{"id":46699,"date":"2025-09-17T14:22:20","date_gmt":"2025-09-17T07:22:20","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=46699"},"modified":"2025-09-26T14:23:52","modified_gmt":"2025-09-26T07:23:52","slug":"hon-6-700-kho-luu-tru-rieng-tu-bi-cong-khai-trong-cuoc-tan-cong-chuoi-cung-ung-nx","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/hon-6-700-kho-luu-tru-rieng-tu-bi-cong-khai-trong-cuoc-tan-cong-chuoi-cung-ung-nx\/","title":{"rendered":"H\u01a1n 6.700 kho l\u01b0u tr\u1eef ri\u00eang t\u01b0 b\u1ecb c\u00f4ng khai trong cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng Nx"},"content":{"rendered":"
\n
<\/i>\u00a0H\u1ed3ng \u0110\u1ea1t<\/a><\/div>\n<\/div>\n

M\u1edbi \u0111\u00e2y, c\u00f4ng ty an ninh m\u1ea1ng Wiz (M\u1ef9) th\u00f4ng b\u00e1o, tin t\u1eb7c \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c th\u00f4ng tin b\u00ed m\u1eadt (secret) b\u1ecb \u0111\u00e1nh c\u1eafp trong cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng Nx g\u1ea7n \u0111\u00e2y, \u0111\u1ec3 t\u1eeb \u0111\u00f3 c\u00f4ng khai h\u01a1n 6.700 kho l\u01b0u tr\u1eef ri\u00eang t\u01b0.<\/p>\n

L\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng c\u00f3 t\u00ean \u201cs1ngularity\u201d, k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 s\u1eed d\u1ee5ng token NPM tr\u00ean kho l\u01b0u tr\u1eef Nx \u0111\u1ec3 ph\u00e1t h\u00e0nh 8 phi\u00ean b\u1ea3n \u0111\u1ed9c h\u1ea1i. C\u00e1c phi\u00ean b\u1ea3n n\u00e0y ch\u1ee9a m\u1ed9t t\u1eadp l\u1ec7nh \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 th\u1ef1c thi t\u1ec7p telemetry[.]js \u0111\u1ed9c h\u1ea1i tr\u00ean h\u1ec7 th\u1ed1ng Linux v\u00e0\u00a0macOS<\/a>, nh\u1eb1m t\u00ecm ki\u1ebfm m\u1ed9t c\u00e1ch c\u00f3 h\u1ec7 th\u1ed1ng c\u00e1c m\u00e1y t\u00ednh \u0111\u1ec3 t\u00ecm c\u00e1c t\u1ec7p ch\u1ee9a kh\u00f3a API, token\u00a0GitHub<\/a>, token NPM, kh\u00f3a SSH v\u00e0 d\u1eef li\u1ec7u v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed.<\/p>\n

Sau \u0111\u00f3, m\u00e3 \u0111\u1ed9c ti\u1ebfn h\u00e0nh m\u00e3 h\u00f3a d\u1eef li\u1ec7u, t\u1ea1o c\u00e1c kho l\u01b0u tr\u1eef GitHub c\u00f4ng khai c\u00f3 t\u00ean \u201cs1ngularity-repository\u201d (ho\u1eb7c c\u00e1c bi\u1ebfn th\u1ec3 ch\u1ee9a k\u00fd t\u1ef1 s\u1ed1) v\u00e0 truy\u1ec1n d\u1eef li\u1ec7u v\u00e0o c\u00e1c kho l\u01b0u tr\u1eef \u0111\u00f3.<\/p>\n

