{"id":80245,"date":"2020-05-04T19:42:04","date_gmt":"2020-05-04T17:42:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack"},"modified":"2020-05-04T19:42:04","modified_gmt":"2020-05-04T17:42:04","slug":"vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","title":{"rendered":"Securitatea infrastructurii LineageOS compromis\u0103 printr-o vulnerabilitate \u00een SaltStack","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Dezvoltatorii platformei mobile <noindex><a rel=\"nofollow\" href=\"https:\/\/lineageos.org\/\">LineageOS<\/a><\/noindex>, care a \u00eenlocuit CyanogenMod, <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/LineageAndroid\/status\/1256821056100163584\">au avertizat<\/a><\/noindex> despre identificarea unor urme de infiltrare \u00een infrastructura proiectului. Se remarc\u0103 faptul c\u0103, la 6 diminea\u021ba (MSK) pe 3 mai, atacatorului i-a reu\u0219it s\u0103 ob\u021bin\u0103 acces la serverul principal al sistemului de gestionare centralizat\u0103 a configura\u021biei <noindex><a rel=\"nofollow\" href=\"https:\/\/www.saltstack.com\/\">SaltStack<\/a><\/noindex> prin exploatarea unei vulnerabilit\u0103\u021bi necorectate. \u00cen prezent, se desf\u0103\u0219oar\u0103 o analiz\u0103 a incidentului \u0219i detaliile nu sunt \u00eenc\u0103 disponibile. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/status.lineageos.org\/issues\/5eae596b4a0ebd114676545f\">Se raporteaz\u0103<\/a><\/noindex> recently, the attack did not affect the keys for generating digital signatures, the build system, or the platform's source code \u2014 keys <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/zifnab06\/status\/1256870980523196417\">erau stocate<\/a><\/noindex>  pe g\u0103zduiri complet separate de infrastructura principal\u0103, gestionat\u0103 prin SaltStack, iar construc\u021biile au fost suspendate din motive tehnice pe 30 aprilie. Judec\u00e2nd dup\u0103 datele de pe pagina <noindex><a rel=\"nofollow\" href=\"https:\/\/status.lineageos.org\/\">status.lineageos.org<\/a><\/noindex> dezvoltatorii au restabilit deja serverul cu sistemul de revizuire a codului Gerrit, site-ul \u0219i wiki-ul. Serverul cu construc\u021bii (builds.lineageos.org), portalul pentru desc\u0103rcarea fi\u0219ierelor (download.lineageos.org), serverele de mail \u0219i sistemul de coordonare a redirec\u021bion\u0103rii c\u0103tre oglinzi r\u0103m\u00e2n dezactivate. <\/p>\n<p>Atacul a fost posibil deoarece portul de re\u021bea (4506) pentru acces la SaltStack <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/zifnab06\/status\/1256870980523196417\">nu a fost<\/a><\/noindex> blocked for external requests by the firewall \u2014 the attacker had to wait for a critical vulnerability in SaltStack to appear and exploit it before administrators could install the patch. All SaltStack users are advised to urgently update their systems and check for signs of compromise.<\/p>\n<p>Apparently, the attacks via SaltStack were not limited to the hacking of LineageOS and became widespread \u2014 throughout the day, various users who had not updated SaltStack, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/saltstack\/salt\/issues\/57057\">pun accent pe<\/a><\/noindex> au identificat compromiterea infrastructurii lor cu implantarea de cod pentru minerit sau backdoor-uri pe servere. Inclusiv <noindex><a rel=\"nofollow\" href=\"https:\/\/status.ghost.org\/incidents\/tpn078sqk973\">se raporteaz\u0103<\/a><\/noindex> un hack similar al infrastructurii sistemului de gestionare a con\u021binutului <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TryGhost\/Ghost\">Ghost<\/a><\/noindex>, care a afectat site-urile Ghost(Pro) \u0219i facturarea (se afirm\u0103 c\u0103 numerele de carduri de credit nu au fost afectate, dar hashi-urile parolelor utilizatorilor Ghost ar fi putut c\u0103dea \u00een m\u00e2inile atacatorilor).<\/p>\n<p>Pe 29 aprilie au fost <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/saltstack\/salt\/releases\">lansate<\/a><\/noindex> actualiz\u0103ri pentru platforma SaltStack <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.saltstack.com\/en\/latest\/topics\/releases\/3000.2.html\">3000.2<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.saltstack.com\/en\/2019.2\/topics\/releases\/2019.2.4.html\">2019.2.4<\/a><\/noindex>, \u00een care au fost corectate <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/saltstack\/salt\/blob\/v3000.2_docs\/doc\/topics\/releases\/3000.2.rs\">dou\u0103 vulnerabilit\u0103\u021bi<\/a><\/noindex> (informa\u021biile despre vulnerabilit\u0103\u021bi au fost publicate pe 30 aprilie), care au primit cel mai \u00eenalt nivel de pericol, deoarece permit <noindex><a rel=\"nofollow\" href=\"https:\/\/labs.f-secure.com\/advisories\/saltstack-authorization-bypass\">accesul f\u0103r\u0103 autentificare<\/a><\/noindex> executarea codului de la distan\u021b\u0103 at\u00e2t pe gazda de control (salt-master), c\u00e2t \u0219i pe toate serverele gestionate prin aceasta.