Epusami na mbalakaka .env Sekele to bafungola ya AWS mpo na Repo ya GitHub ya bato nyonso: Mpo na nini kosilisa fisyé ebombaka yango te¶

Kososola segɔnde zomi nsima ya kopota mbangu git push origin main (to kobalusa ebombelo ya moto ye moko na Public) ete commit na yo ezalaki na makomi ya polele .env fisyé, AWS moko AKIA... Fungola ya bokɔti mpe Fungola ya Sekele, fungola ya OpenAI/Anthropic API, Stripe sk_live_... jeton ya production, URI ya base de données PostgreSQL/MongoDB na mot de passe, to oyo ezali chiffré te $HOME/.ssh/id_ed25519 clé privée ezali likambo ya mbalakaka ya cybersécurité oyo ezali na ba alarmes mitano. Ba botnets automatisés oyo ezwamaka na ba credentiels esala sondage na public GitHub Events Firehose (api.github.com/events) mpe clone ba commits ya sika oyo epusami na kati ya 1,5 à 4 secondes ya yo git push kosilisa. Mabe koleka, presque développeur nionso oyo azali panique asalaka exactement même erreur fatale: ba supprimer ba... .env fichier localement, bakisa .env mpo na .gitignore, mpe kotindika commit ya mibale oyo ezali na motó ya likambo "remove .env" to mpe "oops". Kopusaka commit ya mibale oyo elongolaka .env ebombaka eloko te: sekele ya makomi ya pɛtɛɛ etikalaka 100 % oyo ekoki kotángama mpo na libela na kati ya diff ya commit ya liboso (git log -p), mpe ata soki ozali kotinda na makasi (git push --force) likolo ya filiale, commit oyo ezali na référence te (dangling blob) etikali accès public na nzela ya URL na yango ya GitHub direct mpe ba vues ya Pull Request oyo e caché tii tango ekolongolama polele. Soki credentiel oyo efutamaki esi esalelami na ba attaquants mpo na ko déployer ransomware, ko détourner domaine DNS na yo, to kokanga locataire na yo ya cloud, consulter ba guides na biso ya moninga na ransomware mpe eyano ya ba malware, . ko détourner kombo ya domaine, DNS oyo esilaki, mpe kozua site internet, mpe Google Workspace to Microsoft 365 lockout ya administrateur ya domaine personnalisé. Soki fuite ya credentielle esali impact na sécurité ya ba malades ya lopitalo, ba contrôles physiques industriels, to ba infrastructures ya dispatch ya urgence, benga numéro d’urgence ya esika ofandi (911 na États-Unis mpe na Canada, . 112 na Union européenne mobimba, . 999 na Royaume-Uni) to tala buku na biso ya mokili mobimba ya banimero ya mbalakaka.

Sala boye sikoyo¶

1. REVOKER, DEACTIVATE, ET ROTATE secret nionso oyo e exposé na console ya fournisseur LIBOSO - na kati ya 120 secondes ya liboso - avant ya ko perdre seconde moko na course git commandes: Soki sekele esimbaki ebombelo ya bato banso ya GitHub, GitLab, to Bitbucket mpo na ata 3 secondes, talela fungola wana lokola eziki mpo na libela mpe esi ezali na maboko ya ba attaquants automatiques. Motango moko te ya git reset --hard, . git push --force, to kosilisa ebombelo ekoki kosilisa fungola moko na base de données ya bot ya scraper oyo esi e téléchargé commit na yo na seconde #2. Kota na AWS IAM, Stripe, OpenAI, ba consoles ya base de données, to ba paramètres ya GitHub SSH sikoyo mpe Ko désactiver / Effacer / Rouler clé mbala moko.
2. Kosala audit ya ba Logs na yo ya Facturation ya Cloud mpe ya Audit (AWS CloudTrail, . GCP Cloud Audit Logs, . Stripe Logs) mpo na lininisa oyo ezali kati na yo git push mpe revocation ya clé na yo: Ba bots ya cryptomining automatique esalelaka fuite AWS_ACCESS_KEY_ID (AKIA...) ba credentiels na kati ya 30 à 90 secondes mpo na ko spin up ba instances ya GPU ya quota maximum (p4d.24xlarge / . g5.48xlarge) na kati ya bitúká nyonso ya AWS oyo ebombami (ap-east-1, . me-south-1, . af-south-1) mpe kosala basaleli ya IAM ya porte ya sima to Lambda ba crochets ya persistance po etikala na kati ya compte AWS na yo ata sima ya ko effacer clé oyo e fuite.
3. JAMAIS kotindika ata seconde moko "Delete .env" commit - na bosolo, kokoma na masini "delete secret" to mpe "remove password" na message ya commit ebendaka ba bots ya scraper ciblé: Bankoto ya ba scripts ya acteur ya menace etuna mpenza GitHub Search mpo na ba messages ya commit oyo ezali na "remove .env", . "delete key", . "oops", mpe "remove credentials", na nsima finá commit moko na nsima na lisolo mpo na koyiba fungola.
4. Kokoma lisusu lisolo mobimba ya ebombelo ya Git na esika na yo na kosalelaka git filter-repo (to BFG Repo-Cleaner) mpo na kolongola fisyé to kobongola molongo ya mot de passe uta na commit, nzete, mpe tag nyonso ya lisolo:: git filter-branch ezali officiellement déprequé na projet Git; kosalela ** .git filter-repo --invert-paths --path .env** (ko nuke fichier moko na ba commits nionso) to git filter-repo --replace-text expressions.txt (mpo na kozongisa ba chaînes ya mot de passe ya sikisiki na ***REMOVED*** na kati ya ba fichiers ya code sans ko effacer ba fichiers).
5. Force-push ba branches nionso na ba tags (git push origin --force --all), MPE kopɛtola ba vues ya commit caché ya côté serveur ya GitHub (dangling commits): Tala secret oyo ba développeurs mingi bayebi te: ata sima ya kokima git filter-repo mpe git push --force, Ba serveurs ya GitHub ebatelaka SHA ya commit ya kala na bomoi na cache ya objet na bango (git cat-file), elingi koloba moto nyonso oyo akomaki SHA ya commit ya bilembo 40 uta na API ya Makambo ya bato banso akoki kaka kotala github.com/user/repo/commit/<OLD_SHA>. Tozali kolimbola awa na nse ndenge ya kopɛtola mbala moko ba caches ya commit oyo ezali kokangama na nzela ya GitHub Support / API to na kolongolaka mpe kosala lisusu ebombelo.
6. Botia moko ya mboka pre-commit scanner ya sekele (gitleaks to mpe trufflehog) na kati .git/hooks/pre-commit liboso ya kokoma ligne mosusu ya code: A 10-second gitleaks protect --staged crochet pré-commit e inspectaka chaque ligne étape localement na ordinateur portable na yo na ba blocs git commit liboso ete sekele moko ebima mokolo mosusu na masini na yo.