Wiz cho bi\u1ebft ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0y c\u00f2n c\u1ed1 g\u1eafng thu th\u1eadp c\u00e1c t\u1ec7p tin nh\u1ea1y c\u1ea3m. C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u \u0111\u00e3 x\u00e1c \u0111\u1ecbnh \u0111\u01b0\u1ee3c h\u01a1n 20.000 t\u1ec7p tin b\u1ecb \u0111\u00e1nh c\u1eafp, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn 225 ng\u01b0\u1eddi d\u00f9ng kh\u00e1c nhau. Ngo\u00e0i ra, m\u00e3 \u0111\u1ed9c c\u0169ng s\u1eeda \u0111\u1ed5i c\u00e1c t\u1ec7p kh\u1edfi \u0111\u1ed9ng shell c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, v\u1edbi m\u1ee5c ti\u00eau l\u00e0m h\u1ec7 th\u1ed1ng b\u1ecb s\u1eadp khi m\u1edf c\u00e1c c\u1eeda s\u1ed5 terminal m\u1edbi, \u0111\u1ed3ng th\u1eddi s\u1eed d\u1ee5ng c\u00e1c CLI h\u1ed7 tr\u1ee3 AI nh\u01b0 Claude v\u00e0\u00a0Gemini<\/a>\u00a0\u0111\u1ec3 th\u1ef1c hi\u1ec7n trinh s\u00e1t c\u0169ng nh\u01b0 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u.<\/p>\n

<\/p>\n

Theo b\u00e1o c\u00e1o, Wiz x\u00e1c \u0111\u1ecbnh h\u01a1n 2.300 secret b\u1ecb r\u00f2 r\u1ec9 trong c\u00e1c kho l\u01b0u tr\u1eef nh\u01b0 v\u1eady v\u00e0 h\u01a1n 1.700 ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 b\u1ecb l\u1ed9 th\u00f4ng tin trong cu\u1ed9c t\u1ea5n c\u00f4ng. Wiz gi\u1ea3i th\u00edch: \u201cM\u1ed7i ng\u01b0\u1eddi d\u00f9ng \u0111\u00f3 s\u1ebd c\u00f3 \u00edt nh\u1ea5t m\u1ed9t token GitHub trong d\u1eef li\u1ec7u b\u1ecb r\u00f2 r\u1ec9, v\u00ec \u0111\u00f3 l\u00e0 \u0111i\u1ec1u ki\u1ec7n ti\u00ean quy\u1ebft \u0111\u1ec3 t\u1ea1o kho l\u01b0u tr\u1eef\u201d. Tuy nhi\u00ean, c\u00f4ng ty an ninh m\u1ea1ng n\u00e0y cho bi\u1ebft t\u1ed5ng s\u1ed1 ng\u01b0\u1eddi d\u00f9ng t\u1ea3i xu\u1ed1ng phi\u00ean b\u1ea3n Nx \u0111\u1ed9c h\u1ea1i v\u00e0 th\u1ef1c thi ch\u00fang tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a h\u1ecd c\u00f3 th\u1ec3 cao h\u01a1n nhi\u1ec1u.<\/p>\n

Sau khi token NPM, g\u00f3i Nx \u0111\u1ed9c h\u1ea1i b\u1ecb thu h\u1ed3i x\u00f3a kh\u1ecfi kho l\u01b0u tr\u1eef, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 b\u1eaft \u0111\u1ea7u m\u1ed9t giai \u0111o\u1ea1n t\u1ea5n c\u00f4ng m\u1edbi. Trong giai \u0111o\u1ea1n th\u1ee9 hai n\u00e0y, tin t\u1eb7c \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c secret b\u1ecb x\u00e2m ph\u1ea1m \u0111\u1ec3 truy c\u1eadp v\u00e0o 480 t\u00e0i kho\u1ea3n (bao g\u1ed3m kho\u1ea3ng 300 t\u00e0i kho\u1ea3n li\u00ean quan \u0111\u1ebfn c\u00e1c t\u1ed5 ch\u1ee9c) v\u00e0 c\u00f4ng khai h\u01a1n 6.700 kho l\u01b0u tr\u1eef ri\u00eang t\u01b0, s\u1eed d\u1ee5ng l\u01b0\u1ee3c \u0111\u1ed3 \u0111\u1eb7t t\u00ean \u201cs1ngularity-repository-#5letters#\u201d.<\/p>\n

