{"id":103789,"date":"2022-04-16T15:37:02","date_gmt":"2022-04-16T13:37:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm"},"modified":"2022-04-16T15:37:02","modified_gmt":"2022-04-16T13:37:02","slug":"ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","title":{"rendered":"\u00datok na GitHub, ktor\u00fd viedol k \u00faniku s\u00fakromn\u00fdch repozit\u00e1rov a pr\u00edstupu k infra\u0161trukt\u00fare NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub upozornil pou\u017e\u00edvate\u013eov na \u00fatok zameran\u00fd na s\u0165ahovanie \u00fadajov z priv\u00e1tnych repozit\u00e1rov pomocou kompromitovan\u00fdch OAuth tokenov, generovan\u00fdch pre slu\u017eby Heroku a Travis-CI. Spr\u00e1vy hl\u00e1sia, \u017ee po\u010das \u00fatoku do\u0161lo k \u00faniku \u00fadajov z priv\u00e1tnych repozit\u00e1rov niektor\u00fdch organiz\u00e1ci\u00ed, ktor\u00e9 spr\u00edstupnili svoje repozit\u00e1re pre PaaS platformu Heroku a syst\u00e9m kontinu\u00e1lnej integr\u00e1cie Travis-CI. Medzi po\u0161koden\u00fdmi je spolo\u010dnos\u0165 GitHub a projekt NPM. <\/p>\n

\u00dato\u010dn\u00edci dok\u00e1zali z\u00edska\u0165 z priv\u00e1tnych repozit\u00e1rov GitHub k\u013e\u00fa\u010d na pr\u00edstup k API Amazon Web Services, pou\u017e\u00edvan\u00fd v infra\u0161trukt\u00fare projektu NPM. Z\u00edskan\u00fd k\u013e\u00fa\u010d umo\u017e\u0148oval pr\u00edstup k NPM bal\u00ed\u010dkom ulo\u017een\u00fdm v slu\u017ebe AWS S3. GitHub pova\u017euje za nepravdepodobn\u00e9, \u017ee by napriek z\u00edskan\u00e9mu pr\u00edstupu k repozit\u00e1rom NPM do\u0161lo k modifik\u00e1cii bal\u00ed\u010dkov alebo z\u00edskaniu \u00fadajov s\u00favisiacich s kontami pou\u017e\u00edvate\u013eov. Uv\u00e1dza sa tie\u017e, \u017ee infra\u0161trukt\u00fary GitHub.com a NPM s\u00fa oddelen\u00e9, tak\u017ee \u00fato\u010dn\u00edci nemali \u010das na stiahnutie obsahu intern\u00fdch repozit\u00e1rov GitHub, ktor\u00e9 nie s\u00fa spojen\u00e9 s NPM, pred t\u00fdm, ne\u017e boli problematick\u00e9 tokeny zablokovan\u00e9. <\/p>\n

\u00datok bol zaznamenan\u00fd 12. apr\u00edla, po tom, \u010do sa \u00fato\u010dn\u00edci pok\u00fasili vyradi\u0165 k\u013e\u00fa\u010d k API AWS. Nesk\u00f4r boli zaznamenan\u00e9 podobn\u00e9 \u00fatoky aj na in\u00e9 organiz\u00e1cie, v ktor\u00fdch boli taktie\u017e pou\u017eit\u00e9 tokeny aplik\u00e1ci\u00ed Heroku a Travis-CI. Zasiahnut\u00e9 organiz\u00e1cie nie s\u00fa menovan\u00e9, no v\u0161etk\u00fdm pou\u017e\u00edvate\u013eom, ktor\u00fdch sa \u00fatok dotkol, boli zaslan\u00e9 osobn\u00e9 upozornenia. Pou\u017e\u00edvate\u013eom aplik\u00e1ci\u00ed Heroku a Travis-CI odpor\u00fa\u010dame prehliadnu\u0165 si bezpe\u010dnostn\u00e9 a aud\u00edtorsk\u00e9 z\u00e1znamy na identifik\u00e1ciu anom\u00e1li\u00ed a netypickej aktivity. <\/p>\n

Ako sa tokeny dostali do r\u00fak \u00fato\u010dn\u00edkov zatia\u013e nie je jasn\u00e9, no GitHub pova\u017euje za nepravdepodobn\u00e9, \u017ee by boli z\u00edskan\u00e9 v d\u00f4sledku kompromit\u00e1cie infra\u0161trukt\u00fary spolo\u010dnosti, preto\u017ee tokeny na autoriz\u00e1ciu pr\u00edstupu z extern\u00fdch syst\u00e9mov nie s\u00fa ulo\u017een\u00e9 na strane GitHub v p\u00f4vodnom form\u00e1te, vhodnom na pou\u017eitie. Anal\u00fdza spr\u00e1vania \u00fato\u010dn\u00edka nazna\u010duje, \u017ee hlavn\u00fd cie\u013e s\u0165ahovania obsahu priv\u00e1tnych repozit\u00e1rov je anal\u00fdza pr\u00edtomnosti d\u00f4vern\u00fdch \u00fadajov, ako s\u00fa pr\u00edstupov\u00e9 k\u013e\u00fa\u010de, ktor\u00e9 by mohli by\u0165 pou\u017eit\u00e9 na pokra\u010dovanie \u00fatoku na in\u00e9 prvky infra\u0161trukt\u00fary.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 Heroku \u0438 Travis-CI. \u0421\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u0430 \u0443\u0442\u0435\u0447\u043a\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u043e\u0442\u043a\u0440\u044b\u0432\u0448\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u0434\u043b\u044f PaaS-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Heroku \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis-CI. \u0412 \u0447\u0438\u0441\u043b\u0435 \u043f\u043e\u0441\u0442\u0440\u0430\u0434\u0430\u0432\u0448\u0438\u0445 \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103789","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na GitHub, ktor\u00fd viedol k \u00faniku priv\u00e1tnych repozit\u00e1rov a pr\u00edstupu k infra\u0161trukt\u00fare NPM | ProHoster","description":"GitHub varoval pou\u017e\u00edvate\u013eov pred \u00fatokom zameran\u00fdm na s\u0165ahovanie \u00fadajov z priv\u00e1tnych repozit\u00e1rov pomocou skompromitovan\u00fdch OAuth tokenov generovan\u00fdch pre slu\u017eby Heroku a Travis-CI.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitHub, \u043f\u0440\u0438\u0432\u0435\u0434\u0448\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0443 \u043a \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 NPM | ProHoster","og:description":"GitHub \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 Heroku \u0438 Travis-CI.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-na-github-privedshaya-k-utechke-privatnyh-repozitoriev-i-dostupu-k-infrastrukture-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-16T13:37:02+00:00","article:modified_time":"2022-04-16T13:37:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103789","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:26:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-16 13:38:06","updated":"2026-01-25 10:26:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=103789"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/103789\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=103789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=103789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=103789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}