Paub meej txog qhov thib ob Matrix hack. Qhov project GPG yuam kev cuam tshuam

[:ru]

Tshaj tawm tshiab cov ntsiab lus hais txog lub hacking ntawm infrastructure ntawm decentralized messaging platform Matrix, hais txog qhov twg qhia thaum sawv ntxov. Qhov teeb meem txuas los ntawm cov neeg tawm tsam nkag mus yog Jenkins txuas ntxiv kev koom ua ke, uas tau raug nyiag thaum Lub Peb Hlis 13. Tom qab ntawd, ntawm Jenkins server, tus ID nkag mus ntawm ib tus thawj tswj hwm, raug xa rov qab los ntawm tus neeg sawv cev SSH, raug cuam tshuam, thiab lub Plaub Hlis 4, cov neeg tawm tsam tau nkag mus rau lwm cov servers hauv vaj tse.

Thaum lub sij hawm thib ob nres, lub vev xaib matrix.org tau xa mus rau lwm tus neeg rau zaub mov (matrixnotorg.github.io) los ntawm kev hloov pauv DNS chaw, siv tus yuam sij rau Cloudflare cov ntsiab lus xa khoom API cuam tshuam thaum thawj qhov kev tawm tsam. Thaum rov tsim kho cov ntsiab lus ntawm cov servers tom qab thawj hack, Matrix cov thawj coj hloov kho tsuas yog tus kheej cov yuam sij tshiab thiab tsis tau hloov kho tus yuam sij rau Cloudflare.

Thaum lub sijhawm tawm tsam thib ob, Matrix servers tseem tsis tau kov; kev hloov pauv tsuas yog hloov chaw nyob hauv DNS. Yog tias tus neeg siv twb tau hloov tus password tom qab thawj zaug tawm tsam, tsis tas yuav hloov nws zaum ob. Tab sis yog tias tus password tseem tsis tau hloov pauv, nws yuav tsum tau hloov kho sai li sai tau, txij li qhov xau ntawm cov ntaub ntawv nrog tus password hashes tau lees paub. Txoj kev npaj tam sim no yog pib qhov yuam kev rov pib dua tus password rau lwm zaus koj nkag mus.

Ntxiv rau qhov xau ntawm cov passwords, nws kuj tau lees paub tias GPG cov yuam sij siv los tsim cov ntawv kos npe digital rau pob khoom hauv Debian Synapse repository thiab Riot / Web tawm tau poob rau hauv tes ntawm cov neeg tawm tsam. Cov yuam sij tau tiv thaiv tus password. Cov yuam sij twb raug tshem tawm nyob rau lub sijhawm no. Cov yuam sij raug cuam tshuam rau lub Plaub Hlis 4, txij li thaum ntawd tsis muaj Synapse hloov tshiab tau raug tso tawm, tab sis Riot / Web tus thov kev pabcuam 1.0.7 raug tso tawm (kev kuaj ua ntej pom tias nws tsis raug cuam tshuam).

Tus neeg tawm tsam tau tshaj tawm cov lus ceeb toom ntawm GitHub nrog cov ntsiab lus ntawm kev tawm tsam thiab cov lus qhia kom nce kev tiv thaiv, tab sis lawv raug tshem tawm. Txawm li cas los xij, cov ntaub ntawv archived khaws cia.
Piv txwv li, tus neeg tawm tsam tau tshaj tawm tias Matrix developers yuav tsum siv ob-factor authentication los yog tsawg kawg tsis siv SSH tus neeg saib xyuas redirection ("ForwardAgent yog"), ces nkag mus rau hauv infrastructure yuav raug thaiv. Qhov kev nce siab ntawm kev tawm tsam kuj tuaj yeem raug tso tseg los ntawm kev muab cov neeg tsim tawm tsuas yog cov cai tsim nyog, tsis yog tag nrho hauv paus nkag ntawm tag nrho cov servers.

Tsis tas li ntawd, kev xyaum khaws cov yuam sij rau kev tsim cov ntawv kos npe digital ntawm cov servers ntau lawm tau raug thuam; ib tus tswv tsev cais yuav tsum tau faib rau cov hom phiaj zoo li no. Tseem tawm tsam qhia, yog tias Matrix cov neeg tsim khoom tau tshawb xyuas cov cav tsis tu ncua thiab txheeb xyuas qhov tsis sib xws, lawv yuav tau pom cov cim ntawm kev nyiag thaum ntxov (CI hack mus tsis tau tshawb pom rau ib hlis). Lwm qhov teeb meem yog khaws tag nrho cov ntaub ntawv teeb tsa hauv Git, uas ua rau nws tuaj yeem ntsuas qhov chaw ntawm lwm tus tswv yog tias ib tus ntawm lawv raug nyiag. Nkag mus los ntawm SSH rau infrastructure servers tsis yog txwv rau kev ruaj ntseg hauv network, uas ua rau nws muaj peev xwm txuas rau lawv los ntawm ib qho chaw nyob sab nraud.

