{"id":31452,"date":"2019-10-31T21:41:20","date_gmt":"2019-10-31T18:41:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta\/"},"modified":"2019-10-31T21:41:20","modified_gmt":"2019-10-31T18:41:20","slug":"podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","title":{"rendered":"D\u00e9tails sur le second piratage de Matrix. Les cl\u00e9s GPG du projet ont \u00e9t\u00e9 compromises.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

De nouveaux d\u00e9tails ont \u00e9t\u00e9 publi\u00e9s concernant le piratage de l'infrastructure de la plateforme de messagerie d\u00e9centralis\u00e9e Matrix, signal\u00e9 ce matin. Le maillon probl\u00e9matique \u00e0 travers lequel les attaquants ont p\u00e9n\u00e9tr\u00e9 \u00e9tait le syst\u00e8me d'int\u00e9gration continue Jenkins, qui a \u00e9t\u00e9 pirat\u00e9 le 13 mars. Ensuite, sur le serveur Jenkins, un acc\u00e8s redirig\u00e9 par un agent SSH d'un des administrateurs a \u00e9t\u00e9 intercept\u00e9, permettant aux attaquants d'acc\u00e9der \u00e0 d'autres serveurs de l'infrastructure le 4 avril.<\/p>\n

Lors de la deuxi\u00e8me attaque, le site matrix.org a \u00e9t\u00e9 redirig\u00e9 vers un autre serveur (matrixnotorg.github.io) en modifiant les param\u00e8tres DNS, en utilisant la cl\u00e9 API de Cloudflare intercept\u00e9e lors de la premi\u00e8re attaque. Lors de la reconstruction du contenu serveurs<\/a> apr\u00e8s le premier piratage, les administrateurs de Matrix n'ont mis \u00e0 jour que les nouvelles cl\u00e9s personnelles et ont omis de mettre \u00e0 jour la cl\u00e9 pour Cloudflare. <\/p>\n

Lors de la deuxi\u00e8me attaque, les serveurs de Matrix sont rest\u00e9s intacts, les changements se limitant uniquement \u00e0 la substitution des adresses DNS. Si un utilisateur a d\u00e9j\u00e0 chang\u00e9 son mot de passe apr\u00e8s la premi\u00e8re attaque, il n'est pas n\u00e9cessaire de le changer \u00e0 nouveau. Cependant, si le mot de passe n'a pas encore \u00e9t\u00e9 modifi\u00e9, il doit \u00eatre actualis\u00e9 d\u00e8s que possible, car la fuite de la base de donn\u00e9es avec les hachages de mots de passe est confirm\u00e9e. Actuellement, un processus de r\u00e9initialisation forc\u00e9e du mot de passe est pr\u00e9vu lors de la prochaine connexion.<\/p>\n

En plus de la fuite de mots de passe, il a \u00e9galement \u00e9t\u00e9 confirm\u00e9 que des cl\u00e9s GPG, utilis\u00e9es pour la formation de signatures num\u00e9riques des paquets dans le d\u00e9p\u00f4t Debian de Synapse et les versions de Riot\/Web, sont tomb\u00e9es entre les mains des attaquants. Les cl\u00e9s \u00e9taient prot\u00e9g\u00e9es par mot de passe. \u00c0 l'heure actuelle, les cl\u00e9s ont d\u00e9j\u00e0 \u00e9t\u00e9 r\u00e9voqu\u00e9es. Les cl\u00e9s ont \u00e9t\u00e9 intercept\u00e9es le 4 avril, mais depuis, aucune mise \u00e0 jour de Synapse n'a \u00e9t\u00e9 publi\u00e9e, bien qu'une version du client Riot\/Web 1.0.7 ait \u00e9t\u00e9 lanc\u00e9e (un contr\u00f4le pr\u00e9liminaire a montr\u00e9 qu'il n'avait pas \u00e9t\u00e9 compromis). <\/p>\n

L'attaquant a publi\u00e9 une s\u00e9rie de rapports contenant des d\u00e9tails sur l'attaque sur GitHub, mais ils ont \u00e9t\u00e9 supprim\u00e9s. Cependant, les rapports sont rest\u00e9s dans l'archive.
\n
Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0432\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Matrix, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e\u0441\u044c \u0443\u0442\u0440\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u043c \u0437\u0432\u0435\u043d\u043e\u043c, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u043e\u043d\u0438\u043a\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0431\u044b\u043b\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Jenkins, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u0430 \u0435\u0449\u0451 13 \u043c\u0430\u0440\u0442\u0430. \u0417\u0430\u0442\u0435\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 c Jenkins \u0431\u044b\u043b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 SSH-\u0430\u0433\u0435\u043d\u0442\u043e\u043c \u0432\u0445\u043e\u0434 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 4 \u0430\u043f\u0440\u0435\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31452","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47D\u00e9tails sur le deuxi\u00e8me piratage de Matrix. Les cl\u00e9s GPG du projet ont \u00e9t\u00e9 compromises | ProHoster","description":"De nouveaux d\u00e9tails ont \u00e9t\u00e9 publi\u00e9s concernant le piratage de l'infrastructure de la plateforme de messagerie d\u00e9centralis\u00e9e Matrix, signal\u00e9 ce matin.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u0437\u043b\u043e\u043c Matrix. \u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b GPG-\u043a\u043b\u044e\u0447\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0432\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Matrix, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e\u0441\u044c \u0443\u0442\u0440\u043e\u043c.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:20+00:00","article:modified_time":"2019-10-31T18:41:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 16:59:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:16:23","updated":"2026-02-09 16:59:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/31452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=31452"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/31452\/revisions"}],"predecessor-version":[{"id":158549,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/31452\/revisions\/158549"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=31452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=31452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=31452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}