Nzete ya mokano: bokangami ya mbala moko, bobaluki, mpe bopetoli ya lisolo ya Git¶

Exécuter flux de travail oyo na ordre chronologique strict (Revoquer LIBOSO -> Persistance ya audit SECOND -> Purge Histoire ya Git YA MISATO):

flowchart TD
    Start["Sekele epusami na Repo ya bato banso (.env, Fungola AWS/GCP, Mot de passe ya DB, Fungola Stripe/OpenAI, to Fungola SSH privée)"] --> Step1["MINUTE 0 À 2 (PRIORITÉ #1): Revoquer / Rouler Clé Nionso Exposée na Console ya Fournisseur Mbala moko"]

    Step1 --> SecretType{"Lolenge nini ya Credentiel Ezalaki Na kati ya Commit?"}

    SecretType -->|"Fungola ya infrastructure ya lipata (AWS AKIA, JSON ya compte ya service ya GCP, Azure SP)"| CloudAudit["MINUTE 2 TI 10: Vérifier CloudTrail / Activité Logs -> Kosilisa ba instances ya EC2/Computer ya mabe na ba régions nionso -> Kolongola ba usagers/Roles/STS ya IAM oyo bapesameli ndingisa te"]

    SecretType -->|"URI / Mot de passe ya base de données (Postgres, MySQL, MongoDB, Redis, Supabase)"| DBAudit["MINUTE 2 TI 10: Kobalusa Mot de passe ya mosaleli ya DB + Koboma ba Connexions actives (pg_terminate_backend) + Kokanga Groupe ya Sécurité ya Firewall na ba IP oyo ezali na liste blanche Kaka"]

    SecretType -->|"Token ya API to Fungola SSH (Stripe, OpenAI, GitHub PAT, Slack, Fungola SSH privée)"| TokenAudit["MINUTE 2 TI 10: Rouler Fungola API na Tableau de bord / Longola Fungola SSH ya bato banso na $HOME/.ssh/authorized_keys & Paramètres ya GitHub -> Audit ba journals ya bosaleli ya API ya sika"]

    CloudAudit --> RepoVisibility{"MINUTE 10 TI 20: Ndenge nini olingi ko purger ebombelo ya GitHub?"}
    DBAudit --> RepoVisibility
    TokenAudit --> RepoVisibility

    RepoVisibility -->|"100% Cache-Wipe ya mbangu koleka (Issue ya critique te/Histoire ya étoile te ya kobomba)"| NukeRepo["1. Bolongola Ebombelo mobimba na Paramètres ya GitHub. 2. Tambwisa git filter-repo Localement mpo na kosukola Histoire. 3. Kosala Fresh Repo & Push Clean History (Ebebisaka mbala moko ba SHA nionso ya Commit oyo e caché)"]

