{"id":76851,"date":"2020-04-05T07:42:20","date_gmt":"2020-04-05T05:42:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android"},"modified":"2020-04-05T07:42:20","modified_gmt":"2020-04-05T05:42:20","slug":"rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","title":{"rendered":"Resultaterne af analysen af bagd\u00f8re i Android-applikationer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Forskere fra Helmholtz Center for Informationssikkerhed (CISPA), Ohio State University og New York University <noindex><a rel=\"nofollow\" href=\"https:\/\/cispa.saarland\/2020\/04\/03\/hidden-functions-make-mobile-phone-apps-vulnerable-to-hackers.html\">et<\/a><\/noindex> unders\u00f8gelsen af skjulte funktioner i applikationer til Android-platformen. Analyse af 100.000 mobile applikationer fra Google Play-kataloget, 20.000 fra et alternativt katalog (Baidu) og 30.000 forudinstallerede applikationer p\u00e5 forskellige smartphones, udvalgt fra 1000 firmware fra SamMobile, <noindex><a rel=\"nofollow\" href=\"https:\/\/panda.moyix.net\/~moyix\/papers\/inputscope_oakland20.pdf\">hvordan det er let at f\u00e5 et EV-certifikat i navnet \"Stripe, Inc\" (et popul\u00e6rt betalingssystem) blot ved at registrere et selskab med samme navn i en anden stat. For at opdage forskellen skal man under alle omst\u00e6ndigheder se n\u00e6rmere p\u00e5 detaljer om hjemmesiden - oplysninger fra adresselinjen er ikke tilstr\u00e6kkelige. En anden forsker, James Burton, fik et certifikat i navnet p\u00e5 sit registrerede selskab \"Identity Verified\", hvilket ogs\u00e5 let kan forvirre brugerne.<\/a><\/noindex>, som 12706 (8.5%) programmer indeholder skjult funktionalitet, der ikke er synlig for brugeren, men kan aktiveres med specielle sekvenser, som kan betragtes som bagd\u00f8re. <\/p>\n<p>Specifikt inkluderede 7584 applikationer indbyggede adgangsn\u00f8gler, 501 \u2014 indbyggede masteradgangskoder, og 6013 \u2014 skjulte kommandoer. Problematisk software findes i alle de gennemg\u00e5ede programkilder \u2014 i procent udgjorde bagsiderne 6,86% (6860) af de studerede programmer fra Google Play, 5,32% (1064) fra alternative kataloger og 15,96% (4788) fra listen over forudinstallerede applikationer. De identificerede bagsider giver enhver, der kender n\u00f8glerne, aktiveringskoderne og sekvenserne til at kalde kommandoer, adgang til applikationen og alle tilknyttede data. <\/p>\n<p>For eksempel blev der i en applikation til streaming af sportskampe, som har 5 millioner installationer, fundet en indbygget n\u00f8gle til at f\u00e5 adgang til administratorgr\u00e6nsefladen, hvilket muligg\u00f8r \u00e6ndring af applikationsindstillingerne og adgang til yderligere funktionalitet. I en l\u00e5sesk\u00e6rmsapplikation med 5 millioner installationer blev der fundet en adgangsn\u00f8gle, der tillader nulstilling af den brugerdefinerede adgangskode til enheden. I en overs\u00e6ttelsesprogram med 1 million installationer er der en n\u00f8gle, der muligg\u00f8r k\u00f8b inden for applikationen og opgradering til pro-versionen uden faktisk betaling.<\/p>\n<p> I program for fjernstyring af mistede enheder, som har 10 millioner installationer, er der fundet en masterkode, der giver mulighed for at fjerne den l\u00e5s, som brugeren har sat i tilf\u00e6lde af tab af enheden. I programmet til at f\u00f8re en notesbog er der fundet en masterkode, der tillader opl\u00e5sning af hemmelige noter. I mange applikationer er der ogs\u00e5 opdaget fejlfindingstilstande, der \u00e5bner adgang til lavniveau funktioner, for eksempel i indk\u00f8bsapp'en blev en proxyserver aktiveret ved indtastning af en bestemt kombination, og i l\u00e6ringsprogrammet var der mulighed for at omg\u00e5 testene.<\/p>\n<p>Ud over bagd\u00f8re er der i 4028 (2,7%) applikationer identificeret tilstedev\u00e6relsen af sortlister, der anvendes til at censurere information modtaget fra brugeren. De brugte sortlister indeholder s\u00e6t af ord, der er forbudt at n\u00e6vne, herunder navne p\u00e5 politiske partier og politikere, samt standardfraser, der bruges til at skr\u00e6mme og diskriminere bestemte befolkningsgrupper. Sortlister er blevet identificeret i 1,98% af de unders\u00f8gte programmer fra Google Play, i 4,46% fra alternative kataloger og i 3,87% fra listen over forinstallerede applikationer.<\/p>\n<p>Til analysen er der brugt et v\u00e6rkt\u00f8j skabt af forskerne, InputScope, hvis kode snart vil v\u00e6re <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OSUSecLab\/InputScope\">udgivet<\/a><\/noindex> tilg\u00e6ngelig p\u00e5 GitHub (forskerne har tidligere offentliggjort en statisk analysator <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OSUSecLab\/LeakScope\">LeakScope<\/a><\/noindex>, som automatisk identificerer information l\u00e6kager i applikationer).<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52677\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android. \u0410\u043d\u0430\u043b\u0438\u0437 100 \u0442\u044b\u0441\u044f\u0447 \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 Google Play, 20 \u0442\u044b\u0441\u044f\u0447 \u0438\u0437 \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 (Baidu) \u0438 30 \u0442\u044b\u0441\u044f\u0447 \u043f\u0440\u0435\u0434\u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043d\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 1000 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u0441 SamMobile, \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e 12706 (8.5%) [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-76851","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Android | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-05T05:42:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-05T05:42:20+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Resultater af analysen af bagd\u00f8re i Android-applikationer | ProHoster","description":"Forskere fra Helmholtz Center for Informationssikkerhed (CISPA), Ohio State University og New York University","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Android | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0426\u0435\u043d\u0442\u0440\u0430 \u0413\u0435\u043b\u044c\u043c\u0433\u043e\u043b\u044c\u0446\u0430 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CISPA), \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0448\u0442\u0430\u0442\u0430 \u041e\u0433\u0430\u0439\u043e \u0438 \u041d\u044c\u044e-\u0419\u043e\u0440\u043a\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/rezultaty-analiza-bekdorov-v-prilozheniyah-dlya-android","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-05T05:42:20+00:00","article:modified_time":"2020-04-05T05:42:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76851","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:28:29","updated":"2022-10-07 21:01:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/76851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=76851"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/76851\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=76851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=76851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=76851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}