“Trong m\u1ed9t tr\u01b0\u1eddng h\u1ee3p \u0111\u01b0\u1ee3c ch\u00fang t\u00f4i ghi nh\u1eadn, m\u1ed9t t\u1ed5 ch\u1ee9c \u0111\u00e3 b\u1ecb r\u00f2 r\u1ec9 h\u01a1n 700 kho l\u01b0u tr\u1eef. GitHub cu\u1ed1i c\u00f9ng c\u0169ng \u0111\u00e3 x\u00f3a c\u00e1c kho l\u01b0u tr\u1eef n\u00e0y\u201d, Wiz l\u01b0u \u00fd. Ti\u1ebfp theo, k\u1ebb t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng hai t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng b\u1ecb x\u00e2m ph\u1ea1m \u0111\u1ec3 c\u00f4ng b\u1ed1 h\u01a1n 500 kho l\u01b0u tr\u1eef li\u00ean quan \u0111\u1ebfn m\u1ed9t doanh nghi\u1ec7p. C\u00e1c kho l\u01b0u tr\u1eef n\u00e0y c\u00f3 h\u1eadu t\u1ed1 t\u00ean l\u00e0 _bak v\u00e0 m\u00f4 t\u1ea3 l\u00e0 \u201cS1ngularity\u201d.<\/p>\n

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u l\u01b0u \u00fd, trong giai \u0111o\u1ea1n \u0111\u1ea7u c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng, \u00edt nh\u1ea5t ba ph\u1ea7n t\u1eed ri\u00eang bi\u1ec7t \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o c\u00e1c g\u00f3i Nx \u0111\u1ed9c h\u1ea1i, \u0111i\u1ec1u n\u00e0y gi\u1ea3i th\u00edch cho c\u00e1c bi\u1ebfn th\u1ec3 \u0111\u1eb7t t\u00ean s1ngularity-repository \u0111\u01b0\u1ee3c quan s\u00e1t th\u1ea5y trong cu\u1ed9c t\u1ea5n c\u00f4ng. M\u1eb7c d\u00f9 c\u1ea3 ba \u0111\u1ec1u ch\u1ee9a code \u0111\u1ec3 nh\u1eadn d\u1ea1ng c\u00e1c CLI AI ph\u1ed5 bi\u1ebfn, ch\u00fang \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c l\u1eddi nh\u1eafc kh\u00e1c nhau \u0111\u1ec3 c\u1ed1 g\u1eafng \u201c\u00e9p bu\u1ed9c\u201d c\u00e1c c\u00f4ng c\u1ee5 AI t\u00ecm ki\u1ebfm d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m.<\/p>\n

\u201cCh\u00fang t\u00f4i ph\u00e1t hi\u1ec7n d\u01b0\u1edbi 100 secret h\u1ee3p l\u1ec7 trong 20.000 t\u1ec7p b\u1ecb r\u00f2 r\u1ec9. Ph\u1ea7n l\u1edbn c\u00e1c secret n\u00e0y d\u00e0nh cho c\u00e1c d\u1ecbch v\u1ee5 AI (Langsmith, Anthropic, OpenAI) v\u00e0 n\u1ec1n t\u1ea3ng\u00a0\u0111\u00e1m m\u00e2y<\/a>\u00a0(AWS, Azure, Vercel). Ch\u00fang t\u00f4i v\u1eabn ch\u01b0a ghi nh\u1eadn b\u1ea5t k\u1ef3 v\u1ee5 r\u00f2 r\u1ec9 n\u00e0o li\u00ean quan \u0111\u1ebfn\u00a0ti\u1ec1n \u0111i\u1ec7n t\u1eed<\/a>\u00a0th\u00e0nh c\u00f4ng\u201d, Wiz chia s\u1ebb.<\/p>\n

