{"id":104377,"date":"2022-06-13T21:36:53","date_gmt":"2022-06-13T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov"},"modified":"2022-06-13T21:36:53","modified_gmt":"2022-06-13T19:36:53","slug":"v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","title":{"rendered":"N\u00eb logjet publike t\u00eb Travis CI jan\u00eb identifikuar rreth 73,000 tokene dhe fjal\u00ebkalime t\u00eb projekteve t\u00eb hapura","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompanija Aqua Security publikoi rezultatet e nj\u00eb studimi mbi pranin\u00eb e t\u00eb dh\u00ebnave t\u00eb ndjeshme n\u00eb log\u00ebt e nd\u00ebrtimit, t\u00eb cilat ishin n\u00eb dispozicion publik n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm Travis CI. Hulumtuesit gjet\u00ebn nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb nxjerr\u00eb 770 milion log\u00eb t\u00eb projekteve t\u00eb ndryshme. Gjat\u00eb ngarkes\u00ebs testuese t\u00eb 8 milion log\u00ebve, u identifikuan rreth 73 mij\u00eb tokena, informacion kredencialesh dhe \u00e7el\u00ebsa aksesesh, t\u00eb lidhur me sh\u00ebrbime t\u00eb njohura si GitHub, AWS dhe Docker Hub. Informacioni i zbuluar mund t\u00eb kompromentoj\u00eb infrastruktur\u00ebn e shum\u00eb projekteve t\u00eb hapura, p\u00ebr shembull, nj\u00eb rrjedhje e ngjashme s\u00eb fundmi \u00e7oi n\u00eb hakimin e infrastruktur\u00ebs s\u00eb projektit NPM. <\/p>\n

\u0423\u0442\u0435\u0447\u043a\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u0433\u0430\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Travis CI \u0447\u0435\u0440\u0435\u0437 \u0448\u0442\u0430\u0442\u043d\u044b\u0439 API (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0439 \u043b\u043e\u0433 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 URL \u0432\u0438\u0434\u0430 «https:\/\/api.travis-ci.org\/v3\/job\/5248126\/log.txt», \u0433\u0434\u0435 \u0447\u0438\u0441\u043b\u043e 5248126 — \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043b\u043e\u0433\u0430). \u0414\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043b\u043e\u0433\u043e\u0432 \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0435\u0449\u0451 \u043e\u0434\u0438\u043d API («https:\/\/api.travis-ci.org\/logs\/6976822»), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043b\u043e\u0433\u0430 \u043f\u043e \u043f\u043e\u0440\u044f\u0434\u043a\u043e\u0432\u043e\u043c\u0443 \u043d\u043e\u043c\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434\u043e\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u043a\u043e\u043b\u043e 770 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 2013 \u043f\u043e \u043c\u0430\u0439 2022 \u0433\u043e\u0434\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0439 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0439 \u043f\u043b\u0430\u043d. <\/p>\n

Analiza e mostr\u00ebs testuese tregoi se n\u00eb shum\u00eb raste, n\u00eb logun \u00ebsht\u00eb reflektuar n\u00eb m\u00ebnyr\u00eb t\u00eb hapur parametrat e aksesit n\u00eb depo, API dhe ruajtjet, t\u00eb mjaftueshme p\u00ebr t\u00eb pasur qasje n\u00eb depo private, p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb kod ose p\u00ebr t'u lidhur me mjedise cloud t\u00eb p\u00ebrdorura n\u00eb infrastruktur\u00eb. P\u00ebr shembull, n\u00eb log\u00ebt jan\u00eb gjetur tokena p\u00ebr t'u lidhur me depo n\u00eb GitHub, fjal\u00ebkalime p\u00ebr publikimin e nd\u00ebrtimeve n\u00eb Docker Hub, \u00e7el\u00ebsa p\u00ebr akses n\u00eb mjedise Amazon Web Services (AWS), parametrat e lidhjes me DBMS MySQL dhe PostgreSQL. <\/p>\n

E r\u00ebnd\u00ebsishme \u00ebsht\u00eb se rrjedhje t\u00eb ngjashme p\u00ebrmes API jan\u00eb regjistruar nga hulumtuesit n\u00eb vitet 2015 dhe 2019. Pas incidenteve t\u00eb kaluara, kompania Travis shtoi disa kufizime p\u00ebr t\u00eb v\u00ebshtir\u00ebsuar ngarkimin masiv t\u00eb t\u00eb dh\u00ebnave dhe kufizoi qasjen n\u00eb API, por k\u00ebto kufizime arrit\u00ebn t\u00eb anashkalohen. P\u00ebr m\u00eb tep\u00ebr, kompania Travis b\u00ebri nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb pastruar t\u00eb dh\u00ebnat e ndjeshme n\u00eb log\u00eb, por t\u00eb dh\u00ebnat u pastruan vet\u00ebm pjes\u00ebrisht. <\/p>\n

Shkelja ka prekur kryesisht p\u00ebrdoruesit e projekteve t\u00eb hapura, t\u00eb cil\u00ebve Travis u ofron qasje falas n\u00eb sh\u00ebrbimin e tij t\u00eb integrimit t\u00eb vazhduesh\u00ebm. Gjat\u00eb nj\u00eb verifikimi t\u00eb kryer nga disa ofrues sh\u00ebrbimesh, \u00ebsht\u00eb konfirmuar se rreth gjysma e tokenave dhe \u00e7el\u00ebsave t\u00eb nxjerr\u00eb nga log\u00ebt mbeten aktive. T\u00eb gjith\u00eb p\u00ebrdoruesve t\u00eb variantit falas t\u00eb sh\u00ebrbimit Travis CI u rekomandohet urgjentisht t\u00eb ndryshojn\u00eb \u00e7el\u00ebsat e qasjes, si dhe t\u00eb konfiguroni fshirjen e log\u00ebve t\u00eb nd\u00ebrtimit dhe t\u00eb kontrolloni munges\u00ebn e daljeve t\u00eb t\u00eb dh\u00ebnave konfidenciale n\u00eb log.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Aqua Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f 770 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 8 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432 \u0432 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 73 \u0442\u044b\u0441\u044f\u0447 \u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104377","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb log\u00ebt publike t\u00eb Travis CI jan\u00eb identifikuar rreth 73 mij\u00eb tokena dhe fjal\u00ebkalime t\u00eb projekteve t\u00eb hapura | ProHoster","description":"Kompania Aqua Security publikoi rezultatet e nj\u00eb studimi mbi pranin\u00eb e t\u00eb dh\u00ebnave konfidenciale n\u00eb log\u00ebt e nd\u00ebrtimit, t\u00eb cilat jan\u00eb publike n\u00eb sistemin e integrimit t\u00eb vazhduesh\u00ebm Travis CI.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445 Travis CI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 73 \u0442\u044b\u0441\u044f\u0447 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Aqua Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-13T19:36:53+00:00","article:modified_time":"2022-06-13T19:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104377","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-03-08 16:34:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-13 19:37:58","updated":"2026-03-08 16:34:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=104377"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/104377\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=104377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=104377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=104377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}