{"id":31452,"date":"2019-10-31T21:41:20","date_gmt":"2019-10-31T18:41:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta\/"},"modified":"2019-10-31T21:41:20","modified_gmt":"2019-10-31T18:41:20","slug":"podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","title":{"rendered":"Dettagli sul secondo attacco a Matrix. Le chiavi GPG del progetto sono state compromesse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sono emersi nuovi dettagli sull'attacco all'infrastruttura della piattaforma di messaggistica decentralizzata Matrix, di cui si \u00e8 parlato questa mattina. Il punto vulnerabile attraverso cui sono penetrati gli aggressori \u00e8 stato il sistema di integrazione continua Jenkins, che \u00e8 stato violato gi\u00e0 il 13 marzo. Successivamente, sul server Jenkins \u00e8 stato intercettato l'accesso SSH ridirezionato di uno degli amministratori e il 4 aprile gli aggressori hanno ottenuto l'accesso a altri server dell'infrastruttura.<\/p>\n

Durante il secondo attacco, il sito matrix.org \u00e8 stato reindirizzato a un altro server (matrixnotorg.github.io) attraverso la modifica dei parametri DNS, utilizzando la chiave API del sistema di distribuzione dei contenuti Cloudflare, intercettata durante il primo attacco. Durante la ricostruzione del contenuto server<\/a> dopo il primo attacco, gli amministratori di Matrix hanno aggiornato solo le nuove chiavi personali e hanno trascurato l'aggiornamento della chiave per Cloudflare. <\/p>\n

Durante il secondo attacco, i server Matrix sono rimasti intatti e le modifiche si sono limitate a sostituire gli indirizzi DNS. Se un utente ha gi\u00e0 cambiato la password dopo il primo attacco, non \u00e8 necessario cambiarla di nuovo. Tuttavia, se la password non \u00e8 ancora stata aggiornata, \u00e8 fondamentale farlo il prima possibile, poich\u00e9 la fuga del database contenente gli hash delle password \u00e8 stata confermata. Attualmente si prevede di avviare il processo di reset forzato della password al prossimo accesso.<\/p>\n

Oltre alla fuga delle password, \u00e8 stata anche confermata la compromissione delle chiavi GPG utilizzate per generare le firme digitali dei pacchetti nel repository Debian di Synapse e nei rilascio di Riot\/Web. Le chiavi erano protette da password. Attualmente le chiavi sono gi\u00e0 state revocate. Le chiavi sono state intercettate il 4 aprile, ma da allora non sono stati rilasciati aggiornamenti per Synapse, anche se \u00e8 stata rilasciata la versione 1.0.7 del client Riot\/Web (le verifiche preliminari hanno mostrato che non \u00e8 stata compromessa). <\/p>\n

L'attaccante ha pubblicato una serie di rapporti con i dettagli dell'attacco su GitHub, ma sono stati rimossi. Tuttavia, i rapporti sono stati conservati in archivio.
\n
Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0432\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Matrix, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e\u0441\u044c \u0443\u0442\u0440\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u043c \u0437\u0432\u0435\u043d\u043e\u043c, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u043e\u043d\u0438\u043a\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0431\u044b\u043b\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Jenkins, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u0430 \u0435\u0449\u0451 13 \u043c\u0430\u0440\u0442\u0430. \u0417\u0430\u0442\u0435\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 c Jenkins \u0431\u044b\u043b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 SSH-\u0430\u0433\u0435\u043d\u0442\u043e\u043c \u0432\u0445\u043e\u0434 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 4 \u0430\u043f\u0440\u0435\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31452","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dettagli sul secondo attacco a Matrix. Le chiavi GPG del progetto sono state compromesse | ProHoster","description":"Sono emerse nuove informazioni sull'attacco all'infrastruttura della piattaforma decentralizzata di messaggistica Matrix, di cui si \u00e8 parlato questa mattina. Il punto vulnerabile attraverso cui gli aggressori sono riusciti a infiltrarsi era il sistema di integrazione continua Jenkins, che \u00e8 stato compromesso gi\u00e0 il 13 marzo. Successivamente, su un server con Jenkins \u00e8 stato intercettato l'accesso SSH di un amministratore, e il 4 aprile gli attaccanti hanno ottenuto accesso ad altri server dell'infrastruttura.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u0437\u043b\u043e\u043c Matrix. \u0421\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b GPG-\u043a\u043b\u044e\u0447\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0432\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Matrix, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e\u0441\u044c \u0443\u0442\u0440\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u043c \u0437\u0432\u0435\u043d\u043e\u043c, \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u043e\u043d\u0438\u043a\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0431\u044b\u043b\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Jenkins, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u0430 \u0435\u0449\u0451 13 \u043c\u0430\u0440\u0442\u0430. \u0417\u0430\u0442\u0435\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 c Jenkins \u0431\u044b\u043b \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0447\u0435\u043d \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 SSH-\u0430\u0433\u0435\u043d\u0442\u043e\u043c \u0432\u0445\u043e\u0434 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 4 \u0430\u043f\u0440\u0435\u043b\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/podrobnosti-pro-vtoroj-vzlom-matrix-skomprometirovany-gpg-klyuchi-proekta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:20+00:00","article:modified_time":"2019-10-31T18:41:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 16:59:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:16:23","updated":"2026-02-09 16:59:47"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/31452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=31452"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/31452\/revisions"}],"predecessor-version":[{"id":158549,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/31452\/revisions\/158549"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=31452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=31452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=31452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}