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u ch\u1ec9 ra r\u1eb1ng nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 chuy\u1ec3n \u0111\u1ed5i ho\u1ea1t \u0111\u1ed9ng x\u00e2m nh\u1eadp t\u1eeb xa th\u00f4ng qua webhook[.]site, v\u1ed1n \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 x\u00e2m ph\u1ea1m token NPM c\u1ee7a Nx, sang ch\u1ec9 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u n\u1ebfu c\u00f3 CLI v\u00e0 c\u00f3 th\u1ec3 t\u1ea1o kho l\u01b0u tr\u1eef c\u00f4ng khai tr\u00ean t\u00e0i kho\u1ea3n n\u1ea1n nh\u00e2n.<\/p>\n

\u201cCh\u00fang t\u00f4i tin r\u1eb1ng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 t\u1ed1i \u01b0u h\u00f3a b\u1ea3o m\u1eadt ho\u1ea1t \u0111\u1ed9ng c\u1ee7a ch\u00fang. C\u1ea3 hai c\u01a1 ch\u1ebf tr\u00edch xu\u1ea5t d\u1eef li\u1ec7u \u0111\u1ec1u h\u1ea1n ch\u1ebf \u0111\u00e1ng k\u1ec3 kh\u1ea3 n\u0103ng b\u1ecb t\u1ea5n c\u00f4ng, v\u00ec ch\u00fang kh\u00f4ng c\u1ea7n ph\u1ea3i s\u1edf h\u1eefu b\u1ea5t k\u1ef3 c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng n\u00e0o. Webhook[.]site \u0111\u00e3 h\u1eefu \u00edch trong cu\u1ed9c x\u00e2m nh\u1eadp ban \u0111\u1ea7u, nh\u01b0ng gi\u1edbi h\u1ea1n ng\u01b0\u1eddi d\u00f9ng \u1ea9n danh \u1edf m\u1ee9c 100 b\u1ea3n ghi, bu\u1ed9c k\u1ebb t\u1ea5n c\u00f4ng ph\u1ea3i s\u1eed d\u1ee5ng m\u1ed9t c\u01a1 ch\u1ebf tr\u00edch xu\u1ea5t d\u1eef li\u1ec7u thay th\u1ebf do s\u1ed1 l\u01b0\u1ee3ng n\u1ea1n nh\u00e2n qu\u00e1 l\u1edbn\u201d, Wiz gi\u1ea3i th\u00edch, \u0111\u1ed3ng th\u1eddi l\u01b0u \u00fd kho\u1ea3ng 100 token NPM duy nh\u1ea5t (h\u01a1n 40% s\u1ed1 token NPM b\u1ecb r\u00f2 r\u1ec9 trong giai \u0111o\u1ea1n \u0111\u1ea7u c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng) v\u1eabn c\u00f2n hi\u1ec7u l\u1ef1c. M\u1eb7t kh\u00e1c, ch\u1ec9 c\u00f3 5% s\u1ed1 token GitHub b\u1ecb x\u00e2m ph\u1ea1m c\u00f2n ho\u1ea1t \u0111\u1ed9ng.<\/p>\n<\/article>\n","protected":false},"excerpt":{"rendered":"

\u00a0H\u1ed3ng \u0110\u1ea1t M\u1edbi \u0111\u00e2y, c\u00f4ng ty an ninh m\u1ea1ng Wiz (M\u1ef9) th\u00f4ng b\u00e1o, tin t\u1eb7c \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c th\u00f4ng tin b\u00ed m\u1eadt (secret) b\u1ecb \u0111\u00e1nh c\u1eafp trong cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng Nx g\u1ea7n \u0111\u00e2y, \u0111\u1ec3 t\u1eeb \u0111\u00f3 c\u00f4ng khai h\u01a1n 6.700 kho l\u01b0u tr\u1eef ri\u00eang t\u01b0. L\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a cu\u1ed9c t\u1ea5n […]<\/p>\n","protected":false},"author":20,"featured_media":46700,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,24,35],"tags":[],"class_list":["post-46699","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=46699"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46699\/revisions"}],"predecessor-version":[{"id":46701,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46699\/revisions\/46701"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/46700"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=46699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=46699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=46699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}