<\/p>\n<ul>\n<li class=\"l\"> Prima vulnerabilitate (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2020-11651\">CVE-2020-11651<\/a><\/noindex>) este cauzat\u0103 de lipsa verific\u0103rilor adecvate la apelarea metodelor din clasa ClearFuncs pe parcursul procesului salt-master. Vulnerabilitatea permite unui utilizator de la distan\u021b\u0103 accesul la anumite metode f\u0103r\u0103 autentificare. Printre altele, prin metodele vulnerabile, atacatorul poate ob\u021bine un token pentru acces cu privilegii de root la serverul master \u0219i poate executa comenzi pe gazdele gestionate, pe care ruleaz\u0103 demonul <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.saltstack.com\/en\/latest\/ref\/cli\/salt-minion.html\">salt-minion<\/a><\/noindex>. Patch-ul pentru remedierea acestei vulnerabilit\u0103\u021bi a fost <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/saltstack\/salt\/commit\/a67d76b15615983d467ed81371b38b4a17e4f3b7\">publicat<\/a><\/noindex> acum 20 de zile, dar dup\u0103 aplicarea acestuia, au ap\u0103rut <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/saltstack\/salt\/issues\/57016\">regresii<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/saltstack\/salt\/issues\/57027\">modific\u0103ri<\/a><\/noindex>, care duce la erori \u0219i la sincronizarea defectuoas\u0103 a fi\u0219ierelor.\n<li class=\"l\"> A doua vulnerabilitate (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2020-11652\">CVE-2020-11652<\/a><\/noindex>) permite, prin manipularea clasei ClearFuncs, accesul la metode prin transmiterea unor c\u0103i formate \u00eentr-un anumit mod, ceea ce poate fi folosit pentru acces complet la directoare arbitrare \u00een FS-ul serverului master cu privilegii de root, dar necesit\u0103 acces autentificat (acest acces poate fi ob\u021binut prin prima vulnerabilitate \u0219i folosit pentru compromiterea complet\u0103 a \u00eentregii infrastructuri).\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52872\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b LineageOS, \u043f\u0440\u0438\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 CyanogenMod, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0432 6 \u0447\u0430\u0441\u043e\u0432 \u0443\u0442\u0440\u0430 (MSK) 3 \u043c\u0430\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 SaltStack \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0438\u0434\u0451\u0442 \u0440\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-80245","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b LineageOS, \u043f\u0440\u0438\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 CyanogenMod,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b LineageOS \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SaltStack | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b LineageOS, \u043f\u0440\u0438\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 CyanogenMod,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-04T17:42:04+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-04T17:42:04+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Securitatea infrastructurii LineageOS compromis\u0103 printr-o vulnerabilitate \u00een SaltStack | ProHoster","description":"Dezvoltatorii platformei mobile LineageOS, succesorul CyanogenMod,","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b LineageOS \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SaltStack | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b LineageOS, \u043f\u0440\u0438\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 CyanogenMod,","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-04T17:42:04+00:00","article:modified_time":"2020-05-04T17:42:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"80245","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:21:23","updated":"2022-09-28 08:26:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/80245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=80245"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/80245\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=80245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=80245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=80245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}