{"id":103789,"date":"2022-04-16T15:37:02","date_gmt":"2022-04-16T13:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm"},"modified":"2022-04-16T15:37:02","modified_gmt":"2022-04-16T13:37:02","slug":"ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","title":{"rendered":"Atacul asupra GitHub, care a dus la scurgerea de repozitorii private \u0219i acces la infrastructura NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub a avertizat utilizatorii cu privire la un atac destinat desc\u0103rc\u0103rii de date din repozitorii private, utiliz\u00e2nd token-uri OAuth compromise generate pentru serviciile Heroku \u0219i Travis-CI. Se raporteaz\u0103 c\u0103, \u00een timpul atacului, au avut loc scurgeri de date din repozitoriile private ale unor organiza\u021bii care au deschis accesul c\u0103tre repozitorii pentru platforma PaaS Heroku \u0219i sistemul de integrare continu\u0103 Travis-CI. Printre cei afecta\u021bi s-a num\u0103rat compania GitHub \u0219i proiectul NPM. <\/p>\n

Atacatorii au reu\u0219it s\u0103 extrag\u0103 din repozitoriile private GitHub o cheie de acces la API-ul Amazon Web Services, utilizat\u0103 \u00een infrastructura proiectului NPM. Cheia ob\u021binut\u0103 permitea accesul la pachetele NPM stocate \u00een serviciul AWS S3. GitHub consider\u0103 c\u0103, \u00een ciuda accesului ob\u021binut la repozitoriile NPM, nu s-a ajuns la modificarea pachetelor sau la ob\u021binerea de date legate de conturile utilizatorilor. De asemenea, se remarc\u0103 faptul c\u0103, av\u00e2nd \u00een vedere c\u0103 infrastructurile GitHub.com \u0219i NPM sunt separate, atacatorii nu au avut timp s\u0103 descarce con\u021binutul repozitariilor interne GitHub, care nu erau legate de NPM, \u00eenainte ca token-urile problematice s\u0103 fie blocate. <\/p>\n

Atacul a fost \u00eenregistrat pe 12 aprilie, dup\u0103 ce atacatorii au \u00eencercat s\u0103 foloseasc\u0103 cheia API AWS. Ulterior, au fost \u00eenregistrate atacuri similare \u0219i asupra altor organiza\u021bii, \u00een care au fost utilizate, de asemenea, token-uri ale aplica\u021biilor Heroku \u0219i Travis-CI. Organiza\u021biile afectate nu sunt numite, dar tuturor utilizatorilor afecta\u021bi de atac li s-au trimis notific\u0103ri individuale corespunz\u0103toare. Utilizatorilor aplica\u021biilor Heroku \u0219i Travis-CI li se recomand\u0103 s\u0103 studieze jurnalele de securitate \u0219i audit pentru a identifica anomalii \u0219i activit\u0103\u021bi neobi\u0219nuite. <\/p>\n

Modul \u00een care token-urile au ajuns \u00een m\u00e2inile atacatorilor nu este clar deocamdat\u0103, dar GitHub consider\u0103 c\u0103 acestea nu au fost ob\u021binute ca urmare a compromiterii infrastructurii companiei, deoarece token-urile pentru autorizarea accesului din sisteme externe nu sunt stocate pe partea GitHub \u00een formatul original, utilizabil. Analiza comportamentului atacatorului a ar\u0103tat c\u0103, probabil, scopul principal al desc\u0103rc\u0103rii con\u021binutului repozitariilor private este analiza prezen\u021bei unor date confiden\u021biale, cum ar fi cheile de acces care ar putea fi folosite pentru continuarea atacului asupra altor elemente ale infrastructurii.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 Heroku \u0438 Travis-CI. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u043e\u0442\u043a\u0440\u044b\u0432\u0448\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u0434\u043b\u044f PaaS-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Heroku \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis-CI. \u0412 \u0447\u0438\u0441\u043b\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103789","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atac asupra GitHub, care a dus la scurgerea repozitoriilor private \u0219i accesul la infrastructura NPM | ProHoster","description":"GitHub a avertizat utilizatorii cu privire la un atac destinat extragerii de date din repozitorii private, folosind tokenuri OAuth compromise, generate pentru serviciile Heroku \u0219i Travis-CI.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitHub, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0443 \u043a \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 NPM | ProHoster","og:description":"GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 Heroku \u0438 Travis-CI.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-16T13:37:02+00:00","article:modified_time":"2022-04-16T13:37:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103789","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:26:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-16 13:38:06","updated":"2026-01-25 10:26:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103789"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103789\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}