Hacking matrix.org infrastructure

[:ru]

Cov tsim tawm ntawm Matrix decentralized messaging platform tshaj tawm hais txog kev kaw thaum muaj xwm txheej ceev ntawm servers matrix.org и Riot.im (Matrix tus neeg siv khoom tseem ceeb) vim kev nyiag ntawm qhov project infrastructure. Thawj qhov hluav taws xob tau tshwm sim nag hmo, tom qab uas cov servers tsis muaj rov qab los, thiab cov ntawv thov raug tsim kho los ntawm cov ntaub ntawv siv. Tab sis ob peb feeb dhau los cov servers tau cuam ​​tshuam zaum ob.

Cov neeg tawm tsam tso tawm ntawm lub ntsiab nplooj ntawv qhov project cov ncauj lus kom ntxaws txog kev teeb tsa neeg rau zaub mov thiab cov ntaub ntawv ntawm lub xub ntiag ntawm lub database nrog hashes ntawm yuav luag tsib thiab ib nrab lab cov neeg siv Matrix. Raws li cov pov thawj, tus password hash ntawm tus thawj coj ntawm Matrix qhov project yog muaj rau pej xeem. Hloov chaw code tso tawm nyob rau hauv attackers 'GitHub repository (tsis nyob rau hauv lub official matrix repository). Paub meej txog qhov thib ob hack kom deb li deb ploj lawm.

Tom qab thawj hack los ntawm pab pawg Matrix, nws tau luam tawm qhia, uas qhia tau hais tias lub hack tau cog lus los ntawm qhov tsis zoo nyob rau hauv lub unupdated Jenkins nruam integration system. Tom qab nkag mus rau Jenkins servers, cov neeg tawm tsam tau cuam tshuam cov yuam sij SSH thiab tuaj yeem nkag mus rau lwm qhov chaw servers. Nws tau hais tias lub hauv paus code thiab pob khoom tsis cuam tshuam los ntawm kev tawm tsam. Qhov kev tawm tsam kuj tsis cuam tshuam rau Modular.im servers. Tab sis cov neeg tawm tsam tau txais kev nkag mus rau lub ntsiab DBMS, uas muaj, ntawm lwm yam, cov lus tsis tau encrypted, nkag mus rau tokens thiab password hashs.

Txhua tus neeg siv tau qhia kom hloov lawv tus password. Tab sis thaum lub sij hawm tus txheej txheem ntawm kev hloov passwords nyob rau hauv lub ntsiab Riot tus neeg siv, cov neeg siv ntsib nrog rau qhov poob ntawm cov ntaub ntawv nrog thaub qab cov ntawv luam ntawm cov yuam sij rau kev rov ua cov ntawv sau encrypted thiab tsis muaj peev xwm nkag mus rau keeb kwm ntawm cov lus yav dhau los.

Cia peb nco ntsoov koj tias lub platform rau kev teeb tsa kev sib txuas lus ncaj ncees Matrix tau nthuav tawm raws li qhov project uas siv cov qauv qhib thiab ua tib zoo saib xyuas kom muaj kev ruaj ntseg thiab kev ceev ntiag tug ntawm cov neeg siv. Matrix muab qhov kawg-rau-kawg encryption raws li nws tus kheej raws tu qauv, suav nrog Ob Chav Ratchet algorithm (tseem siv los ua ib feem ntawm Cov Txheej Txheem Teeb Meem), txhawb kev tshawb nrhiav thiab tsis txwv kev saib cov ntaub ntawv keeb kwm, tuaj yeem siv los hloov cov ntaub ntawv, xa ntawv ceeb toom, ntsuas. muaj tus tsim tawm hauv online, npaj kev sib tham hauv xov tooj, ua suab thiab video hu. Nws kuj txhawb cov yam ntxwv siab heev xws li ntaus ntawv ceeb toom, nyeem ntawv pom zoo, thawb cov ntawv ceeb toom thiab kev tshawb nrhiav neeg rau zaub mov, synchronization ntawm tus neeg siv khoom keeb kwm thiab xwm txheej, ntau yam kev xaiv tus cim (email, xov tooj, Facebook account, thiab lwm yam).

Ntxiv: Luam tawm rau txuas ntxiv nrog cov lus piav qhia ntawm qhov thib ob hack, cov ntaub ntawv hais txog kev xau ntawm PGP cov yuam sij, thiab cov ntsiab lus ntawm cov teeb meem kev nyab xeeb uas ua rau lub hack.

