{"id":112852,"date":"2024-01-12T15:10:15","date_gmt":"2024-01-12T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy"},"modified":"2026-02-13T23:24:49","modified_gmt":"2026-02-13T21:24:49","slug":"ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","title":{"rendered":"Sulmi n\u00eb infrastruktur\u00ebn PyTorch, duke kompromituar repository-n dhe l\u00ebshimet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Detajet e sulmit mbi infrastruktur\u00ebn e p\u00ebrdorur p\u00ebr zhvillimin e korniz\u00ebs s\u00eb m\u00ebsimit t\u00eb makinerive PyTorch jan\u00eb zbuluar, duke lejuar nxjerrjen e \u00e7el\u00ebsave t\u00eb qasjes t\u00eb mjaftueshme p\u00ebr t\u00eb mbajtur t\u00eb dh\u00ebna arbitrare n\u00eb repository-n e l\u00ebshimeve t\u00eb projektit n\u00eb GitHub dhe AWS, si dhe p\u00ebr mb\u00ebshtjelljen e kodit n\u00eb deg\u00ebn kryesore t\u00eb repository-t dhe shtimin e nj\u00eb backdoor n\u00ebp\u00ebrmjet var\u00ebsive. Z\u00ebvend\u00ebsimi i l\u00ebshimeve t\u00eb PyTorch mund t\u00eb jet\u00eb p\u00ebrdorur p\u00ebr t\u00eb kryer sulme ndaj kompanive t\u00eb m\u00ebdha si Google, Meta, Boeing dhe Lockheed Martin, q\u00eb p\u00ebrdorin PyTorch n\u00eb projektet e tyre. N\u00eb kuad\u00ebr t\u00eb programit Bug Bounty, kompania Meta ka paguar k\u00ebrkuesit $16,250 p\u00ebr informacionin mbi problemin. <\/p>\n

Thelbi i sulmit \u00ebsht\u00eb mund\u00ebsia p\u00ebr t\u00eb ekzekutuar kodin tuaj n\u00eb server\u00eb<\/a> integrimit t\u00eb vazhduesh\u00ebm, q\u00eb kryejn\u00eb rind\u00ebrtimin dhe ekzekutimin e detyrave p\u00ebr testimin e ndryshimeve t\u00eb reja q\u00eb d\u00ebrgohen n\u00eb depo. Problemi ndikon n\u00eb projektet q\u00eb p\u00ebrdorin procesor\u00eb t\u00eb jasht\u00ebm t\u00eb vet\u00eb-hostuar \"Self-Hosted Runner\" me GitHub Actions. Ndryshe nga procesor\u00ebt tradicional\u00eb t\u00eb GitHub Actions, t\u00eb vet\u00eb-hostuarit ekzekutohen jo n\u00eb infrastruktur\u00ebn e GitHub, por n\u00eb server\u00ebt e tyre ose n\u00eb virtuakale<\/a> makina t\u00eb mb\u00ebshtetura nga zhvilluesit. <\/p>\n

Ekzekutimi i detyrave t\u00eb nd\u00ebrtimit n\u00eb server\u00ebt e tyre lejon organizimin e ekzekutimit t\u00eb kodit q\u00eb mund t\u00eb skanoj rrjetin e brendsh\u00ebm t\u00eb nd\u00ebrmarjes, t\u00eb k\u00ebrkoj\u00eb n\u00eb sistemin lokal t\u00eb skedar\u00ebve \u00e7el\u00ebsa t\u00eb enkriptimit dhe tokene qasjeje, t\u00eb analizoj\u00eb variablat e mjedisit me parametrat e qasjes n\u00eb ruajtjet e jashtme ose sh\u00ebrbimet n\u00eb re. N\u00eb rastin e munges\u00ebs s\u00eb izolimit t\u00eb duhur t\u00eb mjedisit t\u00eb nd\u00ebrtimit, t\u00eb dh\u00ebnat konfidenciale t\u00eb gjetura mund t\u00eb d\u00ebrgohen jasht\u00eb nga agresor\u00ebt, p\u00ebr shembull, p\u00ebrmes thirrjeve n\u00eb API t\u00eb jashtme. P\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrdorimin nga projektet \"Self-Hosted Runner\", mund t\u00eb p\u00ebrdoret vegla Gato, q\u00eb analizon skedar\u00ebt e pun\u00ebs n\u00eb dispozicion publik dhe log\u00ebt e ekzekutimit t\u00eb detyrave CI. <\/p>\n

N\u00eb PyTorch dhe shum\u00eb projekte t\u00eb tjera q\u00eb p\u00ebrdorin \"Self-Hosted Runner\", ekzekutimi i detyrave t\u00eb nd\u00ebrtimit lejohet vet\u00ebm p\u00ebr zhvilluesit, ndryshimet e t\u00eb cil\u00ebve kan\u00eb kaluar m\u00eb par\u00eb rishikimin dhe jan\u00eb p\u00ebrfshir\u00eb n\u00eb baz\u00ebn e kodit t\u00eb projektit. Posedimi i statusit \"contributor\" kur p\u00ebrdoren cil\u00ebsimet e parazgjedhura n\u00eb depo i jep mund\u00ebsin\u00eb t\u00eb ekzekutohen p\u00ebrpunuesit e GitHub Actions kur p\u00ebrfshihen k\u00ebrkesa p\u00ebr ndihm\u00ebn dhe, p\u00ebr pasoj\u00eb, t\u00eb ekzekutohet kodi i tyre n\u00eb \u00e7do ambient GitHub Actions Runner t\u00eb lidhur me depoen ose organizat\u00ebn q\u00eb mbik\u00ebqyr projektin. <\/p>\n

