{"id":105214,"date":"2022-09-29T15:36:37","date_gmt":"2022-09-29T13:36:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah"},"modified":"2022-09-29T15:36:37","modified_gmt":"2022-09-29T13:36:37","slug":"kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","title":{"rendered":"Kritiske s\u00e5rbarheder, der kompromitterer end-to-end kryptering i mange Matrix-klienter.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Udviklerne af platformen for decentraliseret kommunikation Matrix har advaret om opdagelse af kritiske s\u00e5rbarheder i bibliotekerne matrix-js-sdk, matrix-ios-sdk og matrix-android-sdk2, der g\u00f8r det muligt for serveradministratorer at udgive sig for andre brugere og l\u00e6se beskeder i chats med ende-til-ende kryptering (E2EE). S\u00e5rbarhederne skyldes fejl i de enkelte implementeringer af Matrix-protokollen og er ikke problemer i selve protokollen. I \u00f8jeblikket har projektet udsendt opdateringer til de problematiske SDK'er og de dele af klient-applikationer, der er bygget p\u00e5 deres basis.    <\/p>\n<p>For at gennemf\u00f8re et angreb med succes kr\u00e6ves der adgang til en hjemmestyret server, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2922\">server<\/a> (homeserver \u2014 server til opbevaring af historik og kunderegnskaber). Anvendelse af ende-til-ende-kryptering p\u00e5 klientsiden forhindrer administratoren <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3857\">server<\/a> i at blande sig i meddelelsesudvekslingen, men de identificerede s\u00e5rbarheder giver mulighed for at omg\u00e5 denne beskyttelse. Problemerne ber\u00f8rer den prim\u00e6re Matrix-klient Element (tidligere Riot) til web, desktop-systemer, iOS og Android, samt tredjeparts klientapplikationer, herunder Cinny, Beeper, SchildiChat, Circuli og Synod.im. S\u00e5rbarhederne optr\u00e6der ikke i bibliotekerne matrix-rust-sdk, hydrogen-sdk, Matrix Dart SDK, mautrix-python, mautrix-go og matrix-nio, samt i applikationerne Hydrogen, ElementX, Nheko, FluffyChat, Syphon, Timmy, Gomuks og Pantalaimon.      <\/p>\n<p>Tre hovedscenarier for angreb fremh\u00e6ves:  <\/p>\n<ul>\n<li class=\"l\"> En Matrix-serveradministrator kan bryde verifikationen baseret p\u00e5 emojis (SAS, Short Authentication Strings) ved brug af krydsunderskrifter og udgive sig for en anden bruger. Problemet skyldes en s\u00e5rbarhed (CVE-2022-39250) i koden af matrix-js-sdk, relateret til sammenblanding af behandling af enhedsidentiteter og krydsunderskriftsn\u00f8gler.\n<li class=\"l\"> En angrebsmand, der kontrollerer serveren, kan forfalske en betroet afsender og overlevere en falsk n\u00f8gle til at opfange beskeder fra andre brugere. Problemet skyldes en s\u00e5rbarhed i matrix-js-sdk (CVE-2022-39251), matrix-ios-sdk (CVE-2022-39255) og matrix-android-sdk2 (CVE-2022-39248), som f\u00e5r klienten til forkert at modtage adresserede beskeder til enhederne, som er krypteret ved brug af Megolm-protokollen i stedet for Olm, og tilskriver beskederne til afsenderen Megolm og ikke den faktiske afsender.\n<li class=\"l\"> Ved at udnytte de s\u00e5rbarheder, der n\u00e6vnes i det foreg\u00e5ende punkt, kan serveradministratoren ogs\u00e5 tilf\u00f8je en falsk n\u00f8gle til en brugerkonto for at hente n\u00f8gler, der bruges til at kryptere beskeder.    <\/ul>\n<p>Forskere, der har opdaget s\u00e5rbarheden, har ogs\u00e5 demonstreret angreb, der f\u00f8rer til tilf\u00f8jelse af en ekstern bruger til chatten eller tilknytning af en fremmed enhed til en bruger. Angrebene er baseret p\u00e5, at systemmeddelelserne, der bruges til at tilf\u00f8je brugere til chatten, ikke er bundet til n\u00f8glerne fra chatens skaber og kan genereres af serveradministratoren. Udviklerne fra Matrix-projektet har klassificeret disse s\u00e5rbarheder som mindre, da s\u00e5danne manipulationer ikke ville g\u00e5 ubem\u00e6rket hen \u2014 i tilf\u00e6lde af substituering af en bruger vil denne blive vist p\u00e5 brugerlisten i chatten, og ved tilf\u00f8jelse af en enhed vil en advarsel blive vist, og enheden vil blive markeret som usikker (uden at der straks efter tilf\u00f8jelsen til den subterfuge enhed begynder at blive sendt de delte n\u00f8gler, som er n\u00f8dvendige for at dekryptere meddelelser).<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57844\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u044b\u0434\u0430\u0432\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0447\u0438\u0442\u0430\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u0447\u0430\u0442\u0430\u0445 \u0441\u043e \u0441\u043a\u0432\u043e\u0437\u043d\u044b\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c (E2EE). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Matrix \u0438 \u043d\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430. \u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f, \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 SDK [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105214","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u0432\u043e\u0437\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 Matrix-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-09-29T13:36:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-09-29T13:36:37+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritiske s\u00e5rbarheder, der kompromitterer ende-til-ende kryptering i mange Matrix-klienter | ProHoster","description":"Udviklerne af den decentraliserede kommunikationsplatform Matrix har advarsel om opdagelsen af kritiske s\u00e5rbarheder i bibliotekerne matrix-js-sdk, matrix-ios-sdk og matrix-android-sdk2, som g\u00f8r det muligt for serveradministratorer.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u0432\u043e\u0437\u043d\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 Matrix-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 matrix-js-sdk, matrix-ios-sdk \u0438 matrix-android-sdk2, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/kriticheskie-uyazvimosti-komprometiruyushhie-skvoznoe-shifrovanie-vo-mnogih-matrix-klientah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-09-29T13:36:37+00:00","article:modified_time":"2022-09-29T13:36:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"105214","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:04","updated":"2026-02-22 15:31:01","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/105214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=105214"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/105214\/revisions"}],"predecessor-version":[{"id":162385,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/105214\/revisions\/162385"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=105214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=105214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=105214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}