Tau qhov twg losopennet.ru

[: en]

Tshaj tawm tshiab cov ntsiab lus hais txog lub hacking ntawm infrastructure ntawm decentralized messaging platform Matrix, hais txog qhov twg qhia thaum sawv ntxov. Qhov teeb meem txuas los ntawm cov neeg tawm tsam nkag mus yog Jenkins txuas ntxiv kev koom ua ke, uas tau raug nyiag thaum Lub Peb Hlis 13. Tom qab ntawd, ntawm Jenkins server, tus ID nkag mus ntawm ib tus thawj tswj hwm, raug xa rov qab los ntawm tus neeg sawv cev SSH, raug cuam tshuam, thiab lub Plaub Hlis 4, cov neeg tawm tsam tau nkag mus rau lwm cov servers hauv vaj tse.

Thaum lub sij hawm thib ob nres, lub vev xaib matrix.org tau xa mus rau lwm tus neeg rau zaub mov (matrixnotorg.github.io) los ntawm kev hloov pauv DNS chaw, siv tus yuam sij rau Cloudflare cov ntsiab lus xa khoom API cuam tshuam thaum thawj qhov kev tawm tsam. Thaum rov tsim kho cov ntsiab lus ntawm cov servers tom qab thawj hack, Matrix cov thawj coj hloov kho tsuas yog tus kheej cov yuam sij tshiab thiab tsis tau hloov kho tus yuam sij rau Cloudflare.

Thaum lub sijhawm tawm tsam thib ob, Matrix servers tseem tsis tau kov; kev hloov pauv tsuas yog hloov chaw nyob hauv DNS. Yog tias tus neeg siv twb tau hloov tus password tom qab thawj zaug tawm tsam, tsis tas yuav hloov nws zaum ob. Tab sis yog tias tus password tseem tsis tau hloov pauv, nws yuav tsum tau hloov kho sai li sai tau, txij li qhov xau ntawm cov ntaub ntawv nrog tus password hashes tau lees paub. Txoj kev npaj tam sim no yog pib qhov yuam kev rov pib dua tus password rau lwm zaus koj nkag mus.

Ntxiv rau qhov xau ntawm cov passwords, nws kuj tau lees paub tias GPG cov yuam sij siv los tsim cov ntawv kos npe digital rau pob khoom hauv Debian Synapse repository thiab Riot / Web tawm tau poob rau hauv tes ntawm cov neeg tawm tsam. Cov yuam sij tau tiv thaiv tus password. Cov yuam sij twb raug tshem tawm nyob rau lub sijhawm no. Cov yuam sij raug cuam tshuam rau lub Plaub Hlis 4, txij li thaum ntawd tsis muaj Synapse hloov tshiab tau raug tso tawm, tab sis Riot / Web tus thov kev pabcuam 1.0.7 raug tso tawm (kev kuaj ua ntej pom tias nws tsis raug cuam tshuam).

Tus neeg tawm tsam tau tshaj tawm cov lus ceeb toom ntawm GitHub nrog cov ntsiab lus ntawm kev tawm tsam thiab cov lus qhia kom nce kev tiv thaiv, tab sis lawv raug tshem tawm. Txawm li cas los xij, cov ntaub ntawv archived khaws cia.
Piv txwv li, tus neeg tawm tsam tau tshaj tawm tias Matrix developers yuav tsum siv ob-factor authentication los yog tsawg kawg tsis siv SSH tus neeg saib xyuas redirection ("ForwardAgent yog"), ces nkag mus rau hauv infrastructure yuav raug thaiv. Qhov kev nce siab ntawm kev tawm tsam kuj tuaj yeem raug tso tseg los ntawm kev muab cov neeg tsim tawm tsuas yog cov cai tsim nyog, tsis yog tag nrho hauv paus nkag ntawm tag nrho cov servers.

Tsis tas li ntawd, kev xyaum khaws cov yuam sij rau kev tsim cov ntawv kos npe digital ntawm cov servers ntau lawm tau raug thuam; ib tus tswv tsev cais yuav tsum tau faib rau cov hom phiaj zoo li no. Tseem tawm tsam qhia, yog tias Matrix cov neeg tsim khoom tau tshawb xyuas cov cav tsis tu ncua thiab txheeb xyuas qhov tsis sib xws, lawv yuav tau pom cov cim ntawm kev nyiag thaum ntxov (CI hack mus tsis tau tshawb pom rau ib hlis). Lwm qhov teeb meem yog khaws tag nrho cov ntaub ntawv teeb tsa hauv Git, uas ua rau nws tuaj yeem ntsuas qhov chaw ntawm lwm tus tswv yog tias ib tus ntawm lawv raug nyiag. Nkag mus los ntawm SSH rau infrastructure servers tsis yog txwv rau kev ruaj ntseg hauv network, uas ua rau nws muaj peev xwm txuas rau lawv los ntawm ib qho chaw nyob sab nraud.

Tau qhov twg los: opennet.ru

[:]