Truffle Security yakaburitsa zvinyorwa zvekurwisa zveakawanda akajairwa GitHub repository matekiniki ekubvisa data kubva kure repositories ane maforogo eruzhinji kana akagadzirwa seforogo.
Iko kugona kuwana zviitwa nehashi mune ese marepositori akabatanidzwa nemaforogo imhaka yekuti GitHub, kuitira kukwidziridza uye kubvisa zvakapetwa, inochengeta zvinhu zvese kubva kuhombe repository nemaforogo pamwe chete, chete zvine musoro kuparadzanisa varidzi vekuita. Kuchengetera kwakadaro kunobvumidza iwe kuti utarise chero kuzvipira kubva kune chero forogo mune huru repository nekunyatso kutsanangura hashi yayo muURL. Semuenzaniso, mushandisi anogona kuforoma iyo "/torvalds/linux" repository uye owedzera chero kodhi kwairi, mushure meiyo iyi kodhi inozowanikwa kuburikidza yakananga hash link mu "/torvalds/linux" repository. Kana repository yadzimwa, kana paine kanenge forogo yeruzhinji, iyo data kubva kure repository inoramba iripo uchishandisa hashi yekuzvipira.
Mamiriro matatu anotsanangurwa anoisa njodzi yekuchengetedza:
- Mamiriro ekutanga anosanganisira mamiriro ezvinhu apo vanogadzira forogo veruzhinji marepositori, vowedzera shanduko kwavari, kuyedza, vobva vadzima. Pamusoro pekudonha kodhi isina kuitirwa kuburitswa, njodzi inomuka kana kushanda API makiyi ekuwana anowedzerwa kune kodhi yemuenzaniso mafaera mukuyedza. Muchiitiko ichi, anorwisa anogona kuwana shanduko nekuita hashi yakagadziriswa mushure mekunge forogo yabviswa kuburikidza nenzvimbo huru. Semuenzaniso, vachishandisa nzira yakarongwa, vatsvakurudzi vakakwanisa kuziva makumi matatu ekushanda kweAPI yekuwana makiyi kuburikidza nekuongorora matatu emashini ekudzidza-ane chokuita repositories ane nhamba huru yeforogo.
- Chechipiri chiitiko chine chekuita nemukana wekuwana mukana kune data mushure mekudzima yekutanga repository, kana maforogo akagadzirwa kune ino repository. Muenzaniso unopiwa apo makiyi epachivande emumwe wevashandi akaburitswa netsaona munzvimbo inochengeterwa veruzhinji yekambani imwe, zvichibvumira kuwana kwakazara kune ese matura ekambani iyi paGitHub. Iyo kambani yakadzima iyo yakaburitswa repository, asi makiyi akaramba aripo kuti adzorerwe kuburikidza nekuita hash mafoni mumaforogo repositori.
- Mamiriro ezvinhu echitatu ane hukama nemhando yekusimudzira yemapurojekiti anovandudza shanduro yakavhurika munzvimbo inochengeterwa veruzhinji uye yakawedzerwa vhezheni yemuridzi mune yakavanzika. Kana kambani yakatanga kugadzira purojekiti mune yakavanzika repository, uyezve, mushure mekuvhura iyo kodhi yeprojekiti, yakaendesa kune yeruzhinji chikamu, asi ikaramba ichigadzira yakavharwa yemukati kana yakawedzera vhezheni mune yakavanzika forogo, zvinokwanisika kuwana shanduko. yakawedzerwa kune yakavanzika forogo uchishandisa kuzvipira hashes kuburikidza neruzhinji repository. Muchiitiko ichi, kuwana kunongogoneka kune shanduko yakawedzerwa kune yakavanzika forogo iyo huru repository isati yaendeswa kune yeruzhinji chikamu (matura ezvakavanzika uye eruzhinji repositori akapatsanurwa, asi apo maviri marepositori aive ega, zvisungo zvakachengetwa pamwechete, saka vakaramba vari munzvimbo inochengeterwa zvinhu mushure mekunge yaendeswa kuboka revanhu) .
Nzira iyi inobvumira vanhu kupinda mu repository forks kuburikidza ne link kuenda ku main repository yagara ichizivikanwa kwemakore mazhinji uye inoshandiswa nguva nenguva kune majokes akasiyana-siyana uye kutsausa vagadziri (semuenzaniso, majokers nguva nenguva anogadzira chitarisiko chekuisa backdoors mu repository ne kernel nenzira yakafanana). Linux (paGitHub). Kuti vadzivise majee akadaro, GitHub yakawedzera yambiro yekuti chikumbiro chakakumbirwa chakanga chisina chekuita nechero matavi ari mudura razvino uye chingave cheforogo. Zvisinei, kugona kuwana commits by hash mune chero repository yakabatana neforks kwaionekwa sekusina njodzi, sezvo kuwana data mu remote uye private forks kunoda ruzivo rwe commit hash.
Kutsvaga hashi yekuzvipira inogadzirwa yakavakirwa paSHA-1 algorithm uye kusanganisira makumi matatu nemaviri mavara hazvisi zvechokwadi, asi zvakazoitika kuti izvi hazvidiwe. GitHub inotsigira a shorthand fomu rereferensi maitirwo anobvumira shanduko kuti dzigadziriswe nevashoma ekutanga mavara ehashi kana pasina anopindirana nezvimwe zvipimo. Huwandu hwemavara eakapfupikiswa hashi kero i32, inofambirana nekutsvaga zviuru makumi matanhatu neshanu zvemisanganiswa (4^65). Muchiitiko ichi, hutsinye hutsinye hunogona kunge husiri madikanwa, sezvo GitHub API inobvumidza iwe kuti ubatanidze vanobata kuti vatore zviitiko zvinoshandiswa nevechitatu-bato mapurojekiti anochengetedza archive ane yakazara log yezvese mashandiro, umo ruzivo rwekuita hashes runoramba ruripo. kunyange mushure mekudzima repositories.
Source: opennet.ru
