答案已發布2 週前Last edited 上週17 來源

CISA GitHub 洩密事件：公開倉庫點樣暴露政府雲端金鑰同密碼

一名為 CISA 工作嘅承包商將包含明文密碼、AWS GovCloud 金鑰同多種存取 token 嘅 GitHub repository 設為公開，暴露政府系統憑證。[1][13] 名為「Private‑CISA」嘅倉庫內含數百 MB 內部運作檔案，包括部署配置、Kubernetes 檔案同身份驗證資料，涉及 CISA 同國土安全部系統。[2][8] 研究人員指出，如果部分憑證仍然有效，理論上可能可存取政府雲端基礎設施同內部系統。CISA 表示目前未有證據顯示出現實際入侵。[2][13]

使用 Studio Global AI 搜尋並查核事實瀏覽更多熱門頁面

1.2M0

Illustration representing a cybersecurity incident where government credentials were exposed in a public GitHub repository — How were sensitive credentials for the U.SA contractor’s public GitHub repository exposed sensitive credentials tied to CISA and DHS systems before the issue was discovered and removed.
AI 提示
Create a landscape editorial hero image for this Studio Global article: How were sensitive credentials for the U.S. cybersecurity agency CISA accidentally exposed on a public GitHub repository by a contractor, wh. Article summary: A CISA contractor reportedly left a public GitHub repository containing sensitive operational material and credentials tied to CISA/DHS systems, including AWS GovCloud keys, plaintext passwords, tokens, and internal conf. Topic tags: general, general web, user generated. Reference image context from search candidates: Reference image 1: visual subject "## ‘This kind of exposure happens with alarming frequency,’ said an expert; here’s what CSOs and CIOs should do to protect employees’ and contractors’ GitHub repositories. Until a" source context "Contractor's public GitHub account exposed GovCloud and CISA ..." Reference image 2: visual subject "# CISA Contracto
openai.com

美國負責網絡安全協調嘅聯邦機構 Cybersecurity and Infrastructure Security Agency（CISA） 最近爆出一宗頗為尷尬嘅安全事件：一名為該機構工作的承包商，意外將大量敏感憑證放入一個公開的 GitHub repository。雖然事件引起廣泛關注，但官方表示目前沒有證據顯示相關資料被惡意利用或導致真正入侵。

憑證點樣被公開

問題源自一個由 CISA 承包商維護嘅 GitHub 倉庫。該 repository 名為 「Private‑CISA」，但實際上卻被設定為公開，任何人都可以在 GitHub 上瀏覽或下載內容。

研究人員表示，這個倉庫至少公開存在了幾個月，期間一直包含與政府系統相關的大量內部資料，直到問題被上報後才被移除。

檔案中包含詳細文件與配置資料，顯示 CISA 如何建立、測試以及部署內部軟件與基礎設施。

Studio Global AI

Search, cite, and publish your own answer

Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.

使用 Studio Global AI 搜尋並查核事實

人們還問