GitHub tau tshaj tawm cov txiaj ntsig ntawm kev tshuaj xyuas ntawm qhov kev tawm tsam, raws li qhov tshwm sim ntawm lub Plaub Hlis 12, cov neeg tawm tsam tau nkag mus rau huab ib puag ncig hauv Amazon AWS cov kev pabcuam siv hauv cov txheej txheem ntawm NPM project. Kev tshuaj xyuas ntawm qhov xwm txheej tau pom tias cov neeg tawm tsam tau nkag mus rau cov ntawv luam theej ntawm skimdb.npmjs.com tus tswv, suav nrog cov ntaub ntawv thaub qab nrog cov ntaub ntawv pov thawj rau kwv yees li 100 txhiab NPM cov neeg siv txij li xyoo 2015, suav nrog tus password hashes, npe thiab email.
Tus password hashes tau tsim los siv cov ntsev PBKDF2 lossis SHA1 algorithms, uas tau hloov pauv xyoo 2017 los ntawm kev siv dag zog ntau dua bcrypt. Thaum qhov xwm txheej raug txheeb xyuas, cov passwords cuam tshuam tau rov pib dua thiab cov neeg siv tau ceeb toom kom teeb tus password tshiab. Txij li qhov yuav tsum tau ua pov thawj ob qho tseem ceeb nrog kev lees paub email tau suav nrog hauv NPM txij li Lub Peb Hlis 1, qhov kev pheej hmoo ntawm cov neeg siv kev cuam tshuam raug ntsuas raws li qhov tsis tseem ceeb.
Tsis tas li ntawd, tag nrho cov ntaub ntawv nthuav tawm thiab cov metadata ntawm cov pob khoom ntiag tug txij li lub Plaub Hlis 2021, CSV cov ntaub ntawv nrog cov npe tshiab ntawm txhua lub npe thiab cov qauv ntawm cov pob khoom ntiag tug, nrog rau cov ntsiab lus ntawm txhua pob khoom ntiag tug ntawm ob tus neeg siv GitHub (npe tsis qhia tawm) poob rau hauv txhais tes ntawm cov neeg tawm tsam. Raws li rau lub chaw cia khoom nws tus kheej, kev tshuaj xyuas cov cim thiab kev txheeb xyuas cov pob hashes tsis tau qhia cov neeg tawm tsam hloov pauv rau NPM pob lossis tshaj tawm cov ntawv tsis tseeb tshiab ntawm pob.
Qhov kev tawm tsam tau tshwm sim rau lub Plaub Hlis 12 siv cov neeg nyiag OAuth tokens tsim rau ob tus neeg thib peb GitHub integrators, Heroku thiab Travis-CI. Siv cov tokens, cov neeg tawm tsam tuaj yeem rho tawm los ntawm tus kheej GitHub repositories tus yuam sij nkag mus rau Amazon Web Services API, siv hauv NPM qhov project infrastructure. Cov txiaj ntsig tau tso cai nkag mus rau cov ntaub ntawv khaws cia hauv AWS S3 kev pabcuam.
Tsis tas li ntawd, cov ntaub ntawv tau tshaj tawm txog yav dhau los txheeb xyuas qhov teeb meem tsis pub lwm tus paub thaum ua cov ntaub ntawv cov neeg siv ntawm NPM servers - cov passwords ntawm qee tus neeg siv NPM, nrog rau NPM nkag tokens, tau muab khaws cia rau hauv cov ntawv ntshiab hauv cov cav sab hauv. Thaum lub sij hawm kev koom ua ke ntawm NPM nrog GitHub logging system, cov neeg tsim khoom tsis paub meej tias cov ntaub ntawv rhiab raug tshem tawm ntawm kev thov rau NPM cov kev pabcuam muab tso rau hauv lub cav. Nws raug liam tias qhov tsis txaus ntseeg tau kho thiab cov cav tau raug tshem tawm ua ntej kev tawm tsam ntawm NPM. Tsuas yog qee tus neeg ua haujlwm GitHub tau nkag mus rau cov cav, uas suav nrog cov password rau pej xeem.
Tau qhov twg los: opennet.ru