{"id":183679,"date":"2026-10-07T22:54:32","date_gmt":"2026-10-07T20:54:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/v-github-vyyavleno-543-tysyachi-ostavlennyh-v-repozitoriyah-dejstvuyushhih-tokenov-klyuchej-i-parolej"},"modified":"2026-10-07T22:54:38","modified_gmt":"2026-10-07T20:54:38","slug":"543000-active-tokens-keys-and-passwords-found-in-github-repositories","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","title":{"rendered":"Na GitHub-e bolo zisten\u00fdch 543 tis\u00edc ponechan\u00fdch v repozit\u00e1roch akt\u00edvnych tokenov, k\u013e\u00fa\u010dov a hesiel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Truffle Security zverejnila v\u00fdsledky anal\u00fdzy \u00fanikov prihlasovac\u00edch \u00fadajov v repozit\u00e1roch umiestnen\u00fdch na GitHub. Pri skenovan\u00ed 224 mili\u00f3nov repozit\u00e1rov, ktor\u00e9 obsahovali 58 mili\u00e1rd s\u00faborov, bolo identifikovan\u00fdch 543 tis\u00edc jedine\u010dn\u00fdch prihlasovac\u00edch \u00fadajov (tokenov, k\u013e\u00fa\u010dov a hesiel), ktor\u00e9 s\u00fa st\u00e1le akt\u00edvne. Akt\u00edvne prihlasovacie \u00fadaje boli v repozit\u00e1roch najmenej rok, preto\u017ee v\u00fdskum vyu\u017e\u00edval v\u00fdrez stavu GitHub z 7. augusta minul\u00e9ho roka a overovanie aktu\u00e1lnosti prihlasovac\u00edch \u00fadajov, vykonan\u00e9 prostredn\u00edctvom pokusn\u00fdch pr\u00edstupov k API, sie\u0165ov\u00fdm slu\u017eb\u00e1m a hostite\u013eom, bolo uskuto\u010dnen\u00e9 na konci j\u00fala tohto roka. <\/p>\n

Medi\u00e1nov\u00e1 doba, po\u010das ktorej s\u00fa prihlasovacie \u00fadaje verejne dostupn\u00e9, bola odhadovan\u00e1 na 784 dn\u00ed, pri\u010dom najstar\u0161ie e\u0161te akt\u00edvne pr\u00edstupov\u00e9 k\u013e\u00fa\u010de boli datovan\u00e9 do roku 2009. Asi 200 tis\u00edc n\u00e1jden\u00fdch akt\u00edvnych prihlasovac\u00edch \u00fadajov bolo vlo\u017een\u00fdch do repozit\u00e1rov po predvolenom aktivovan\u00ed mechanizmu na GitHub na blokovanie \u00fanikov citliv\u00fdch \u00fadajov a pr\u00edstupov\u00fdch tokenov, ktor\u00fd vykon\u00e1va kontrolu pri odosielan\u00ed push po\u017eiadaviek. \u00daniky neboli rozpoznan\u00e9 kv\u00f4li umiestneniu v form\u00e1toch, ktor\u00e9 nie s\u00fa podporovan\u00e9 implementovanou ochranou, pri\u010dom priame zapnutie filtrov zn\u00ed\u017eilo \u00faniky rozpoznan\u00fdch prihlasovac\u00edch \u00fadajov zhruba na polovicu. <\/p>\n

Uk\u00e1zalo sa, \u017ee GitHub \u00faspe\u0161ne odha\u013euje \u00faniky tokenov k be\u017en\u00fdm slu\u017eb\u00e1m, ako s\u00fa GitHub, AWS, Slack, SendGrid, Stripe a GCP, ale prehliada opusten\u00e9 v k\u00f3de parametre pripojenia k datab\u00e1zam, pr\u00edstupov\u00e9 k\u013e\u00fa\u010de k API Google a s\u00fakromn\u00e9 k\u013e\u00fa\u010de. Parametre pripojenia k datab\u00e1zam a s\u00fakromn\u00e9 k\u013e\u00fa\u010de sa predvolene neblokuj\u00fa, aby sa predi\u0161lo falo\u0161n\u00fdm poplachom. Pr\u00edstupov\u00e9 k\u013e\u00fa\u010de k API Google nie s\u00fa blokovan\u00e9, preto\u017ee maj\u00fa prefix AIzaSy, ako otvoren\u00e9 k\u013e\u00fa\u010de Google Maps ur\u010den\u00e9 na integr\u00e1ciu na webov\u00e9 str\u00e1nky. <\/p>\n