Kufizimi n\u00eb statusin \u00abkontributor\u00bb u zbulua t\u00eb ishte i leht\u00eb p\u00ebr t'u anashkaluar \u2014 mjafton t\u00eb d\u00ebrgosh nj\u00eb ndryshim t\u00eb par\u00ebnd\u00ebsish\u00ebm paraprakisht dhe t\u00eb pres\u00ebsh q\u00eb ai t\u00eb pranohet n\u00eb baz\u00ebn e kodit, pas s\u00eb cil\u00ebs zhvilluesi automatikisht merr statusin e pjes\u00ebmarr\u00ebsit aktiv, pull-requestet e t\u00eb cil\u00ebve lejohet t\u00eb testohen n\u00eb infrastruktur\u00ebn CI pa nj\u00eb verifikim t\u00eb shqyer. P\u00ebr t\u00eb fituar statusin e zhvilluesit aktiv, gjat\u00eb eksperimenteve u p\u00ebrdor\u00ebn ndryshime t\u00eb vogla kozmetike, t\u00eb lidhura me korrigjimin e gabimeve n\u00eb dokumentacion. P\u00ebr t\u00eb marr\u00eb qasje n\u00eb depo dhe ruajtjen e versioneve t\u00eb PyTorch, gjat\u00eb sulmit gjat\u00eb ekzekutimit t\u00eb kodit n\u00eb 'Self-Hosted Runner' u realizua kapja e tokenit GitHub, i cili p\u00ebrdorej p\u00ebr t\u00eb pasur qasje n\u00eb depo nga proceset e nd\u00ebrtimit, si dhe \u00e7el\u00ebsave AWS, t\u00eb angazhuar p\u00ebr ruajtjen e rezultateve t\u00eb nd\u00ebrtimit. <\/p>\n

Problemi nuk \u00ebsht\u00eb specifik p\u00ebr PyTorch dhe prek shum\u00eb projekte t\u00eb tjera t\u00eb m\u00ebdha q\u00eb p\u00ebrdorin konfigurimet e paracaktuara p\u00ebr 'Self-Hosted Runner' n\u00eb GitHub Actions. P\u00ebr shembull, mund t\u00eb p\u00ebrmend realizimin e sulmeve t\u00eb ngjashme p\u00ebr t\u00eb futur backdoor n\u00eb disa portofol\u00eb t\u00eb m\u00ebdhenj t\u00eb kripto-monedhave dhe projekte blockchain me kapitalizim miliard\u00ebsh, si dhe p\u00ebr t\u00eb b\u00ebr\u00eb ndryshime n\u00eb l\u00ebshimet Microsoft Deepspeed dhe TensorFlow, komprometimin e nj\u00ebrit prej aplikacioneve t\u00eb kompanis\u00eb CloudFlare, si dhe ekzekutimin e kodit n\u00eb kompjuter\u00ebt n\u00eb rrjetin Microsoft. Detajet p\u00ebr k\u00ebto incidente ende nuk jan\u00eb zbuluar. N\u00eb kuad\u00ebr t\u00eb programeve ekzistuese Bug Bounty, hulumtuesit kan\u00eb d\u00ebrguar m\u00eb shum\u00eb se 20 k\u00ebrkesa p\u00ebr t\u00eb marr\u00eb shp\u00ebrblime n\u00eb shum\u00ebn e disa qindrave mij\u00ebra dollar\u00ebve.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f PyTorch, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0443\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432 GitHub \u0438 AWS, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 PyTorch \u043c\u043e\u0433\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112852","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi ndaj infrastruktur\u00ebs PyTorch, duke kompromentuar depot dhe l\u00ebshimet | ProHoster","description":"Jan\u00eb zbuluar detajet e nj\u00eb sulmi ndaj infrastruktur\u00ebs q\u00eb p\u00ebrdoret p\u00ebr zhvillimin e korniz\u00ebs s\u00eb m\u00ebsimit t\u00eb makinerive PyTorch, i cili mund\u00ebsoi nxjerrjen e \u00e7el\u00ebsave t\u00eb aksesit t\u00eb mjaftuesh\u00ebm p\u00ebr t\u00eb vendosur t\u00eb dh\u00ebna t\u00eb rastit n\u00eb nj\u00eb depo me l\u00ebshimet e projektit n\u00eb GitHub dhe AWS, si dhe p\u00ebr t\u00eb injektuar kod n\u00eb deg\u00ebn kryesore t\u00eb depove dhe p\u00ebr t\u00eb shtuar nj\u00eb backdoor p\u00ebrmes var\u00ebsive. Z\u00ebvend\u00ebsimi i l\u00ebshimeve t\u00eb PyTorch mund t\u00eb ishte p\u00ebrdorur p\u00ebr t\u00eb kryer sulme ndaj kompanive t\u00eb m\u00ebdha.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 PyTorch, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0430\u044f \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0438 \u0440\u0435\u043b\u0438\u0437\u044b | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u0440\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f PyTorch, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0443\u044e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0441 \u0440\u0435\u043b\u0438\u0437\u0430\u043c\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432 GitHub \u0438 AWS, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043a\u043e\u0434\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u0440\u0435\u043b\u0438\u0437\u043e\u0432 PyTorch \u043c\u043e\u0433\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438,","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-infrastrukturu-pytorch-komprometiruyushhaya-repozitorij-i-relizy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-12T13:10:15+00:00","article:modified_time":"2026-02-13T21:24:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112852","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-13 21:24:49","updated":"2026-02-13 21:24:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=112852"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112852\/revisions"}],"predecessor-version":[{"id":164381,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/112852\/revisions\/164381"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=112852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=112852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=112852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}