    RepoVisibility -->|"Esengeli Kobatela ba Stars ya Repo oyo ezali, ba Issues, ba PR, & ba fourchettes"| RewriteRepo["1. Tambwisa git filter-repo (--invert-banzela to --replace-text). 2. Tambwisa git push --force --nyonso & --ba tags. 3. Bokutana na Portal ya Lisungi / Lisungi ya GitHub mpo na kopɛtola Cache ya Dangling Commit SHA"]

Phase 1: Minute 0 à 2 - Fiche ya tricherie ya revocation ya mbala moko na Fournisseur¶

Kofungola te terminal mpo na kobunda na yango git rebase ntango bafungola na yo ya kobimisa ezali naino kosala. Finá mbala moko na mopesi oyo azwi mpasi na nse mpe boma liboso mokanda ya kondimama:

Phase 2: Minute 2 à 10 - Kotala soki ba attaquants basali déjà porte ya sima (AWS / Cloud Containment)¶

Soki ya yo e fuite .env fisyé ezalaki na Fungola ya Bokɔti ya AWS (AKIA...), Google Cloud Service Account JSON, to Azure Service Principal, kosilisa fungola oyo efutaki ezali kaka ndambo ya etumba. Esengeli o vérifier que bot automatique esalelaki ba 90 secondes wana te pona ko établir persistance na kati ya compte cloud na yo:

Audit forensique ya AWS ya 6 Points Post-Leak¶

1. Botala AWS CloudTrail -> Event history mpo na ba appels nionso ya API oyo esalemi na ba fuites Access Key ID:
2. Fungola AWS CloudTrail Console -> Lisolo ya makambo.
3. Bobongola dropdown ya boluki uta Botangi kaka na ** .Access key ID** mpe ko coller oyo e fuite AKIA... nsinga ya nsinga.
4. Tala événement nionso oyo e enregistrer depuis minute oyo okimaki git push. Concrètement luka: CreateUser, . CreateAccessKey, . AttachUserPolicy, . CreateRole, . AssumeRole, . GetSessionToken, . RunInstances (CE2), 1.1. RequestSpotInstances, . CreateFunction (Lambda), to mpe SendEmail (Esika ya mpamba ya SES).
5. Kolongola temporaire nionso oyo ezali active STS ba sessions oyo ebotami na mosaleli wana:
6. Ata sima ya ko effacer an AKIA... clé d’accès, soki mobundi abengi sts:GetSessionToken avant o supprimer clé, temporaire na bango ** .ASIA... jeton ya session etikalaka na nguya kino ngonga 36.**
7. Pona koboma ba temporaires nionso ya active STS jetons mpo na mosaleli wana ya IAM mbala moko, kende na IAM -> Users -> [Leaked User] -> Permissions -> Add inline policy mpe finá ** .Revoke sessions** (oyo ekangisaka explicite Deny * politique mpo na jeton nionso oyo ebimisami wapi aws:TokenIssueTime ezali liboso koleka sikoyo.).
8. Botala IAM -> Users mpe IAM -> Roles mpo na ba comptes ya sima oyo esalemi sika:
9. Bobongisa Ba usagers nionso ya IAM na Ntango ya bokeli. Bolongola mosaleli nyonso oyo oyebi te (admin-backup, . sys-monitor, . support-bot) mpe ko vérifier ba Trust relationships tab na Roles na yo ya IAM mpo na kozala sûr que attaquant abakisaki ID ya Compte AWS na ye moko ya libanda te ("Principal": {"AWS": "arn:aws:iam::999999999999:root"}) lokola mokambi ya eteyelo oyo batyelaka motema.
10. Salelá ** .AWS Resource Explorer to ** .EC2 Global View** mpo na kotala ba Régions NIONSO 30+ AWS mpo na ba cryptominers oyo ebombami**:
11. Ba attaquants rarement ba lancer ba instances ya cryptomining na us-east-1 esika okomona bango na tableau de bord na yo. Au lieu ya kosala bongo, ba lancer p4d, . g5, to c6i.32xlarge ba instances na ** .ap-southeast-3 (Jakarta), ** Ezali ndenge moko na .me-central-1 (Emirats Arabes Unis), il-central-1 (Tel Aviv), to ** .sa-east-1 (São Paulo)**.
12. Fungola ** .EC2 Console -> EC2 Global View** (oyo e scanner région nionso activée na tableau moko) mpe Terminate ba instances nionso oyo epesami ndingisa te mbala moko.
13. Fungola Cas ya Facturation ya Soutien ya AWS mbala moko soki ba instances ya rogue emati na facture:
14. Soki bot moko ebalukaki $8,000 ya ba instances ya EC2 GPU avant o terminer yango, ko paniquer te: une fois que o securiser compte, o supprimer clé, o activer root/IAM MFA, mpe alongolaki fungola na GitHub, fungola Comte AWS mpe Cas ya lisungi ya facturation kolimbola push ya GitHub ya mbalakaka mpe matambe na yo ya kobongisa. AWS epesaka mbala na mbala crédit ya bolimbisi ya facturation ya volonté ya mbala moko mpo na ba fuites ya clé ya GitHub na mbalakaka mbala moko équipe na bango ya sécurité e vérifier que ebombelo ezali propre.

