{"id":91827,"date":"2020-08-19T13:41:59","date_gmt":"2020-08-19T11:41:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej"},"modified":"2020-08-19T13:41:59","modified_gmt":"2020-08-19T11:41:59","slug":"mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","title":{"rendered":"Mozilla hat das Programm zur Verg\u00fctung von Sicherheitsanf\u00e4lligkeiten erweitert","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Die Mozilla Corporation hat bekannt gegeben<\/a><\/noindex> zur Erweiterung der Initiative zur Auszahlung von Pr\u00e4mien f\u00fcr die Identifizierung von Sicherheitsproblemen in Firefox. Neben direkten Schwachstellen wird das Bug-Bounty-Programm nun auch Methoden<\/a><\/noindex> zum Umgehen der im Browser vorhandenen Mechanismen, die Exploits verhindern. <\/p>\n

\u0412 \u0447\u0438\u0441\u043b\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432\u0445\u043e\u0434\u0438\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0447\u0438\u0441\u0442\u043a\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 HTML \u043f\u0435\u0440\u0435\u0434 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435, \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0443\u0437\u043b\u043e\u0432 DOM \u0438 \u0441\u0442\u0440\u043e\u043a\/ArrayBuffers, \u0437\u0430\u043f\u0440\u0435\u0442 eval() \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0438 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435, \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0436\u0451\u0441\u0442\u043a\u0438\u0445 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 CSP (Content Security Policy) \u043a \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u043c «about:», \u0437\u0430\u043f\u0440\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u0445 \u043e\u0442 «chrome:\/\/», «resource:\/\/» \u0438 «about:», \u0437\u0430\u043f\u0440\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435, \u043e\u0431\u0445\u043e\u0434 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e (\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430) \u0438 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 JavaScript. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u043e\u0448\u0438\u0431\u043a\u0438, \u043f\u043e\u0434\u043f\u0430\u0434\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0434 \u0432\u044b\u043f\u043b\u0430\u0442\u0443 \u043d\u043e\u0432\u043e\u0433\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u0441\u044f eine vergessene<\/a><\/noindex> \u00dcberpr\u00fcfung auf eval() in Web Worker-Threads angef\u00fchrt.<\/p>\n

Wenn eine Schwachstelle entdeckt wird und die Schutzmechanismen gegen Exploits umgangen werden, kann der Forscher zus\u00e4tzlich 50 % der Grundbelohnung erhalten, die<\/a><\/noindex> f\u00fcr die entdeckte Schwachstelle vergeben wird (zum Beispiel f\u00fcr eine UXSS-Schwachstelle, die den Mechanismus HTML Sanitizer<\/a><\/noindex>umgeht, k\u00f6nnen bis zu 7.000 $ sowie ein Bonus von 3.500 $ erzielt werden). Bemerkenswert ist, dass die Erweiterung des Belohnungsprogramms f\u00fcr unabh\u00e4ngige Forscher im Kontext der k\u00fcrzlichen Entlassung<\/a><\/noindex> von 250 Mitarbeitern von Mozilla durchgef\u00fchrt wurde, betroffen war, das ganze Team f\u00fcr Bedrohungsmanagement (Threat Management Team),<\/a><\/noindex> das f\u00fcr die Identifizierung und Analyse von Vorf\u00e4llen verantwortlich war, sowie ein Teil des<\/a><\/noindex> Security-Teams.<\/p>\n

Dar\u00fcber hinaus wird \u00fcber eine \u00c4nderung der Regeln zur Anwendung des Belohnungsprogramms f\u00fcr Sicherheitsanf\u00e4lligkeiten berichtet, die in den Nachtversionen festgestellt werden. Es wird festgestellt, dass solche Anf\u00e4lligkeiten h\u00e4ufig bereits w\u00e4hrend interner automatisierter \u00dcberpr\u00fcfungen und Fuzzing-Tests erkannt werden. Meldungen \u00fcber solche Fehler f\u00fchren nicht zu einer Verbesserung der Sicherheit von Firefox und der Verfeinerung der Fuzzing-Tests. Daher werden Belohnungen f\u00fcr Sicherheitsanf\u00e4lligkeiten in Nachtversionen nur ausgezahlt, wenn das Problem mehr als 4 Tage im Hauptrepository vorhanden ist und nicht durch interne \u00dcberpr\u00fcfungen und Mitarbeiter von Mozilla erkannt wurde.<\/p>\n

<\/a><\/noindex><\/p>\n

Quelle: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Firefox. \u041f\u043e\u043c\u0438\u043c\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Bug Bounty \u0442\u0435\u043f\u0435\u0440\u044c \u0431\u0443\u0434\u0435\u0442 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u043e\u0431\u0445\u043e\u0434\u0430 \u0438\u043c\u0435\u044e\u0449\u0438\u0445\u0441\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432, \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0430\u0431\u043e\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432. \u0412 \u0447\u0438\u0441\u043b\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432\u0445\u043e\u0434\u0438\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0447\u0438\u0441\u0442\u043a\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 HTML \u043f\u0435\u0440\u0435\u0434 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435, \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0443\u0437\u043b\u043e\u0432 DOM […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91827","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla hat das Belohnungsprogramm f\u00fcr die Entdeckung von Sicherheitsanf\u00e4lligkeiten erweitert | ProHoster","description":"Mozilla hat die Initiative zur Auszahlung von Geldpr\u00e4mien f\u00fcr die Entdeckung von Sicherheitsproblemen in Firefox erweitert. Neben den direkten Sicherheitsanf\u00e4lligkeiten wird das Bug-Bounty-Programm nun auch Methoden zur Umgehung vorhandener Mechanismen im Browser umfassen, die die Ausnutzung von Exploits verhindern. Zu diesen Mechanismen geh\u00f6rt das System zur Bereinigung von HTML-Fragmenten vor der Verwendung im privilegierten Kontext sowie die Trennung des Speichers f\u00fcr DOM-Knoten.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u044b\u043f\u043b\u0430\u0442\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Firefox. \u041f\u043e\u043c\u0438\u043c\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Bug Bounty \u0442\u0435\u043f\u0435\u0440\u044c \u0431\u0443\u0434\u0435\u0442 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u043e\u0431\u0445\u043e\u0434\u0430 \u0438\u043c\u0435\u044e\u0449\u0438\u0445\u0441\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432, \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0430\u0431\u043e\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432. \u0412 \u0447\u0438\u0441\u043b\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432\u0445\u043e\u0434\u0438\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0447\u0438\u0441\u0442\u043a\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 HTML \u043f\u0435\u0440\u0435\u0434 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435, \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0443\u0437\u043b\u043e\u0432 DOM","og:url":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-19T11:41:59+00:00","article:modified_time":"2020-08-19T11:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:20:24","updated":"2022-10-08 11:15:02"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/91827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=91827"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/91827\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=91827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=91827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=91827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}