Firma Cloudflare, dostarczaj\u0105ca sie\u0107 dostarczania tre\u015bci, obs\u0142uguj\u0105ca oko\u0142o 20% ruchu w Internecie, opublikowa\u0142a raport na temat w\u0142amania do jednego z serwer\u00f3w w swojej infrastrukturze, na kt\u00f3rym dzia\u0142a\u0142a wewn\u0119trzna strona wiki oparta na platformie Atlassian Confluence, system \u015bledzenia b\u0142\u0119d\u00f3w Atlassian Jira oraz system zarz\u0105dzania kodem Bitbucket. Analiza wykaza\u0142a, \u017ce atakuj\u0105cy uzyska\u0142 dost\u0119p do serwera, wykorzystuj\u0105c tokeny uzyskane w wyniku pa\u017adziernikowego w\u0142amania do firmy Okta, kt\u00f3re doprowadzi\u0142o do wycieku token\u00f3w dost\u0119pu. <\/p>\n
Po ujawnieniu jesieni\u0105 informacji o w\u0142amaniu do Okta, firma Cloudflare zainicjowa\u0142a proces aktualizacji u\u017cywanych przez us\u0142ugi Okta danych logowania, kluczy i token\u00f3w, ale, jak si\u0119 okaza\u0142o, jeden token i trzy konta (z kilku tysi\u0119cy), skompromitowane w wyniku w\u0142amania do Okta, nie zosta\u0142y wymienione i kontynuowa\u0142y dzia\u0142anie, co wykorzysta\u0142 atakuj\u0105cy. Podane dane logowania uznawano za nieu\u017cywane, ale w rzeczywisto\u015bci pozwala\u0142y na dost\u0119p do platformy Atlassian, systemu zarz\u0105dzania kodem Bitbucket, aplikacji SaaS, maj\u0105cej administracyjny dost\u0119p do \u015brodowiska Atlassian Jira oraz \u015brodowiska w AWS, s\u0142u\u017c\u0105cego do zarz\u0105dzania katalogiem aplikacji Cloudflare, ale nie mia\u0142o dost\u0119pu do infrastruktury CDN i nie przechowywa\u0142o poufnych danych. <\/p>\n
Incydent nie dotkn\u0105\u0142 danych i system\u00f3w u\u017cytkownik\u00f3w Cloudflare. Przeprowadzony audyt wykaza\u0142, \u017ce atak ograniczy\u0142 si\u0119 do system\u00f3w z produktami Atlassian i nie rozprzestrzeni\u0142 si\u0119 na inne serwery<\/a>, dzi\u0119ki zastosowaniu w Cloudflare modelu z zerowym zaufaniem (Zero Trust) oraz izolacji cz\u0119\u015bci infrastruktury. <\/p>\n W\u0142amanie do serwera Cloudflare zosta\u0142o zauwa\u017cone 23 listopada, a pierwsze \u015blady nieautoryzowanego dost\u0119pu do wiki i systemu \u015bledzenia b\u0142\u0119d\u00f3w zosta\u0142y zarejestrowane 14 listopada. 22 listopada atakuj\u0105cy zainstalowali tylne drzwi do uzyskania sta\u0142ego dost\u0119pu, utworzone za pomoc\u0105 ScriptRunner dla Jira. Tego samego dnia atakuj\u0105cy uzyskali dost\u0119p do systemu zarz\u0105dzania kodami \u017ar\u00f3d\u0142owymi, w kt\u00f3rym wykorzystywana by\u0142a platforma Atlassian Bitbucket. Po tym podj\u0119to pr\u00f3by po\u0142\u0105czenia si\u0119 z konsol\u0105 serwera<\/a>, u\u017cywan\u0105 do uzyskania dost\u0119pu do jeszcze nieuruchomionego centrum danych w Brazylii, ale wszystkie pr\u00f3by po\u0142\u0105czenia okaza\u0142y si\u0119 nieudane. <\/p>\n Najwyra\u017aniej aktywno\u015b\u0107 atakuj\u0105cego ogranicza\u0142a si\u0119 do badania architektury sieci dostarczania tre\u015bci oraz poszukiwania s\u0142abych punkt\u00f3w. W trakcie swojej dzia\u0142alno\u015bci napastnik korzysta\u0142 z wyszukiwania w wiki po s\u0142owach kluczowych zwi\u0105zanych z zdalnym dost\u0119pem, sekretami, openconnect, cloudflared i tokenami. Zarejestrowano otwarcie przez przest\u0119pc\u0119 202 stron wiki (z 194100) oraz 36 raport\u00f3w o problemach (z 2059357), zwi\u0105zanych z zarz\u0105dzaniem usuwaniem luk w zabezpieczeniach i rotacj\u0105 kluczy. Zidentyfikowano tak\u017ce pobranie 120 repozytori\u00f3w z kodem (z 11904), z kt\u00f3rych wi\u0119kszo\u015b\u0107 dotyczy\u0142a tworzenia kopii zapasowych, konfiguracji i zarz\u0105dzania CDN, systemami identyfikacji, zdalnym dost\u0119pem i wykorzystaniem platform Terraform i Kubernetes. W niekt\u00f3rych z repozytori\u00f3w znalaz\u0142y si\u0119 pozostawione w kodzie zaszyfrowane klucze, kt\u00f3re zosta\u0142y wymienione zaraz po incydencie, mimo zastosowania solidnych metod szyfrowania. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 wiki-\u0441\u0430\u0439\u0442 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Atlassian Confluence, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a Atlassian Jira \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u043e\u043c Bitbucket. \u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113361","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firma Cloudflare ujawnia szczeg\u00f3\u0142y dot. w\u0142amania do jednego ze swoich serwer\u00f3w | ProHoster","description":"Firma Cloudflare, \u015bwiadcz\u0105ca us\u0142ugi sieci dostarczania tre\u015bci, obs\u0142uguj\u0105ca oko\u0142o 20% ruchu internetowego, opublikowa\u0142a raport o w\u0142amaniu do jednego z serwer\u00f3w swojej infrastruktury, na kt\u00f3rym dzia\u0142a\u0142a wewn\u0119trzna.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T11:41:16+00:00","article:modified_time":"2024-02-02T11:41:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113361","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=113361"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113361\/revisions"}],"predecessor-version":[{"id":160155,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113361\/revisions\/160155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=113361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=113361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=113361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"