Phase 3: Pourquoi ko supprimer fichier na Commit ya sika elongi te - pe ndenge nini kokoma lisusu histoire malamu na git filter-repo¶

1. Mpo na nini git rm .env && git commit -m "delete .env" ezali mpenza na ntina te¶

Git ezali système ya ba fichiers oyo ekoki kozala na adresse ya contenus kaka (Directed Acyclic Graph / DAG ya ba commits, banzete, mpe biloko ya blob): - Kanisa ete Komipesa A1B2C3 ebakisami .env (Blob 998877). - Kanisa 2 minutes après okimi mbangu git rm .env, bakisa .env mpo na .gitignore, mpe kofina Komipesa D4E5F6 **. - Ntango moto oyo azali kotala na liste ya ba fisyé ya lelo na lokasa na yo ya ebandeli ya GitHub akomona te .env, Komipesa A1B2C3 mpe Blob 998877 bazali naino eteni ya 100 % ya ebombelo. Moto nyonso oyo azali kotambola git clone ba téléchargements Blob 998877, moto nyonso oyo azali kofina tab "Commits" na GitHub akoki kofina A1B2C3 mpo na kotánga ya yo .env fisyé na makomi ya pɛtɛɛ, mpe bisaleli oyo esalemi na masini (trufflehog git https://github.com/user/repo) scanner commit historique moko na moko na 2 secondes.

2. Etape na Etape: Kolongola Fisyé to Molongo ya Sekele na Lisolo NIONSO Na Kosaleláká git filter-repo¶

Projet ya Git na GitHub ba recommander officiellement git-filter-repo (oyo ezwi esika ya oyo ya malembe, oyo ekoki kosala mabunga git filter-branch mpe ezali kutu flexible koleka BFG Repo-Cleaner).

1. Kotia na kati git-filter-repo (Ezwaka 5 secondes):

   # On macOS (Homebrew):
   brew install git-filter-repo
   
   # On Linux / Windows (via pip / apt):
   pip3 install git-filter-repo
   

2. Sala copie ya sauvegarde ya sécurité ya dossier ya ebombelo ya esika na yo yambo ya kokoma lisusu histoire:

   cp -r $HOME/projects/my-repo $HOME/projects/my-repo-backup
   cd $HOME/projects/my-repo
   

   (Note: Soki o déplacer déjà valide na yo .env dossier libanda, sala que ozala na copie propre ya .env ebombami na /tmp/.env.safe libanda ya repo, mpo git filter-repo ekopangusa .env uta na répertoire na yo ya mosala mpe.)
3. Pona Option A (Effacer Nzela ya Fichier mobimba lokola .env to mpe id_rsa) TO Option B (Kobongola ba chaînes secretes spécifiques na kati ya ba fichiers ya code):
4. Option A: Longola mobimba .env (to config/secrets.json) uta na commit nionso na histoire:

   git filter-repo --invert-paths --path .env --force
   

   (Mpo na nini --invert-paths? Kozanga --invert-paths, . git filter-repo --path .env ebombaka KAKA .env mpe elongolaka biloko mosusu nyonso. Kosangisa --invert-paths --path .env ayebisi Git a bomba nionso SAUF .env na kati ya ba commits nionso, ba branches, na ba tags.)
5. Option B: Bomba fichier ya code (app.py / . config.js), kasi kopangusa molongo ya sekele oyo ezali na code makasi na version historique nionso: Salá fisyé ya makomi /tmp/secrets-to-scrub.txt oyo ezali na molongo moko ya sekele (to regex) na molɔngɔ moko:

   AKIAIOSFODNN7EXAMPLE==>REDACTED_AWS_KEY
   sk_live_51NzExampleSecretKey999==>REDACTED_STRIPE_KEY
   regex:postgres:\/\/non_at_chars@==>postgres://REDACTED_DB_CREDENTIALS@
   

   Sikoyo kima mbangu git filter-repo --replace-text: 1 .

   git filter-repo --replace-text /tmp/secrets-to-scrub.txt --force
   shred -u /tmp/secrets-to-scrub.txt 2>/dev/null || rm -P /tmp/secrets-to-scrub.txt
   

6. Kobakisa .env mpo na .gitignore po o re-commettre yango te 5 minutes à partir ya sikoyo:

   echo ".env" >> .gitignore
   echo "*.pem" >> .gitignore
   git add .gitignore
   git commit -m "chore: update gitignore rules"
   

7. Bakisa lisusu télécommande na yo ya GitHub (git filter-repo alongolaka na nko origin lokola vérification ya sécurité) mpe force-push ba branches nionso na ba étiquettes:

   git remote add origin git@github.com:YOUR_USERNAME/YOUR_REPO.git
   git push origin --force --all
   git push origin --force --tags
   

