{"id":80245,"date":"2020-05-04T19:42:04","date_gmt":"2020-05-04T17:42:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack"},"modified":"2020-05-04T19:42:04","modified_gmt":"2020-05-04T17:42:04","slug":"vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/vzlom-infrastruktury-lineageos-cherez-uyazvimost-v-saltstack","title":{"rendered":"Shkelja e infrastruktur\u00ebs s\u00eb LineageOS p\u00ebrmes nj\u00eb cenueshm\u00ebrie n\u00eb SaltStack","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zhvilluesit e platform\u00ebs mobile LineageOS<\/a><\/noindex>, q\u00eb z\u00ebvend\u00ebsoi CyanogenMod, k\u00ebshilluan<\/a><\/noindex> p\u00ebr identifikimin e gjurm\u00ebve t\u00eb thyerjes s\u00eb infrastruktur\u00ebs s\u00eb projektit. Raportohet se n\u00eb or\u00ebn 6 t\u00eb m\u00ebngjesit (MSK) m\u00eb 3 maj, sulmuesi arriti t\u00eb merrte akses n\u00eb serverin kryesor t\u00eb sistemit t\u00eb menaxhimit t\u00eb centralizuar t\u00eb konfigurimit SaltStack<\/a><\/noindex> p\u00ebrmes shfryt\u00ebzimit t\u00eb nj\u00eb dob\u00ebsie t\u00eb pap\u00ebrmir\u00ebsuar. Tani \u00ebsht\u00eb duke u hetuar incidenti dhe detajet ende nuk jan\u00eb t\u00eb disponueshme. <\/p>\n

Raportohet<\/a><\/noindex> vet\u00ebm, q\u00eb sulmi nuk preku \u00e7el\u00ebsat p\u00ebr formimin e n\u00ebnshkrimeve dixhitale, sistemin e nd\u00ebrtimit dhe kodin burimor t\u00eb platform\u00ebs \u2014 \u00e7el\u00ebsat isha<\/a><\/noindex> n\u00eb hostet q\u00eb ishin plot\u00ebsisht t\u00eb ndara nga infrastruktura kryesore, e cila menaxhohej p\u00ebrmes SaltStack, dhe nd\u00ebrtimet ishin ndaluar p\u00ebr arsye teknike m\u00eb 30 Prill. Duke u bazuar n\u00eb t\u00eb dh\u00ebnat n\u00eb faqen status.lineageos.org<\/a><\/noindex> zhvilluesit tashm\u00eb e kan\u00eb rikuperuar serverin me sistemin e rishikimit t\u00eb kodit Gerrit, faqen dhe wiki. Server\u00ebt e nd\u00ebrtimit (builds.lineageos.org), portali p\u00ebr shkarkimin e skedar\u00ebve (download.lineageos.org), server\u00ebt e post\u00ebs dhe sistemi i koordinimit p\u00ebr shfaqjen n\u00eb pasqyra mbeten t\u00eb \u00e7aktivizuar. <\/p>\n

Sulmi u b\u00eb i mundur p\u00ebr shkak se porta rrjetore (4506) p\u00ebr akses n\u00eb SaltStack nuk ishte<\/a><\/noindex> blocking for external requests by the firewall \u2014 the attacker had to wait for a critical vulnerability in SaltStack to appear and exploit it before the administrators installed the patch. All SaltStack users are urgently advised to update their systems and check for signs of compromise.<\/p>\n

It seems that the attacks through SaltStack were not limited to the hacking of LineageOS and took on a mass scale \u2014 during the day, various users who did not manage to update SaltStack, theksojn\u00eb<\/a><\/noindex> detecting the compromise of their infrastructures with code for mining or backdoors placed on the servers. Including raportohet<\/a><\/noindex> about the similar hacking of the content management system Ghost<\/a><\/noindex>, which affected Ghost(Pro) sites and billing (it is claimed that credit card numbers were not compromised, but hashes of Ghost users' passwords may have fallen into the hands of attackers).<\/p>\n

On April 29, there were jan\u00eb l\u00ebshuar<\/a><\/noindex> updates to the SaltStack platform 3000.2<\/a><\/noindex> dhe 2019.2.4<\/a><\/noindex>, which eliminated dy rreziqe<\/a><\/noindex> (information about the vulnerabilities was published on April 30), assigned the highest level of danger, as they allow without authentication<\/a><\/noindex> ekzekutimi i larg\u00eb aktivizuar si n\u00eb hostin e menaxhimit (salt-master), ashtu edhe n\u00eb t\u00eb gjitha serverat e menaxhuar prej tij.<\/p>\n