Tau qhov twg losopennet.ru

[: en]

Cov tsim tawm ntawm Matrix decentralized messaging platform tshaj tawm hais txog kev kaw thaum muaj xwm txheej ceev ntawm servers matrix.org и Riot.im (Matrix tus neeg siv khoom tseem ceeb) vim kev nyiag ntawm qhov project infrastructure. Thawj qhov hluav taws xob tau tshwm sim nag hmo, tom qab uas cov servers tsis muaj rov qab los, thiab cov ntawv thov raug tsim kho los ntawm cov ntaub ntawv siv. Tab sis ob peb feeb dhau los cov servers tau cuam ​​tshuam zaum ob.

Cov neeg tawm tsam tso tawm ntawm lub ntsiab nplooj ntawv qhov project cov ncauj lus kom ntxaws txog kev teeb tsa neeg rau zaub mov thiab cov ntaub ntawv ntawm lub xub ntiag ntawm lub database nrog hashes ntawm yuav luag tsib thiab ib nrab lab cov neeg siv Matrix. Raws li cov pov thawj, tus password hash ntawm tus thawj coj ntawm Matrix qhov project yog muaj rau pej xeem. Hloov chaw code tso tawm nyob rau hauv attackers 'GitHub repository (tsis nyob rau hauv lub official matrix repository). Paub meej txog qhov thib ob hack kom deb li deb ploj lawm.

Tom qab thawj hack los ntawm pab pawg Matrix, nws tau luam tawm qhia, uas qhia tau hais tias lub hack tau cog lus los ntawm qhov tsis zoo nyob rau hauv lub unupdated Jenkins nruam integration system. Tom qab nkag mus rau Jenkins servers, cov neeg tawm tsam tau cuam tshuam cov yuam sij SSH thiab tuaj yeem nkag mus rau lwm qhov chaw servers. Nws tau hais tias lub hauv paus code thiab pob khoom tsis cuam tshuam los ntawm kev tawm tsam. Qhov kev tawm tsam kuj tsis cuam tshuam rau Modular.im servers. Tab sis cov neeg tawm tsam tau txais kev nkag mus rau lub ntsiab DBMS, uas muaj, ntawm lwm yam, cov lus tsis tau encrypted, nkag mus rau tokens thiab password hashs.

Txhua tus neeg siv tau qhia kom hloov lawv tus password. Tab sis thaum lub sij hawm tus txheej txheem ntawm kev hloov passwords nyob rau hauv lub ntsiab Riot tus neeg siv, cov neeg siv ntsib nrog rau qhov poob ntawm cov ntaub ntawv nrog thaub qab cov ntawv luam ntawm cov yuam sij rau kev rov ua cov ntawv sau encrypted thiab tsis muaj peev xwm nkag mus rau keeb kwm ntawm cov lus yav dhau los.

Cia peb nco ntsoov koj tias lub platform rau kev teeb tsa kev sib txuas lus ncaj ncees Matrix tau nthuav tawm raws li qhov project uas siv cov qauv qhib thiab ua tib zoo saib xyuas kom muaj kev ruaj ntseg thiab kev ceev ntiag tug ntawm cov neeg siv. Matrix muab qhov kawg-rau-kawg encryption raws li nws tus kheej raws tu qauv, suav nrog Ob Chav Ratchet algorithm (tseem siv los ua ib feem ntawm Cov Txheej Txheem Teeb Meem), txhawb kev tshawb nrhiav thiab tsis txwv kev saib cov ntaub ntawv keeb kwm, tuaj yeem siv los hloov cov ntaub ntawv, xa ntawv ceeb toom, ntsuas. muaj tus tsim tawm hauv online, npaj kev sib tham hauv xov tooj, ua suab thiab video hu. Nws kuj txhawb cov yam ntxwv siab heev xws li ntaus ntawv ceeb toom, nyeem ntawv pom zoo, thawb cov ntawv ceeb toom thiab kev tshawb nrhiav neeg rau zaub mov, synchronization ntawm tus neeg siv khoom keeb kwm thiab xwm txheej, ntau yam kev xaiv tus cim (email, xov tooj, Facebook account, thiab lwm yam).

Ntxiv: Luam tawm rau txuas ntxiv nrog cov lus piav qhia ntawm qhov thib ob hack, cov ntaub ntawv hais txog kev xau ntawm PGP cov yuam sij, thiab cov ntsiab lus ntawm cov teeb meem kev nyab xeeb uas ua rau lub hack.

Tau qhov twg los: opennet.ru

[:]