Phase 4: Motambo ya cache ya GitHub oyo ebombami (Dangling Commits) mpe Ndenge ya kopɛtola yango¶

Tala réalité forensique critique oyo ekomami na GitHub's Official Docs (Kolongola ba données sensibles na ebombelo): - Ntango ozali kopota mbangu git filter-repo mpe git push origin --force --all, commit nionso na ebombelo na yo ezuaka hash ya sika ya 40 caractères SHA-1, mpe ya yo main pointeur ya filiale ekendeke na histoire ya sika ya peto. - NZOKA, serveur ya bobateli ya Git ya sima ya GitHub ezwa mbala moko TE bosoto-kozwa (git gc --prune=now) ba commit SHA ya kala, oyo ezangi référence. - Yango elingi koloba soki bot ya attaquant e enregistraki hash ya kala ya commit (e.g., a1b2c3d4...) uta na API ya GitHub Events ya bato banso ntango opusaki mpo na mbala ya liboso, bakoki kaka kofungwama https://github.com/YOUR_USERNAME/YOUR_REPO/commit/a1b2c3d4... na navigateur web nyonso mpe tala ya yo .env fichier ata APRES o force-pusé histoire propre. Mabe koleka, soki secret ebimaki na kati ya Pull Request, refs/pull/12/head ebatelaka commit wana libela ekoki kozuama.

Ndenge nini kobebisa ba commits cached/dangling na ba serveurs ya GitHub sikoyo:¶

1. Méthode 1 (Instant, 100% Complete Wipe - Meilleur soki repo ezali na ba Issues/PRs/Stars ya critique te):
2. Kende na ebombelo na yo na GitHub -> ** .Settings -> Défiler tii na nse (Danger Zone) -> Finá na esika bakomi Delete this repository** **.
3. Bosala ebombelo ya sika mpenza na nkombo moko mpenza na GitHub mpe botindika bopeto na bino git filter-repo ebombelo ya mboka na yango (git push -u origin main).
4. Kolongola ebombelo na GitHub ebukaka mbala moko botali nyonso ya web ya bato banso ya ba SHA ya kala ya commit oyo ekangami na caché (404 Not Found).
5. Méthode 2 (Kobatela minzoto, Makambo, mpe PR - Kosalela Lisungi ya GitHub / Cache Purge):
6. Ya liboso, kanga hash SHA ya 40 caractères exactes ya commit ya kala oyo ezalaki na secret (vérifier git reflog na dossier ya sauvegarde na yo to ba email na yo ya notification ya GitHub).
7. Fungola Lisungi ya GitHub (support.github.com) mpe kosalela Longola ba données sensibles / Purge cached commit views flux ya mosala (kosala référence na URL ya ebombelo mpe SHA(s) ya commit dangling ya sikisiki). Esaleli ya automatique ya GitHub Support esalaka na ngambo ya serveur ya mbala moko git gc cache purge oyo e invalider ba vues web caché na ba objets sans référence sans ko effacer ebombelo na yo.
8. Koyebisa ba camarades / collaborateurs nionso ya équipe na... git clone ya sika (JAMAIS git pull):
9. Yebisa développeur nionso ya équipe na yo: "Ko kima TE." git pull mpe kotindika." Soki moninga ya mosala oyo abendaki commit ya mabe liboso akimi git pull (oyo esangisaka histoire ya kala ya saleté na histoire ya sika oyo ekomami lisusu) mpe epusaka, bako puser oyo elongolami .env commit right back onto GitHub. Collaborateur nionso asengeli soit ko supprimer dossier local na bango pe kosala ya sika git clone, to kokima mbangu git fetch origin && git reset --hard origin/main.

Phase 5: Kopekisa ba fuites oyo ekoya libela (Gitleaks Pre-Commit Crochet & Protection ya poussée ya GitHub)¶

Zwá segɔnde 60 sikoyo mpo na kosala ete na matematiki ezala likoki te ya kosala lisusu sekele na mbalakaka:

1. Kofungola GitHub ya ofele "Push Protection for Yourself" na kati ya compte na yo mobimba ya GitHub:
2. Kende na GitHub Settings (paramètres ya profil personnel na yo, likolo na droite) -> Code security and analysis (to Code security).
3. Défiler na ** .Secret scanning -> Kofungola nzela Push protection for yourself** **.
4. Na oyo efungolami, ntango nyonso oyo ozali kopota mbangu git push uta na ordinateur nionso kino na n'importe quoi ebombelo ya leta to ya privé, serveur ya GitHub etalaka packfile na yo oyo ekoti yambo ya kondima poussée: soki emoni fungola AWS, fungola OpenAI, fungola Stripe, fungola SSH privé, to jeton Slack, GitHub eboyi git push kaka na terminal na yo avant que commit ekende en direct.
5. Kotia na kati gitleaks lokola moto ya mboka pre-commit crochet na ordinateur portable na yo:

