{"id":104377,"date":"2022-06-13T21:36:53","date_gmt":"2022-06-13T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov"},"modified":"2022-06-13T21:36:53","modified_gmt":"2022-06-13T19:36:53","slug":"v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","title":{"rendered":"N\u00eb logjet publike t\u00eb Travis CI jan\u00eb identifikuar rreth 73,000 tokene dhe fjal\u00ebkalime t\u00eb projekteve t\u00eb hapura","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompanija Aqua Security publikoi rezultatet e nj\u00eb studimi mbi pranin\u00eb e t\u00eb dh\u00ebnave t\u00eb ndjeshme n\u00eb log\u00ebt e nd\u00ebrtimit, t\u00eb cilat ishin n\u00eb dispozicion publik n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm Travis CI. Hulumtuesit gjet\u00ebn nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb nxjerr\u00eb 770 milion log\u00eb t\u00eb projekteve t\u00eb ndryshme. Gjat\u00eb ngarkes\u00ebs testuese t\u00eb 8 milion log\u00ebve, u identifikuan rreth 73 mij\u00eb tokena, informacion kredencialesh dhe \u00e7el\u00ebsa aksesesh, t\u00eb lidhur me sh\u00ebrbime t\u00eb njohura si GitHub, AWS dhe Docker Hub. Informacioni i zbuluar mund t\u00eb kompromentoj\u00eb infrastruktur\u00ebn e shum\u00eb projekteve t\u00eb hapura, p\u00ebr shembull, nj\u00eb rrjedhje e ngjashme s\u00eb fundmi \u00e7oi n\u00eb hakimin e infrastruktur\u00ebs s\u00eb projektit NPM. <\/p>\n
Dhemeti \u00ebsht\u00eb i lidhur me mund\u00ebsin\u00eb e qasjes n\u00eb journale t\u00eb p\u00ebrdoruesve t\u00eb sh\u00ebrbimit falas Travis CI p\u00ebrmes API-s\u00eb s\u00eb tij (p\u00ebr shembull, nj\u00eb jurnal nd\u00ebrtimi mund t\u00eb shkarkohet p\u00ebrmes nj\u00eb URL-je t\u00eb till\u00eb si \"https:\/\/api.travis-ci.org\/v3\/job\/5248126\/log.txt\", ku numri 5248126 \u00ebsht\u00eb identifikuesi i jurnalit). P\u00ebr t\u00eb p\u00ebrcaktuar gam\u00ebn e mundshme t\u00eb identifikuesve t\u00eb jurnalit, u p\u00ebrdor nj\u00eb API tjet\u00ebr (\"https:\/\/api.travis-ci.org\/logs\/6976822\"), e cila ofron redirektim p\u00ebr shkarkimin e jurnalit sipas numrit rendor. Duke p\u00ebrshkruar n\u00eb proces, gjat\u00eb hulumtimit arrit\u00ebm t\u00eb p\u00ebrcaktonim pa autentifikim rreth 770 milion journale, t\u00eb krijuara nga viti 2013 deri n\u00eb maj t\u00eb vitit 2022 gjat\u00eb nd\u00ebrtimit t\u00eb projekteve q\u00eb b\u00ebnin pjes\u00eb n\u00eb planin e tarif\u00ebs s\u00eb lir\u00eb. <\/p>\n
Analiza e mostr\u00ebs testuese tregoi se n\u00eb shum\u00eb raste, n\u00eb logun \u00ebsht\u00eb reflektuar n\u00eb m\u00ebnyr\u00eb t\u00eb hapur parametrat e aksesit n\u00eb depo, API dhe ruajtjet, t\u00eb mjaftueshme p\u00ebr t\u00eb pasur qasje n\u00eb depo private, p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb kod ose p\u00ebr t'u lidhur me mjedise cloud t\u00eb p\u00ebrdorura n\u00eb infrastruktur\u00eb. P\u00ebr shembull, n\u00eb log\u00ebt jan\u00eb gjetur tokena p\u00ebr t'u lidhur me depo n\u00eb GitHub, fjal\u00ebkalime p\u00ebr publikimin e nd\u00ebrtimeve n\u00eb Docker Hub, \u00e7el\u00ebsa p\u00ebr akses n\u00eb mjedise Amazon Web Services (AWS), parametrat e lidhjes me DBMS MySQL dhe PostgreSQL. <\/p>\n
E r\u00ebnd\u00ebsishme \u00ebsht\u00eb se rrjedhje t\u00eb ngjashme p\u00ebrmes API jan\u00eb regjistruar nga hulumtuesit n\u00eb vitet 2015 dhe 2019. Pas incidenteve t\u00eb kaluara, kompania Travis shtoi disa kufizime p\u00ebr t\u00eb v\u00ebshtir\u00ebsuar ngarkimin masiv t\u00eb t\u00eb dh\u00ebnave dhe kufizoi qasjen n\u00eb API, por k\u00ebto kufizime arrit\u00ebn t\u00eb anashkalohen. P\u00ebr m\u00eb tep\u00ebr, kompania Travis b\u00ebri nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb pastruar t\u00eb dh\u00ebnat e ndjeshme n\u00eb log\u00eb, por t\u00eb dh\u00ebnat u pastruan vet\u00ebm pjes\u00ebrisht. <\/p>\n
Shkelja ka prekur kryesisht p\u00ebrdoruesit e projekteve t\u00eb hapura, t\u00eb cil\u00ebve Travis u ofron qasje falas n\u00eb sh\u00ebrbimin e tij t\u00eb integrimit t\u00eb vazhduesh\u00ebm. Gjat\u00eb nj\u00eb verifikimi t\u00eb kryer nga disa ofrues sh\u00ebrbimesh, \u00ebsht\u00eb konfirmuar se rreth gjysma e tokenave dhe \u00e7el\u00ebsave t\u00eb nxjerr\u00eb nga log\u00ebt mbeten aktive. T\u00eb gjith\u00eb p\u00ebrdoruesve t\u00eb variantit falas t\u00eb sh\u00ebrbimit Travis CI u rekomandohet urgjentisht t\u00eb ndryshojn\u00eb \u00e7el\u00ebsat e qasjes, si dhe t\u00eb konfiguroni fshirjen e log\u00ebve t\u00eb nd\u00ebrtimit dhe t\u00eb kontrolloni munges\u00ebn e daljeve t\u00eb t\u00eb dh\u00ebnave konfidenciale n\u00eb log. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"