HackerNews中文版

向团队致以问候。贾斯廷很棒，我知道他们在这一切中一定感到压力很大。以下是我从波特（Porter）收到的电子邮件，已根据HN字符限制进行了删减。完整文本请见：https://gist.github.com/leetrout/2d172d2b95e8d24af0f3de0d0b03561e --- 发生了什么在2026年4月13日，波特团队检测到我们基础设施中一个过期的AWS访问密钥存在未经授权的活动。发现后，我们立即撤销了所有受影响的凭证，并启动了我们的事件响应流程，包括全面调查。自4月13日以来，我们在波特的网络和系统中没有发现进一步的未经授权活动。我们与Cloudflare和亚马逊密切合作，已基本完成对我们环境的调查，并继续优先支持客户的响应工作。我们确定，威胁行为者在2026年4月11日03:23 UTC至2026年4月13日15:24 UTC之间进行活动。在此期间，威胁行为者利用波特基础设施中的IAM角色链访问了21个客户的云账户。目标组中的一些客户确认成功获取了集群中的机密。对于这些用户，目前没有证据表明机密被滥用或采取了其他超出通过此角色链获取机密的行动。特别是，没有证据表明这些用户的客户基础设施被未经授权地修改。通过相同的初始访问，威胁行为者访问了波特GitHub应用的凭证。与GitHub团队合作后，我们了解到对一些用户的GitHub API端点发出了请求。我们随后确认有三个客户的代码库被克隆。用户配置的Helm覆盖和波特集成的凭证，包括少量用户的Slack和AI集成，也被暴露。本周，所有拥有此类凭证的用户已被直接通知。 [省略] 在此后的几天里，我们已： - 轮换了所有剩余的波特AWS访问密钥，包括那些尚未确认受影响的密钥 - 在所有波特AWS账户中部署了额外的日志记录和监控 - 建立了端点检测和响应、额外的实时警报、事件响应保留协议，以及与外部安全公司进行的24小时监控 - 进一步限制了入站网络流量 - 邀请Cloudflare、Latacora和AWS对我们的配置进行审计我们将在后续的详细报告中覆盖我们正在进行的补救措施的全部范围，包括消除长期存在的访问密钥、实施最小权限、限制角色链以及扩展威胁检测。波特客户应采取的措施我们已根据客户的暴露程度向所有客户传达了量身定制的行动项。以下一般步骤适用于所有人： - 审查GitHub活动日志 [省略] 需要关注的关键事件： - 意外的代码库克隆（“git.clone”事件） - 新的部署密钥或SSH密钥添加到代码库 - 不认识的OAuth应用授权 - 对分支保护规则或Webhook配置的更改 - 轮换第三方凭证 - 轮换自2026年4月14日以来未更新的任何波特集成的凭证，包括Slack、警报服务和AI支持。如有需要，请联系安全公司。 [省略] 接下来会发生什么此次事件源于一个过期的、权限过大的访问密钥。我们的补救工作专注于消除导致此次泄露的条件，而不仅仅是针对被利用的特定途径。我们将在接下来的几周内分享一份详细的报告，涵盖我们的补救措施和加强基础设施的持续努力。我们还打算定期更新我们的安全态势，以保持透明。 [省略]

查看原文

Hug ops to the team. Justin is great and I know they have to be stressed from all of this.Email I got from Porter follows, trimmed for HN character limit. Full text at https://gist.github.com/leetrout/2d172d2b95e8d24af0f3de0d0b03561e---What happenedOn April 13th, 2026, the Porter team detected unauthorized activity originating from a stale AWS access key in our infrastructure. Upon detection, we immediately revoked all affected credentials and engaged our incident response processes, which included a comprehensive investigation.Since April 13th, we have seen no further evidence of unauthorized activity within Porter networks and systems. Working closely with Cloudflare and Amazon, we have substantially completed the investigation of our environment and are continuing to prioritize supporting customers in their response efforts.We have determined that the threat actor operated between 03:23 UTC April 11, 2026 and 15:24 UTC April 13, 2026. During this window, the threat actor leveraged IAM role chaining from Porter's infrastructure to access 21 customer cloud accounts. A few customers within the targeted group confirmed successful retrieval of on-cluster secrets. For these users, we currently have no evidence that secrets were abused or that other actions were taken beyond secret retrieval through this role chain. In particular, there was no evidence of any unauthorized modification of customer infrastructure for any of these users. Via the same initial access, the threat actor accessed credentials for the Porter GitHub App. Working with the GitHub team, we learned that requests were made to GitHub API endpoints for some users. We have since received confirmation that three customer repositories were cloned. User-configured Helm overrides and credentials for Porter integrations, including Slack and AI integrations for a limited number of users, were also exposed. All users with such credentials were directly informed this week.[snip]In the days since, we have:Rotated all remaining Porter AWS access keys, including those not known to be affected Deployed additional logging and monitoring across all Porter AWS accounts Established endpoint detection and response, additional real-time alerting, an incident response retainer, and 24x7 monitoring with an outside security firmFurther restricted ingress network trafficEngaged Cloudflare, Latacora, and AWS to audit our configurationsWe will cover the full scope of our ongoing remediation, including elimination of long-lived access keys, least-privilege enforcement, role chaining restrictions, and expanded threat detection in a detailed write-up to follow.What Porter customers should doWe have communicated tailored action items to all customers based on their levels of exposure. The following general steps apply to everyone:Review GitHub activity logs[snip]Key events to look for:Unexpected repository clones ("git.clone" events)New deploy keys or SSH keys added to repositoriesOAuth application authorizations you don't recognizeChanges to branch protection rules or webhook configurationsRotate third-party credentialsRotate credentials for any Porter integrations, including Slack, alerting services, and AI support, that have not been updated since April 14, 2026.Engage a security firm if needed[snip]What comes nextThe incident resulted from a stale, overprivileged access key. Our remediation is focused on eliminating the conditions that made this compromise possible, not just the specific vector that was exploited.We will share a detailed write-up in the coming weeks covering our remediation and ongoing efforts to harden our infrastructure. We also intend to establish regular transparency updates on our security posture moving forward.[snip]

告诉HN：Porter（YC S20）发生安全事件