加密貨幣挖礦正在殺死CI免費服務

{"type":"doc","content":[{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"由於加密貨幣挖礦攻擊，LayerCI、GitLab、TravisCI 以及 Shippable 等等 CI 提供商都在收緊或關閉其免費服務。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"2020 年 9 月，GitLab 宣佈免費 CI 產品將限制使用；兩個月之後，TravisCI 也宣佈對“重大濫用”採取類似的限制措施。爲什麼這些 CI 廠商都會限制免費 CI 產品的使用呢？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"深挖其背後原因，我們發現這些變化都與可挖礦加密貨幣的市值猛增有關。隨着加密貨幣的市值從 2021 年 1 月的 1900 億美元，激增至 2021 年 4 月的 2 萬億美元，一些企圖從可挖礦加密貨幣獲利的不良開發者將目光轉向了平臺提供商的免費 CI 服務。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/wechat\/images\/81\/810320123c2a3eb1f5649fd44bbb90d1.png","alt":null,"title":null,"style":null,"href":null,"fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":"center","origin":null},"content":[{"type":"text","text":"加密貨幣市值激增"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"加密貨幣礦工如何在 LayerCI 平臺“薅羊毛”？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在 LayerCI 平臺，開發者可以通過創建每個分支的預覽環境並自動運行端到端測試來構建全棧網站。由於之前，開發者可以在 LayerCI 的服務器上運行任意代碼，因此經常有人違反 LayerCI 服務條款來挖掘加密貨幣。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用戶名爲“ testronan”的開發者，是 Flask 的狂熱用戶，他們幾乎每一個小時就會提交一次 GitHub 存儲庫：testronan \/ MyFirstRepository-Flask。高產的程序員一般都會確保他們的代碼能夠得到良好的測試，因此我們發現他的存儲庫包含了五個不同的 CI 服務：TravisCI，CircleCI，GitHub Actions，Wercker 和 LayerCI。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"仔細觀察他的 CI 任務，我們發現這些 CI 任務看似是在運行 shell 腳本，實際運行的卻是“listen.sh”，一個將複雜的 NodeJS 腳本和一些看似隨機數結合在一起的 shell 腳本："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"perl"},"content":[{"type":"text","text":"(sleep 10; echo 4; sleep 2; echo \"tex.webd\";sleep 2; echo 7; sleep 1; echo 1; sleep 1; echo \"exit\"; sleep 2) | stdbuf -oL npm run commands\n\"; sleep 2) | stdbuf -oL npm run commandsundefined\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"撥開迷霧，我們發現 MyFirstRepository-Flask 與 Flask 或 Web 服務器無關，它是將 WebDollars 發送到匿名地址的加密貨幣挖掘腳本。這些數字對應 WebDollar 的 NodeJS 實現的安裝選項。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"該存儲庫不是直接攻擊 GitHub，而是濫用 GitHub action 的“ cron”功能來每小時創建一個新提交，並在其他四個 CI 提供程序上挖掘 WebDollars。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"接收這些 coin 的兩個錢包地址是："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/www.webdscan.io\/address\/WEBD%24gBJhmuwat3kvP2@%EF%BC%85232E4K2zXX967grh9L43%EF%BC%8524","title":"","type":null},"content":[{"type":"text","text":"https:\/\/www.webdscan.io\/address\/WEBD%24gBJhmuwat3kvP2@％232E4K2zXX967grh9L43％24"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/www.webdscan.io\/address\/WEBD%24gCszFRxzuMDbyNXnCXszoB2aIMSuV9kgbb%24","title":"","type":null},"content":[{"type":"text","text":"https:\/\/www.webdscan.io\/address\/WEBD%24gCszFRxzuMDbyNXnCXszoB2aIMSuV9kgbb%24"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"利用瀏覽器自動化來挖礦"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"“ vippro99”開發者的做法就沒有“testronan”那麼巧妙，數十個存儲庫幾乎大部分都與加密貨幣或瀏覽器自動化有關。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"nodejs-monney 存儲庫包含了各種腳本，可以通過 Google 流行的 puppeteer 項目啓動 chrome 實例。他的邏輯很簡單，如果直接在 CI 中挖掘加密貨幣是很容易被檢測到的，而瀏覽器自動化是 CI 中常見的功能，剛好可以用它來掩蓋。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"codeblock","attrs":{"lang":"typescript"},"content":[{"type":"text","text":"puppeteer.launch({ headless: true, args: ['--no-sandbox', '--disable-setuid-sandbox', '--window-size=500,500', '--user-agent=Mozilla\/5.0 (Macintosh; Intel Mac OS X 11_2_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/89.0.4389.90 Safari\/537.36' ] }).then(async browser => {\n console.log('-- Running chrome!!');\n const page = await browser.newPage();\n await page.goto('https:\/\/vippro99.github.io\/-meocoder-nodejs-tool\/index.html');\n page.on('console', (msg) => console.log(msg.text()));\n await page.waitForTimeout(((Math.floor(Math.random() * 6) + 52) * 60) * 1000);\n await browser.close();\n})\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"據悉，該賬戶目前正在攻擊 JFrog 的 Shippable CI 服務。我們在 Shippable 官網看到這樣一則通知：“Your Shippable service will expire on May 3rd, 2021.”不知道這個決定是否與加密貨幣挖礦有關。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"“ vippro99”提供的信息表明他們是在越南， 以 Monero 的當前價格，加密貨幣礦工在 Shippable 上的每個實例每月可以獲得 2.5 美元，只需要維護 60 個併發實例就可以與該國的全職薪資相當。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"加密貨幣和 CI 服務商是如何應對“薅羊毛”的？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"針對以上這些花樣百出的“薅羊毛”操作，加密貨幣和 CI 服務商是如何應對的呢？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"最近，以太坊（Ethereum）宣佈計劃完全禁用基於計算的挖礦來獲取新以太坊的方式，完全轉向 proof-of-stake (POS) validation model。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"而 CI 服務商的解決辦法基本都是收緊或者關閉免費服務。2020 年 10 月 1 日開始，GitLab.com 免費層上每個頂級組（或個人命名空間）的 CI \/ CD 使用時長減少到每月 400 分鐘，超出部分會以每 1000 分鐘 10 美元的價格收費，開發者也可以自己升級到付費基本；2020 年 11 月 1 日開始，TravisCI 重新制定了定價規則，對於擁有 1、2、或 5 個併發計劃的構建定價不變，基於 macOS 構建者的需要額外購買附加組件，同時也發佈了新的基於使用情況的定價規則。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"參考鏈接："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"https:\/\/layerci.com\/blog\/crypto-miners-are-killing-free-ci\/"}]}]}