{"id":53579,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah"},"modified":"2021-01-02T13:04:14","modified_gmt":"2021-01-02T11:04:14","slug":"ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","title":{"rendered":"\u00datok na HackerOne, kter\u00fd umo\u017enil p\u0159\u00edstup k uzav\u0159en\u00fdm zpr\u00e1v\u00e1m o zranitelnostech","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Platforma HackerOne, kter\u00e1 umo\u017e\u0148uje odborn\u00edk\u016fm na bezpe\u010dnost informovat v\u00fdvoj\u00e1\u0159e o nalezen\u00fdch zranitelnostech a z\u00edskat za to odm\u011bny, obdr\u017eela zpr\u00e1va<\/a><\/noindex> informaci o vlastn\u00edm \u00fatoku. Jednomu z odborn\u00edk\u016f se poda\u0159ilo z\u00edskat p\u0159\u00edstup k \u00fa\u010dtu bezpe\u010dnostn\u00edho analytika spole\u010dnosti HackerOne, kter\u00fd m\u00e1 mo\u017enost prohl\u00ed\u017eet uzav\u0159en\u00e9 materi\u00e1ly, v\u010detn\u011b informac\u00ed o je\u0161t\u011b neopraven\u00fdch zranitelnostech. B\u011bhem existence platformy bylo p\u0159es HackerOne odborn\u00edk\u016fm vyplaceno celkem 23 milion\u016f dolar\u016f za nalezen\u00ed zranitelnost\u00ed v produktech v\u00edce ne\u017e 100 klient\u016f, mezi kter\u00fdmi jsou Twitter, Facebook, Google, Apple, Microsoft, Slack, Pentagon a americk\u00e9 n\u00e1mo\u0159nictvo.<\/p>\n

Zaj\u00edmav\u00e9 je, \u017ee z\u00edsk\u00e1n\u00ed \u00fa\u010dtu bylo mo\u017en\u00e9 d\u00edky lidsk\u00e9mu faktoru. Jeden z odborn\u00edk\u016f zaslal k posouzen\u00ed \u017e\u00e1dost o potenci\u00e1ln\u00ed zranitelnost v HackerOne. Analytik HackerOne se b\u011bhem zpracov\u00e1n\u00ed \u017e\u00e1dosti pokusil reprodukovat navr\u017eenou metodu \u00fatoku, ale probl\u00e9m se mu nepoda\u0159ilo reprodukovat, a autoru \u017e\u00e1dosti byl zasl\u00e1n odpov\u011bdn\u00ed e-mail s \u017e\u00e1dost\u00ed o dal\u0161\u00ed podrobnosti. P\u0159i tom analytik nezaznamenal, \u017ee spolu s v\u00fdsledky ne\u00fasp\u011b\u0161n\u00e9ho vy\u0161et\u0159ov\u00e1n\u00ed omylem poslal obsah sv\u00e9 relace Cookie. Konkr\u00e9tn\u011b b\u011bhem dialogu analytik uvedl p\u0159\u00edklad HTTP po\u017eadavku proveden\u00e9ho pomoc\u00ed n\u00e1stroje curl, kter\u00fd obsahoval HTTP hlavi\u010dky, z nich\u017e zapomn\u011bl vy\u010distit obsah relace Cookie.<\/p>\n

Odborn\u00edk si t\u00e9to chyby v\u0161iml a dok\u00e1zal z\u00edskat p\u0159\u00edstup k privilegovan\u00e9mu \u00fa\u010dtu na str\u00e1nk\u00e1ch hackerone.com jednodu\u0161e t\u00edm, \u017ee vlo\u017eil hodnotu Cookie, kterou si v\u0161iml, bez nutnosti proch\u00e1zet v\u00edcefaktorov\u00fdm ov\u011b\u0159ov\u00e1n\u00edm poskytovan\u00fdm slu\u017ebou. \u00datok byl mo\u017en\u00fd, proto\u017ee na hackerone.com nebylo pou\u017eito v\u00e1z\u00e1n\u00ed relace na IP nebo prohl\u00ed\u017ee\u010d u\u017eivatele. Probl\u00e9mov\u00fd identifik\u00e1tor relace byl odstran\u011bn dv\u011b hodiny po publikaci zpr\u00e1vy o \u00faniku. Odborn\u00edkovi bylo rozhodnuto vyplatit 20 tis\u00edc dolar\u016f za informov\u00e1n\u00ed o probl\u00e9mu.<\/p>\n

HackerOne zah\u00e1jil audit za \u00fa\u010delem anal\u00fdzy mo\u017en\u00e9ho vzniku podobn\u00fdch \u00fanik\u016f Cookie v minulosti a k posouzen\u00ed potenci\u00e1ln\u00edch \u00fanik\u016f citliv\u00fdch \u00fadaj\u016f t\u00fdkaj\u00edc\u00edch se probl\u00e9m\u016f klient\u016f slu\u017eby. Audit neodhalil \u017e\u00e1dn\u00e9 \u00faniky v minulosti a zjistil, \u017ee v\u00fdzkumn\u00edk, kter\u00fd probl\u00e9m nahl\u00e1sil, mohl z\u00edskat informace o p\u0159ibli\u017en\u011b 5 % ze v\u0161ech program\u016f dostupn\u00fdch v slu\u017eb\u011b, ke kter\u00fdm m\u011bl p\u0159\u00edstup analytik, jeho\u017e session key byl pou\u017eit.<\/p>\n

Aby se zabr\u00e1nilo podobn\u00fdm \u00fatok\u016fm v budoucnu, byla implementov\u00e1na vazba session key na IP adresu<\/a> a filtrov\u00e1n\u00ed session key a autentifika\u010dn\u00edch token\u016f v koment\u00e1\u0159\u00edch. V budoucnu se pl\u00e1nuje nahradit vazbu na IP vazbou na za\u0159\u00edzen\u00ed u\u017eivatele, proto\u017ee vazba na IP je nepohodln\u00e1 pro u\u017eivatele s dynamicky p\u0159id\u011blovan\u00fdmi adresami. Tak\u00e9 bylo rozhodnuto roz\u0161\u00ed\u0159it syst\u00e9m log\u016f s informacemi o p\u0159\u00edstupu u\u017eivatel\u016f k dat\u016fm a implementovat model granula\u010dn\u00edho p\u0159\u00edstupu analytik\u016f k \u00fadaj\u016fm klient\u016f.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0435. \u041e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HackerOne, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0431 \u0435\u0449\u0451 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0417\u0430 \u0432\u0440\u0435\u043c\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0447\u0435\u0440\u0435\u0437 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53579","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na HackerOne, kter\u00fd umo\u017enil p\u0159\u00edstup k uzav\u0159en\u00fdm zpr\u00e1v\u00e1m o zranitelnostech | ProHoster","description":"Platforma HackerOne, kter\u00e1 umo\u017e\u0148uje odborn\u00edk\u016fm na bezpe\u010dnost informovat v\u00fdvoj\u00e1\u0159e o nalezen\u00fdch zranitelnostech a z\u00edskat za to odm\u011bny, obdr\u017eela","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 HackerOne, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0442\u0447\u0451\u0442\u0430\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-01-02T11:04:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53579","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-02-08 20:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=53579"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53579\/revisions"}],"predecessor-version":[{"id":157785,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53579\/revisions\/157785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=53579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=53579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=53579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}