Pokia\u013e ide o n\u00e1jden\u00e9 prihlasovacie \u00fadaje, ktor\u00e9 sa uk\u00e1zali ako nefunk\u010dn\u00e9, v\u00e4\u010d\u0161ina z nich sa t\u00fdka pr\u00edstupov\u00fdch tokenov a k\u013e\u00fa\u010dov, ktor\u00e9 s\u00favisia so slu\u017ebami poskytuj\u00facimi mechanizmus odvolania. Napr\u00edklad z 101886 NPM tokenov bol zisten\u00fd iba jeden platn\u00fd (0,001 %), z 73048 tokenov GitHub bolo 260 (0,35 %), a z 30437 tokenov Hugging Face bolo 15 (0,05 %). Pre k\u013e\u00fa\u010de Stripe dosiahol ukazovate\u013e pre\u017eitia 4 %, AWS 8 %, GCP 8 %, Slack 2 %, GitLab 0,64 %. Na porovnanie z 12985 zisten\u00fdch parametrov pripojenia k datab\u00e1zov\u00e9mu syst\u00e9mu PostgreSQL zostalo akt\u00edvnych 11465 (88 %), z 2421 parametrov pripojenia k MySQL bolo 1806 (74 %), z 126963 slu\u017eobn\u00fdch \u00fa\u010dtov Google Cloud bolo 69041 (54 %), z 3790 tokenov na Docker Hub bolo 1244 (33 %), a z 22800 k\u013e\u00fa\u010dov k SendGrid bolo 9189 (40 %). <\/p>\n

Predt\u00fdm vedci analyzovali pribli\u017ene 7,5 PB \u00fadajov na \u0161kolenie AI modelov, ktor\u00e9 s\u00fa distribuovan\u00e9 prostredn\u00edctvom Hugging Face, a zistili v nich 221 tis\u00edc akt\u00edvnych prihlasovac\u00edch \u00fadajov.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Truffle Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u043d\u0430 GitHub. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f 224 \u043c\u043b\u043d \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 58 \u043c\u0438\u043b\u043b\u0438\u0430\u0440\u0434\u043e\u0432 \u0444\u0430\u0439\u043b\u043e\u0432, \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 543 \u0442\u044b\u0441\u044f\u0447\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0438\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c. \u0414\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0433\u043e\u0434, \u0442\u0430\u043a \u043a\u0430\u043a \u0432 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0441\u0440\u0435\u0437 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f GitHub \u043e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183679","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Na GitHub bolo zisten\u00fdch 543 tis\u00edc platn\u00fdch tokenov, k\u013e\u00fa\u010dov a hesiel ponechan\u00fdch v repozit\u00e1roch | ProHoster","description":"Spolo\u010dnos\u0165 Truffle Security zverejnila v\u00fdsledky anal\u00fdzy \u00fanikov prihlasovac\u00edch \u00fadajov v repozit\u00e1roch umiestnen\u00fdch na GitHub.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 GitHub \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 543 \u0442\u044b\u0441\u044f\u0447\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Truffle Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0442\u0435\u0447\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u043d\u0430 GitHub.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/543000-active-tokens-keys-and-passwords-found-in-github-repositories","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-07T20:54:33+00:00","article:modified_time":"2026-10-07T20:54:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=183679"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183679\/revisions"}],"predecessor-version":[{"id":183680,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/183679\/revisions\/183680"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=183679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=183679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=183679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}