A nagy projektek t\u00e1rol\u00f3inak gyakori megszerz\u00e9s\u00e9vel \u00e9s a fejleszt\u0151k fi\u00f3kjainak kompromitt\u00e1l\u00e1s\u00e1val eljuttatott rosszindulat\u00fa k\u00f3dok miatt a GitHub \u00e1ltal\u00e1nos kiterjesztett hiteles\u00edt\u00e9st vezet be az fi\u00f3kok sz\u00e1m\u00e1ra. K\u00fcl\u00f6n a 500 legn\u00e9pszer\u0171bb NPM-csomag karbantart\u00f3i \u00e9s adminisztr\u00e1torai sz\u00e1m\u00e1ra a k\u00f6vetkez\u0151 \u00e9v elej\u00e9n k\u00f6telez\u0151 k\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9st vezetnek be. <\/p>\n
2021. december 7. \u00e9s 2022. janu\u00e1r 4. k\u00f6z\u00f6tt \u00e1tvinni fogj\u00e1k az \u00f6sszes karbantart\u00f3t, aki NPM-csomagok publik\u00e1l\u00e1s\u00e1ra jogosult, de nem haszn\u00e1l k\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9st, a kiterjesztett fi\u00f3khiteles\u00edt\u00e9s haszn\u00e1lat\u00e1ra. A kiterjesztett hiteles\u00edt\u00e9s megk\u00f6veteli egy egyszer haszn\u00e1latos k\u00f3d megad\u00e1s\u00e1t, amelyet e-mailben k\u00fcldenek el, amikor bel\u00e9pnek az npmjs.com webhelyre vagy hiteles\u00edt\u00e9ssel ell\u00e1tott m\u0171veletet v\u00e9geznek az npm eszk\u00f6zben. <\/p>\n
A kiterjesztett hiteles\u00edt\u00e9s nem v\u00e1ltja fel, hanem kieg\u00e9sz\u00edti a kor\u00e1bban el\u00e9rhet\u0151 opcion\u00e1lis k\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9st, amely egyszer haszn\u00e1latos jelszavak (TOTP) meger\u0151s\u00edt\u00e9s\u00e9t ig\u00e9nyli. K\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9s aktiv\u00e1l\u00e1sakor a kiterjesztett hiteles\u00edt\u00e9s e-mailben nem alkalmazand\u00f3. 2022. febru\u00e1r 1-j\u00e9n megkezd\u0151dik a 100 legn\u00e9pszer\u0171bb NPM-csomag karbantart\u00f3i sz\u00e1m\u00e1ra k\u00f6telez\u0151 k\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9sre val\u00f3 \u00e1t\u00e1ll\u00e1s, amelyeknek a legt\u00f6bb f\u00fcgg\u0151s\u00e9ge van. Az els\u0151 sz\u00e1z migr\u00e1l\u00e1sa ut\u00e1n a m\u00f3dos\u00edt\u00e1s r\u00e1fog terjedni az 500 legn\u00e9pszer\u0171bb NPM-csomagra f\u00fcgg\u0151s\u00e9gek sz\u00e1ma szerint. <\/p>\n
A jelenleg el\u00e9rhet\u0151 k\u00e9tt\u00e9nyez\u0151s hiteles\u00edt\u00e9si rendszeren fel\u00fcl, amely alkalmaz\u00e1sokon alapul\u00f3 egyszer haszn\u00e1latos jelszavakat gener\u00e1l (Authy, Google Authenticator, FreeOTP stb.), 2022 \u00e1prilis\u00e1ban tervezik a hardverkulcsok \u00e9s biometrikus olvas\u00f3k haszn\u00e1lat\u00e1t, amelyek t\u00e1mogatj\u00e1k a WebAuthn protokollt, valamint k\u00fcl\u00f6nb\u00f6z\u0151 kieg\u00e9sz\u00edt\u0151 hiteles\u00edt\u00e9si t\u00e9nyez\u0151k regisztr\u00e1ci\u00f3j\u00e1t \u00e9s kezel\u00e9s\u00e9t. <\/p>\n
