我意外地透露了我的Firebase项目证书，有人开始挖掘加密货币。攻击是多么？

发布于 2025-01-26 11:57:40 字数 392 浏览 2 评论 0原文

我忘了添加到gitignore文件中，其中包括：

{
  "type": 
  "project_id": ,
  "private_key_id": 
  "private_key":
  "client_email": 
  "client_id": 
  "auth_uri": 
  "token_uri": 
  "auth_provider_x509_cert_url": 
  "client_x509_cert_url": 
}

在同一天，有人使用我的项目创建了VM和我的加密货币（正如Google所说）。有人如何使用我的项目？我认为攻击者还需要Firebase凭证来造成一些伤害。我在Google帐户上没有发现任何可疑行为，用于登录Firebase，因此攻击者可以访问我的计算机（？）。

原文

I have forgot to add to gitignore file, which included:

{
  "type": 
  "project_id": ,
  "private_key_id": 
  "private_key":
  "client_email": 
  "client_id": 
  "auth_uri": 
  "token_uri": 
  "auth_provider_x509_cert_url": 
  "client_x509_cert_url": 
}

and on the same day someone used my project to create a VMs and mine crypto (as google said).
How is it possible that someone used my project? I thought that the attacker also needs Firebase credentials to do some harm. I didn't find any suspicious behavior on the google account used to login into firebase, so maybe attacker had access to my computer (?).

分享到QQ

分享到微博