{"id":104377,"date":"2022-06-13T21:36:53","date_gmt":"2022-06-13T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov"},"modified":"2022-06-13T21:36:53","modified_gmt":"2022-06-13T19:36:53","slug":"v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","title":{"rendered":"I de offentliga loggarna p\u00e5 Travis CI har cirka 73 000 tokens och l\u00f6senord fr\u00e5n \u00f6ppna projekt uppt\u00e4ckts","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

F\u00f6retaget Aqua Security har publicerat resultaten av en unders\u00f6kning av f\u00f6rekomsten av k\u00e4nsliga data i byggloggar som \u00e4r offentligt tillg\u00e4ngliga i det kontinuerliga integrationssystemet Travis CI. Forskarna hittade en metod f\u00f6r att extrahera 770 miljoner loggar fr\u00e5n olika projekt. Vid en testuppladdning av 8 miljoner loggar identifierades cirka 73 000 tokens, anv\u00e4ndaruppgifter och \u00e5tkomstr\u00e4tter relaterade till olika popul\u00e4ra tj\u00e4nster, inklusive GitHub, AWS och Docker Hub. Den information som uppt\u00e4cktes kan komprimera infrastrukturen f\u00f6r m\u00e5nga \u00f6ppna projekt, till exempel ledde en liknande l\u00e4cka nyligen till en hackning av infrastrukturen f\u00f6r projektet NPM. <\/p>\n

\u0423\u0442\u0435\u0447\u043a\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u0433\u0430\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Travis CI \u0447\u0435\u0440\u0435\u0437 \u0448\u0442\u0430\u0442\u043d\u044b\u0439 API (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0439 \u043b\u043e\u0433 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 URL \u0432\u0438\u0434\u0430 «https:\/\/api.travis-ci.org\/v3\/job\/5248126\/log.txt», \u0433\u0434\u0435 \u0447\u0438\u0441\u043b\u043e 5248126 — \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043b\u043e\u0433\u0430). \u0414\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043b\u043e\u0433\u043e\u0432 \u0431\u044b\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0435\u0449\u0451 \u043e\u0434\u0438\u043d API («https:\/\/api.travis-ci.org\/logs\/6976822»), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043b\u043e\u0433\u0430 \u043f\u043e \u043f\u043e\u0440\u044f\u0434\u043a\u043e\u0432\u043e\u043c\u0443 \u043d\u043e\u043c\u0435\u0440\u0443. \u041c\u0435\u0442\u043e\u0434\u043e\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043e\u043a\u043e\u043b\u043e 770 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 \u0441 2013 \u043f\u043e \u043c\u0430\u0439 2022 \u0433\u043e\u0434\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0439 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0439 \u043f\u043b\u0430\u043d. <\/p>\n

Analysen av testurvalet visade att loggarna i m\u00e5nga fall inneh\u00f6ll \u00f6ppna \u00e5tkomstr\u00e4ttigheter till repositories, API:er och lagringsytor, tillr\u00e4ckliga f\u00f6r att f\u00e5 tillg\u00e5ng till privata repositories, g\u00f6ra \u00e4ndringar i koden eller ansluta till molnmilj\u00f6er som anv\u00e4nds i infrastrukturen. Till exempel hittades tokens f\u00f6r att ansluta till repositories p\u00e5 GitHub, l\u00f6senord f\u00f6r att publicera byggnader p\u00e5 Docker Hub, nycklar f\u00f6r att f\u00e5 tillg\u00e5ng till Amazon Web Services (AWS) milj\u00f6er samt anslutningsparameterar f\u00f6r MySQL och PostgreSQL databaser. <\/p>\n

Det \u00e4r v\u00e4rt att notera att liknande l\u00e4ckor via API har registrerats av forskare under 2015 och 2019. Efter tidigare incidenter har f\u00f6retaget Travis lagt till vissa begr\u00e4nsningar f\u00f6r att f\u00f6rsv\u00e5ra massnedladdning av data och besk\u00e4rde tillg\u00e5ngen till API:et, men dessa begr\u00e4nsningar har kunnat kringg\u00e5s. Dessutom gjorde f\u00f6retaget Travis ett f\u00f6rs\u00f6k att rensa k\u00e4nsliga data i loggar, men datarensningen var endast delvis genomf\u00f6rd. <\/p>\n

L\u00e4ckan ber\u00f6rde huvudsakligen anv\u00e4ndare av \u00f6ppna projekt som f\u00e5r gratis tillg\u00e5ng till Travis tj\u00e4nst f\u00f6r kontinuerlig integration. Vid en granskning som genomf\u00f6rdes av vissa tj\u00e4nsteleverant\u00f6rer bekr\u00e4ftades det att ungef\u00e4r h\u00e4lften av de extraherade loggtokens och nycklar f\u00f6rblir aktiva. Alla anv\u00e4ndare av den gratis versionen av Travis CI rekommenderas att omedelbart byta \u00e5tkomstnycklar, samt att st\u00e4lla in borttagning av byggloggar och kontrollera att inga konfidentiella uppgifter skrivs ut i loggarna.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Aqua Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f 770 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 8 \u043c\u043b\u043d \u043b\u043e\u0433\u043e\u0432 \u0432 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 73 \u0442\u044b\u0441\u044f\u0447 \u0442\u043e\u043a\u0435\u043d\u043e\u0432, \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104377","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I offentliga loggar f\u00f6r Travis CI har cirka 73 000 tokens och l\u00f6senord f\u00f6r \u00f6ppna projekt identifierats | ProHoster","description":"F\u00f6retaget Aqua Security publicerade resultaten av en studie om f\u00f6rekomsten av konfidentiella uppgifter i byggloggar, som \u00e4r offentligt tillg\u00e4ngliga i systemet f\u00f6r kontinuerlig integration Travis CI.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445 Travis CI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 73 \u0442\u044b\u0441\u044f\u0447 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Aqua Security \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u043b\u043e\u0433\u0430\u0445, \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0435\u043f\u0440\u0435\u0440\u044b\u0432\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 Travis CI.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-publichnyh-logah-travis-ci-vyyavleno-okolo-73-tysyach-tokenov-i-parolej-otkrytyh-proektov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-13T19:36:53+00:00","article:modified_time":"2022-06-13T19:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104377","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-03-08 16:34:25","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-13 19:37:58","updated":"2026-03-08 16:34:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=104377"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/104377\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=104377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=104377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=104377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}