Eml\u00e9keztet\u00fcnk, hogy a 2020-ban v\u00e9gzett kutat\u00e1s szerint mind\u00f6ssze 9,27% a csomagkarbantart\u00f3k k\u00f6z\u00fcl haszn\u00e1l k\u00e9tfaktoros hiteles\u00edt\u00e9st a hozz\u00e1f\u00e9r\u00e9s v\u00e9delm\u00e9re, m\u00edg az \u00faj fi\u00f3kok regisztr\u00e1l\u00e1sakor 13,37% eset\u00e9ben a fejleszt\u0151k megpr\u00f3b\u00e1lt\u00e1k \u00fajra felhaszn\u00e1lni a m\u00e1r megkompromitt\u00e1lt jelszavakat, amelyek a h\u00edres jelsz\u00f3leakokban szerepeltek. A haszn\u00e1lt jelszavak megb\u00edzhat\u00f3s\u00e1g\u00e1nak ellen\u0151rz\u00e9se sor\u00e1n 12% fi\u00f3kot siker\u00fclt megszerezni az NPM-en (13% csomag) az\u00e9rt, mert kisz\u00e1m\u00edthat\u00f3 \u00e9s trivi\u00e1lis jelszavakat haszn\u00e1ltak, mint p\u00e9ld\u00e1ul \u201e123456\u201d. Probl\u00e9m\u00e1snak bizonyult 4 felhaszn\u00e1l\u00f3i fi\u00f3k a legn\u00e9pszer\u0171bb 20 csomag k\u00f6z\u00fcl, 13 fi\u00f3k, amelyeket havonta t\u00f6bb mint 50 milli\u00f3 alkalommal t\u00f6lt\u00f6ttek le, 40 fi\u00f3k, amely t\u00f6bb mint 10 milli\u00f3 let\u00f6lt\u00e9st \u00e9rt el havonta, \u00e9s 282 fi\u00f3k, amely havonta t\u00f6bb mint 1 milli\u00f3 let\u00f6lt\u00e9st produk\u00e1lt. Figyelembe v\u00e9ve a modulok l\u00e1ncolatos let\u00f6lt\u00e9s\u00e9t, a megb\u00edzhatatlan fi\u00f3kok kompromitt\u00e1l\u00e1sa \u00f6sszesen ak\u00e1r az NPM \u00f6sszes modulj\u00e1nak 52%-\u00e1t is \u00e9rintheti. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439. \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 500 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 NPM-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0430 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f. \u0421 7 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u043f\u043e 4 \u044f\u043d\u0432\u0430\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102521","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A GitHub k\u00f6telez\u0151 kiterjesztett hiteles\u00edt\u00e9st vezet be az NPM fi\u00f3kjain\u00e1l | ProHoster","description":"A nagy projektek t\u00e1rol\u00f3inak megragad\u00e1s\u00e1nak \u00e9s a fejleszt\u0151k fi\u00f3kjainak kompromitt\u00e1l\u00e1s\u00e1n kereszt\u00fcl terjesztett rosszindulat\u00fa k\u00f3d el\u0151fordul\u00e1s\u00e1nak n\u00f6veked\u00e9se miatt a GitHub \u00e1ltal\u00e1nos kiterjesztett hiteles\u00edt\u00e9st vezet be.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432 NPM \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0443\u0447\u0430\u0441\u0442\u0438\u0432\u0448\u0438\u043c\u0438\u0441\u044f \u0441\u043b\u0443\u0447\u0430\u044f\u043c\u0438 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u0438 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0432\u0432\u043e\u0434\u0438\u0442 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u0443\u044e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u0443\u044e \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-08T13:36:53+00:00","article:modified_time":"2021-12-08T13:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102521","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-08 13:38:11","updated":"2022-09-27 14:40:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/102521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=102521"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/102521\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=102521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=102521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=102521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"