   # Install gitleaks:
   brew install gitleaks   # (or download binary on Linux/Windows)
   
   # Add a pre-commit hook inside your repository (.git/hooks/pre-commit):
   cat << 'EOF' > .git/hooks/pre-commit
   # /usr/bin/env bash
   gitleaks protect --verbose --redact --staged
   if test $? -ne 0; then
     echo "COMMIT BLOCKED BY GITLEAKS: High-entropy secret or API key detected in staged changes."
     exit 1
   fi
   EOF
   chmod +x .git/hooks/pre-commit
   

Mituya ya mbalakaka ya etuka mpe ba protocoles ya agence¶

Soki push ya credentiel ya GitHub na mbalakaka ememi na intrusion sans autorisée na ba données personnelles réglementées (PII / . PHI), ba systèmes ya soins de santé, to ba infrastructures ya gouvernement, elandaka ba protocoles obligatoires ya notification ya violation:

• Etats-Unis na Canada:
• Bobateli ya bomoi ya mbalakaka / Bokangami ya ba infrastructures ya ntina: Benga 911 soki bobukani ya infrastructure etali misala ya lopitalo to ba contrôles ya sécurité physique.
• Agence ya bokengi ya cybersecurité mpe ya bokengi ya ba infrastructures (CISA) & FBI (IC3): Soki ba attaquants basalelaki ba touches ya cloud oyo efutamaki mpo na ko exfiltrer ba données to ko déployer ba malware ya extorsion, pesa rapport na CISA (1-844-Say-CISA / . cisa.gov/report) mpe Centre ya ba plaintes ya mbeba ya internet ya FBI (ic3.gov).
• SEC, FTC, & State Procureur Général Data violation Notification: Soki CloudTrail / ba journal ya accès na base de données elakisaka que adresse IP oyo epesami ndingisa te e accéder na ba données personnelles ya client (PII) to mikanda ya bokolongono (HIPAA ePHI) liboso ete fungola oyo efutamaki elongolama, tuna mbala moko na avocat ya mibeko na oyo etali ba calendriers ya notification ya l’état ya violation ya ba données mpe rapport ya fédéral HHS OCR / FTC Safeguards Rule.
• Centre canadien ya sécurité cybernétique: Benga 1-833-CYBER-88 (1-833-292-3788) to koyebisa kobuka mibeko ya bomoto na nse ya PIPEDA na Biro ya Commissaire ya confidentialité ya Canada (OPC).
• Royaume-Uni:
• Misala ya mbalakaka: Benga 999 (to 101 / Bokosi ya misala 0300 123 2040 mpe Centre national ya sécurité cybernétique / . NCSC na ncsc.gov.uk).
• Biro ya Commissaire ya sango (ICO - Fenêtre ya GDPR ya Royaume-Uni ya ngonga 72): Soki mokanda ya bondimi oyo efutamaki epesaki nzela na accès sans autorisation na ba données personnelles ya bavandi ya Royaume-Uni, Article 33 ya GDPR ya Royaume-Uni esengi koyebisa ICO (0303 123 1113) na kati ya ngonga 72 sima ya koyeba bobukami.
• Union européenne:
• Misala ya mbalakaka: Benga 112 na kati ya ba Etats membres nionso ya UE.
• GDPR Article 33 & Directive NIS2 Rapport ya ba incidents: Ba organisations oyo ezali na UE GDPR esengeli kotala soki exposition ya credentiel esalaki que ba violer confidentialité ya ba données personnelles (koyebisa ngonga 72 na Autorité nationale ya protection ya ba données / DPA), nzokande ba entités essentielles/importantes na se ya UE NIS2 Directive ekutani na mokolo ya suka ya kokebisa liboso ya ngonga 24 na ekolo na bango CSIRT (BSI na Allemagne, . ANSSI na France, . ACN na Italie) mpo na makambo minene oyo esalemaki na Internet.
• Australie na Nouvelle-Zélande:
• Misala ya mbalakaka: Benga 000 na Australie to ** .111** na Nouvelle-Zélande.
• Centre ya sécurité cybernétique ya Australie (ACSC) & Ba violations ya ba données oyo ekoki koyebisa (OAIC): Benga ** .1300 CYBER1 (1300 292 371)** mpo na eyano ya likambo, mpe kotala mikumba ya koyebisa na se ya Biro ya Commissaire ya sango ya Australie (OAIC) Ba violations ya ba données oyo ekoki koyebisa (NDB) scheme to Mobeko ya Nouvelle-Zélande mpo na kobatela makambo ya moto ye moko 2020 (Privacy Commissioner).
• Inde na Asie-Pacifique:
• Misala ya mbalakaka: Benga 112 na Inde (to 1930 mpo na cybercrime).
• CERT-Na Directive obligatoire ya rapportage ya ngonga 6 (India): Na se ya Equipe ya réponse d’urgence ya ordinateur indien (CERT-In) nzela ya kokende (No. 20(3)/2022-CERT-In), esengeli koyebisa na ** accès non autorisé na ba systèmes cloud/IT to ba fuites ya ba données oyo ezo affecter ba organisations na Inde na incident@cert-in.org.in na kati ya ngonga 6 sima ya bomonisami.

