{"id":101267,"date":"2021-09-14T16:22:48","date_gmt":"2021-09-14T14:22:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya"},"modified":"2021-09-14T16:22:48","modified_gmt":"2021-09-14T14:22:48","slug":"uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","title":{"rendered":"Matrixi klientides avastatud haavatavused, mis v\u00f5imaldavad paljastada l\u00f5pp-\u0161ifreerimise v\u00f5tmed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Enamikus kliendirakendustes jagatud kommunikatsiooniplatvormil Matrix on avastatud haavatavused (CVE-2021-40823, CVE-2021-40824), mis v\u00f5imaldavad saada teavet v\u00f5tmete kohta, mida kasutatakse s\u00f5numite edastamiseks kr\u00fcpteeritud vestlustes (E2EE). R\u00fcndaja, kui ta on kompromiteerinud \u00fche vestluse kasutaja, saab de\u0161ifreerida s\u00f5numid, mis on varem saadetud sellele kasutajale haavatavatest kliendirakendustest. <\/p>\n

Eduka \u00e4rakasutamise jaoks on vajalik juurdep\u00e4\u00e4s s\u00f5numi saaja kontole. Juhtimine v\u00f5ib toimuda kas konto parameetrite lekkimise kaudu v\u00f5i l\u00e4bi Matrix-serveri h\u00e4kkimise, millega kasutaja \u00fchendub. Haavatavused kujutavad k\u00f5ige suuremat ohtu kr\u00fcpteeritud vestluste kasutajatele, kus on \u00fchendatud Matrix-serverid, mis kuuluvad pahatahtlikele. Sarnaste serverite administraatorid serverite<\/a> v\u00f5ivad proovida end serveri kasutajatena esitada, et p\u00fc\u00fcdma kinni s\u00f5numeid, mis saadetakse haavatavatest kliendirakendustest. <\/p>\n

Haavatavused tulenevad loogilistest vigadest, mis esinevad korduvate juurdep\u00e4\u00e4sukliendi rakenduste teostustes, mida pakuvad matrix-js-sdk < 12.4.1 (CVE-2021-40823), matrix-android-sdk2 < 1.2.2 (CVE-2021-40824), matrix-rust-sdk < 0.4.0, FamedlySDK < 0.5.0 ja Nheko \u2264 0.8.2. Teostused, mis p\u00f5hinevad teekidel matrix-ios-sdk, matrix-nio ja libolm, ei ole haavatavad. <\/p>\n

Seet\u00f5ttu esinevad haavatavused k\u00f5igis rakendustes, mis on laenanud probleemset koodi, ja need ei puuduta otseselt protokolle Matrix ja Olm\/Megolm. Eelk\u00f5ige puudutab probleem peamist Matrix-i klienti Element (endine Riot) veebis, lauaarvutites ja Androidis, samuti kolmanda osapoole kliendirakendusi ja teeke, sealhulgas FluffyChat, Nheko, Cinny ja SchildiChat. Probleem ei esine ametlikus klienti iOS-i platvormile ega ka rakendustes Chatty, Hydrogen, mautrix, purple-matrix ja Syphon. <\/p>\n

Elementi kliendi turvaauditi k\u00e4igus tuvastati haavatavused. K\u00f5ikide probleemsete klientide parandused on juba v\u00e4lja antud. Kasutajatel soovitatakse kiiresti installida v\u00e4rskendused ja enne v\u00e4rskenduse installimist viia kliendid offline-re\u017eiimi. Enne paranduste avaldamist puuduvad t\u00f5endid haavatavuse \u00e4rakasutamisest. serverile<\/a> R\u00fcnnaku fakti m\u00e4\u00e4ramine on v\u00f5imatu, kuid kuna r\u00fcnnaku jaoks on vajalik konto kompromiteerimine, saavad administraatorid anal\u00fc\u00fcsida kahtlaste sisselogimiste olemasolu autentimise logides oma serverites, ning kasutajad saavad hinnata oma kontoga seotud seadmete loendit, et tuvastada hiljutisi \u00fcmber\u00fchendusi ja usaldusv\u00e4\u00e4rsuse staatuse muutusi. <\/p>\n

Kl\u00f5vude jagamise mehhanismi teostuses, milles leiti haavatavusi, v\u00f5imaldab kliendil, kellel ei ole s\u00f5numi dekodeerimiseks kl\u00f5ppe, k\u00fcsida kl\u00f5ppe saatja seadmest v\u00f5i oma muudest seadmetest. N\u00e4iteks on selline v\u00f5imalus vajalik, et tagada vanade s\u00f5numite dekodeerimine kasutaja uues seadmes v\u00f5i kasutaja kaotatud kl\u00f5bistute korral. Protokolli spetsifikatsioon m\u00e4\u00e4rab vaikimisi, et kl\u00f5bip\u00e4ringutele ei vastata ning neid saadetakse automaatselt ainult kontrollitud seadmetele, mis kuuluvad samale kasutajale. Kahjuks ei ole praktikas selle n\u00f5ude t\u00e4itmist tagatud ning kl\u00f5bip\u00e4ringud t\u00f6\u00f6tati l\u00e4bi ilma n\u00f5uetekohase seadme tuvastamiseta.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-40823, CVE-2021-40824), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043a\u043b\u044e\u0447\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0447\u0430\u0442\u0430\u0445 \u0441\u043e \u0441\u043a\u0432\u043e\u0437\u043d\u044b\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c (E2EE). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0447\u0430\u0442\u0430, \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f, \u0440\u0430\u043d\u0435\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101267","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Matrixi klientides, mis v\u00f5imaldavad paljastada kr\u00fcpteeritud v\u00f5tmeid | ProHoster","description":"Enamikus Matrixi detsentraliseeritud suhtluse platvormile m\u00f5eldud kliendirakendustes on avastatud haavatavused (CVE-2021-40823, CVE-2021-40824), mis v\u00f5imaldavad teada saada samav\u00e4\u00e4rselt s\u00f5numite edastamiseks kasutatud v\u00f5tmetest kr\u00fcpteeritud vestlustes (E2EE). R\u00fcndaja, kes on kompromiteerinud \u00fche vestluskaaslase konto, suudab dekr\u00fcpteerida s\u00f5numid, mis on varem saadetud sellele kasutajale haavatavatest kliendirakendustest. Edukaks \u00e4rakasutamiseks on vajalik juurdep\u00e4\u00e4s saaja kontole.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 Matrix, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0441\u043a\u0432\u043e\u0437\u043d\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-40823, CVE-2021-40824), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043a\u043b\u044e\u0447\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0447\u0430\u0442\u0430\u0445 \u0441\u043e \u0441\u043a\u0432\u043e\u0437\u043d\u044b\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c (E2EE). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0447\u0430\u0442\u0430, \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f, \u0440\u0430\u043d\u0435\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-14T14:22:48+00:00","article:modified_time":"2021-09-14T14:22:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101267","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-14 14:28:26","updated":"2026-02-22 15:30:28"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101267"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101267\/revisions"}],"predecessor-version":[{"id":162276,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101267\/revisions\/162276"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}