","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Salajaste andmete anal\u00fc\u00fcs, mille tabas uss Shai-Hulud 2 | ProHoster","description":"Ettev\u00f5te Wiz avaldas anal\u00fc\u00fcsi tulemused ussi Shai-Hulud 2 tegevuse j\u00e4lgedest, mille k\u00e4igus avaldati NPM-i repos rohkem kui 800 pahatahtlikku versiooni, mille koguarv \u00fcletab.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0447\u0435\u0440\u0432\u0451\u043c Shai-Hulud 2 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Wiz \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0432\u044f Shai-Hulud 2, \u0432 \u0445\u043e\u0434\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0431\u043e\u043b\u0435\u0435 800 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0432 \u0441\u0443\u043c\u043c\u0435 \u0431\u043e\u043b\u0435\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/analiz-konfidenczialnyh-dannyh-zahvachennyh-chervyom-shai-hulud-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-04T21:12:08+00:00","article:modified_time":"2025-12-04T21:12:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150625","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:25:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:25:22","updated":"2026-01-23 16:25:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/150625","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=150625"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/150625\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/150626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=150625"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=150625"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=150625"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}