Mituna oyo batunaka mingi¶

Na supprimaki ba .env fichier mpe apusaki commit ya sika 30 secondes après erreur na ngai - nazali naino na besoin ya ko roter ba touches API na ngai na ba mots de passe ya base de données?¶

Oui, 100 pour cent - tourner clé moko na moko mbala moko sans exception. Boyekoli ya cybersécurité académique mpe télémétrie oyo euti na GitHub Secret Scanning endimisi ete ba bots automatiques oyo ezwamaka na ba credentiels elandaka flux public ya GitHub Events (api.github.com/makambo oyo ezali kosalema) na tango ya solo mpe kozwa ba commits ya sika oyo epusami na kati 1,5 kino 5 secondes. Mabe koleka, ko puser deuxième commit oyo e supprimer .env etikaka makomi mobimba ya polele .env fichier oyo efandi libela na kati ya histoire ya commit ya liboso diff - mpe ba bots mingi elukaka spécifiquement ba commits oyo e supprimer .env ba fichiers. Soki bapusani sekele moko na ebombelo ya bato nyonso ata na segɔnde moko, ekómaka na likama mpo na libela; kolongolama mpe kobalola mokanda ya bondimi na tableau de bord ya mopesi ezali eloko kaka moko oyo ebatelaka yo.

Est-ce que soki ebombelo ezalaki repo ya GitHub PRIVATE tango na committed ya .env dossier, pe nalingi kaka na nettoyer yango avant nasala repo public semaine prochaine?¶

Soki ebombelo ezalaki 100 pour cent Privé ntango mobimba (mpe ata ba apps moko te ya CI/CD ya bato mosusu oyo batyelaka motema te ezalaki na nzela ya kokɔta), ba bots ya scraper na API ya GitHub Events ya bato nyonso bazali na yango te amoni secret na yo nanu. Kasi, kolongolama kaka TE `.env` na commit ya sika et puis flip repo depuis Privé na Public. Moment oyo o flip dépôt privé na Public, ya ngo graphique ya commit historique mobimba ekomi public - mpe ba bots mbala moko e scanner ba commits nionso ya kala na repo public ya sika. Yambo ya kosala repo privée public, soit: (1) Kima git filter-repo --invert-banzela --nzela .env mpo na kolongola fisyé na ba commits nyonso ya lisolo (mpe kobalola bafungola ata ndenge nini mpo na kosala malamu), TO (2) Kosala kopi ya ba fisyé ya sika ya pɛto na dossier ya sika mpenza, kotambola git init na yango mpo na lisolo ya ebandeli ya 1-commit ya peto, mpe kobimisa ebombelo wana ya sika.

Pourquoi AWS e attache automatiquement politique oyo babengi AWSCompromisedKeyQuarantineV2 na mosaleli na ngai ya IAM, mpe mpo na nini nazali naino kozwa facture?¶

Po AWS esalaka partenariat directement na GitHub Secret Scanning, tango nionso an AKIA... fungola ebimaka na commit ya GitHub public, système ya sécurité automatique ya AWS e détectaka yango na ba minutes, efungoli ticket ya soutien, pe e attache politique géré AWSFungola oyo epekisamiQuarantineV2 (to V3) na mosaleli wana ya IAM. Politique wana ya quarantaine e bloquer ba actions dangereuses évidentes lokola ko lancer ya sika ec2:Kosala baInstances to kosilisa ba seau S3 - . kasi esilisaka TE ba instances EC2 oyo attaquant asilaki ko lancer na ba secondes 60 ya liboso avant politique attaché, mpe elongolaka te ba usagers ya IAM ya porte ya sima to ya tango moke STS ba sessions oyo attaquant asali déjà. Esengeli kaka o supprimer manuellement clé oyo e fuite, vérifier EC2 Botali ya mokili mobimba na kati ya ba régions nionso pona kosilisa ba instances ya rogue, pe ko vérifier CloudTrail ya kosala mpo na mbongwana ya IAM oyo epesami ndingisa te.

Bokeseni nini ezali kati na git filter-repo mpe BFG Repo-Cleaner, mpe mpo na nini nasengeli kosalela yango te git filter-branch?¶

git filtre-eteni-etape ezali script ya kala ya shell ya kala oyo etongami na ba versions ya liboso ya Git oyo ezali malembe mingi na ba dépôts ya minene, pete ya ko configurer mabe (kotika ba refs ya sauvegarde na kati ba refs/ya ebandeli/ . oyo ezali naino na basekele na yo.), mpe sikoyo enyataka likebisi ya koboya ya officiel oyo euti na Git oyo ezali koyebisa yo osalela yango te. Bango mibale git-filtre-repo ya kosala (ekomamaki na Python mpe endimami officiellement na ba mainteneurs ya Git ya moboko mpe GitHub) mpe BFG Repo-Mopɛtola (ekomami na Java/Scala) kotambolisa 10x kino 100x mbangu mpe kokoma lisusu na bopeto ba commits nionso, banzete, mpe ba balises. git-filtre-repo ya kosala ezali mingimingi kolinga mingi lelo mpo ete ebongoli ata commit na yo ya checked-out ya lelo (`HEAD`) kozanga kosenga liboso commit préliminaire separate.

