{"id":107040,"date":"2023-03-02T12:48:19","date_gmt":"2023-03-02T10:48:19","guid":{"rendered":"https:\/\/prohoster.info\/?p=107040"},"modified":"2023-03-03T15:16:29","modified_gmt":"2023-03-03T13:16:29","slug":"github-realizoval-proverku-utechki-konfidenczialnyh-dannyh-v-repozitoriyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/github-realizoval-proverku-utechki-konfidenczialnyh-dannyh-v-repozitoriyah","title":{"rendered":"A GitHub bevezette a bizalmas adatok sziv\u00e1rg\u00e1s\u00e1nak ellen\u0151rz\u00e9s\u00e9t a t\u00e1rol\u00f3kban.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A GitHub bejelentette, hogy elind\u00edtotta ingyenes szolg\u00e1ltat\u00e1s\u00e1t, amely lehet\u0151v\u00e9 teszi a felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra, hogy nyomon k\u00f6vethess\u00e9k a nyilv\u00e1nos adatt\u00e1rol\u00f3kban v\u00e9letlen\u00fcl k\u00f6zz\u00e9tett \u00e9rz\u00e9keny adatokat, mint p\u00e9ld\u00e1ul titkos\u00edt\u00e1si kulcsokat, adatb\u00e1zis jelszavakat \u00e9s API-hozz\u00e1f\u00e9r\u00e9si tokeneket. Kor\u00e1bban ez a szolg\u00e1ltat\u00e1s csak a b\u00e9ta tesztprogram r\u00e9sztvev\u0151i sz\u00e1m\u00e1ra volt el\u00e9rhet\u0151, most azonban korl\u00e1toz\u00e1sok n\u00e9lk\u00fcl minden nyilv\u00e1nos adatt\u00e1rol\u00f3 sz\u00e1m\u00e1ra el\u00e9rhet\u0151v\u00e9 v\u00e1lt. A saj\u00e1t adatt\u00e1rol\u00f3 ellen\u0151rz\u00e9s\u00e9hez aktiv\u00e1lni kell a «Code security and analysis» szakaszban a «Secret scanning» opci\u00f3t. <\/p>\n

\u00d6sszesen t\u00f6bb mint 200 sablon ker\u00fclt megval\u00f3s\u00edt\u00e1sra a k\u00fcl\u00f6nf\u00e9le kulcsok, tokenek, tan\u00fas\u00edtv\u00e1nyok \u00e9s hiteles\u00edt\u0151 adatok azonos\u00edt\u00e1s\u00e1ra. Az adatlop\u00e1sok keres\u00e9se nemcsak a k\u00f3dban, hanem a probl\u00e9m\u00e1k, le\u00edr\u00e1sok \u00e9s hozz\u00e1sz\u00f3l\u00e1sok k\u00f6z\u00f6tt is t\u00f6rt\u00e9nik. A hamis riaszt\u00e1sok elker\u00fcl\u00e9se \u00e9rdek\u00e9ben csak a garant\u00e1ltan azonos\u00edthat\u00f3 token t\u00edpusokat ellen\u0151rzik, amelyek t\u00f6bb mint 100 k\u00fcl\u00f6nb\u00f6z\u0151 szolg\u00e1ltat\u00e1st \u00f6lelnek fel, bele\u00e9rtve az Amazon Web Services, Azure, Crates.io, DigitalOcean, Google Cloud, NPM, PyPI, RubyGems \u00e9s Yandex.Cloud. Emellett t\u00e1mogatja az \u00f6nal\u00e1\u00edrt tan\u00fas\u00edtv\u00e1nyok \u00e9s kulcsok \u00e9szlel\u00e9sekor k\u00fcld\u00f6tt figyelmeztet\u00e9sek k\u00fcld\u00e9s\u00e9t is. <\/p>\n

Janu\u00e1rban k\u00eds\u00e9rleti jelleggel 14 ezer t\u00e1rol\u00f3t elemeztek, amelyek a GitHub Actions-t haszn\u00e1lj\u00e1k. Ennek eredm\u00e9nyek\u00e9ppen 1110 t\u00e1rol\u00f3ban (7.9%, azaz szinte minden tizenkettedik) titkos adatok jelenl\u00e9t\u00e9t \u00e1llap\u00edtott\u00e1k meg. P\u00e9ld\u00e1ul a t\u00e1rol\u00f3kban 692 GitHub App token, 155 Azure Storage kulcs, 155 GitHub Personal token, 120 Amazon AWS kulcs \u00e9s 50 Google API kulcs lett felfedezve.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0432 \u0441\u0442\u0440\u043e\u0439 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u043f\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0421\u0423\u0411\u0414 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u0420\u0430\u043d\u0435\u0435 \u0434\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0431\u044b\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0431\u0435\u0442\u0430-\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0430 \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0430\u0447\u0430\u043b \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u0432\u0441\u0435\u043c \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c. \u0414\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0432\u043e\u0435\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A GitHub megval\u00f3s\u00edtotta a bizalmas adatok kisziv\u00e1rg\u00e1s\u00e1nak ellen\u0151rz\u00e9s\u00e9t a t\u00e1rol\u00f3kban | ProHoster","description":"A GitHub bejelentette, hogy elind\u00edtja ingyenes szolg\u00e1ltat\u00e1s\u00e1t, amely a bizalmas adatok, p\u00e9ld\u00e1ul titkos\u00edt\u00e1si kulcsok, adatb\u00e1zis-jelszavak \u00e9s API-hozz\u00e1f\u00e9r\u00e9si tokenek v\u00e9letlenszer\u0171 k\u00f6zz\u00e9t\u00e9tel\u00e9nek nyomon k\u00f6vet\u00e9s\u00e9re szolg\u00e1l.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/github-realizoval-proverku-utechki-konfidenczialnyh-dannyh-v-repozitoriyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47GitHub \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0443\u0442\u0435\u0447\u043a\u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 | ProHoster","og:description":"GitHub \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0432 \u0441\u0442\u0440\u043e\u0439 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u043f\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u043a\u043b\u044e\u0447\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u0430\u0440\u043e\u043b\u0438 \u043a \u0421\u0423\u0411\u0414 \u0438 \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/github-realizoval-proverku-utechki-konfidenczialnyh-dannyh-v-repozitoriyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-02T10:48:19+00:00","article:modified_time":"2023-03-03T13:16:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/107040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=107040"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/107040\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=107040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=107040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=107040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}