Ndenge nini moto akoki kaka kotala commit na ngai oyo elongolami na GitHub sima ya ko kima git filter-repo mpe git push --force?¶

Na Git, . `git push --force` kaka ba mises à jour ya pointeur ya référence ya etape (`refs/heads/main`) . mpo na kolakisa monyololo na yo ya sika ya komipesa oyo ekomami lisusu; esalaka bongo te mbala moko kosukola biloko ya kala ya kosala oyo ezali na référence te ("dangling") oyo ebombami na ba serveurs ya sima ya GitHub. Soki bot moko e enregistraki hash SHA ya 40 caractères ya commit na yo ya ebandeli tango ebetaki API ya Events public, kokende directement na https://github.com/nkolo/repo/commit/<40-char-SHA> eko charger kaka commit orphelin wana uta na cache ya objet ya GitHub tiii tango bosangisi ya bosoto ekotambola. Pona ko nuke vue wana ya cache mbala moko, soit bolongola ebombelo na GitHub mpe bosala yango lisusu uta na repo ya esika na yo ya peto, to kotinda commit ya dangling SHA na Lisungi ya GitHub (`support.github.com`) . mpo na purge ya cache ya mbala moko côté serveur.

Est-ce que soki mutu asi a cliqué "Fork" na dépôt public na ngai avant na kima git filter-repo?¶

Oyo ezali ntina Etape 1 ezali ntango nyonso kolongolama mpe kobalola ba credentiels na tableau de bord ya mopesi: kopota mbangu git filtre-repo ya kosala mpe kotinda na makasi na ebombelo na yo moko akomaka lisusu TE ba commits na kati ya Fork indépendant ya mutu mususu ya ebombelo na yo (longola se soki olongoli ebombelo na yo mobimba ya moboti mpe okutana na Lisungi ya GitHub na oyo etali ba données sensibles na ba fourchettes). Soki olongoli ba touches AWS/API mpe o roter ba mots de passe ya base de données, copie nionso ya ya kala .env fisyé oyo efandi na kati ya base ya ba données ya fourchette to bot ya bato mosusu ekomi molongo ya ba caractères oyo ekufá, oyo ezali na ntina te oyo ekoki lisusu kokɔta na infrastructure na yo te.

Ba guides oyo etali yango¶

• Ransomware mpe malware: kokanga mpe kozongisa yango mbala moko
• Ko détourner kombo ya domaine, DNS oyo esilaki, mpe kozua site internet
• Google Workspace to Microsoft 365 lockout ya administrateur ya domaine personnalisé mpe kobikisa DNS
• Phishing mpe ba comptes compromis : blocage d’urgence
• rm -rf to Shift-Delete ya mbalakaka na Linux, macOS, to Windows: bozongisi mbala moko bobele botangi
• Mituya ya mbalakaka na kotalela mboka

Maziba mpe bokambi ya Leta¶

• Mikanda ya bokengi ya officiel ya GitHub (docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository): Kolongola ba données sensibles na ebombelo (git filter-repo, . BFG Repo-Cleaner, Purging ya Cache ya Dangling Commit, mpe Protection ya Push ya Scanning ya Sekele).
• Misala ya Internet ya Amazon (AWS) Buku ya koyanola na makambo ya bokengi (docs.aws.amazon.com/security/): Koyanola na bafungola ya bokɔti ya AWS IAM oyo emonisami polele (AWSCompromisedKeyQuarantineV2, Kolongolama mpo na mwa ntango STS Ba sessions na nzela ya aws:TokenIssueTime, mpe CloudTrail Audit forensique).
• Institut national ya ba normes mpe ya technologie (NIST) (Etats-Unis): Mokanda ya sipesiale 800-61 Rev. 2: Buku ya botangi ya makambo ya bokengi ya ordinateur & SP 800-57: Likanisi mpo na boyangeli bafungola (Bolongoli ya mikanda ya bondimi oyo ezali na likama mpe bobaluki ya cryptographique).
• Projet ya bokengi ya application Web ya polele (OWASP): Fuille ya tricherie ya gestion ya ba secrets (Kopekisa ba credentiels hardcoded, Pre-Commit Secret Scanning na Gitleaks/ .TruffleHog, mpe Injection Sekele ya Tango ya Kosala Ephémère).
• Agence ya cybersécurité mpe ya sécurité ya ba infrastructures (CISA) (Etats-Unis): Architecture ya référence technique ya sécurité cloud mpe playbook ya remediation ya credentiel compromis.