{"id":101267,"date":"2021-09-14T16:22:48","date_gmt":"2021-09-14T14:22:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya"},"modified":"2021-09-14T16:22:48","modified_gmt":"2021-09-14T14:22:48","slug":"uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","title":{"rendered":"Matrixi klientides avastatud haavatavused, mis v\u00f5imaldavad l\u00f5ppkasutaja kr\u00fcpteerimisv\u00f5tmete avaldamist.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Enamikus Matrix'i detsentraliseeritud suhtlusplatformi kliendirakendustes on tuvastatud haavatavused (CVE-2021-40823, CVE-2021-40824), mis v\u00f5imaldavad hankida teavet v\u00f5tmete kohta, mida on kasutatud s\u00f5numite edastamiseks l\u00f5puni kr\u00fcpteeritud vestlustes (E2EE). R\u00fcndaja, olles komprimeerinud \u00fche vestluskaaslase, v\u00f5ib dekodeerida varasemad s\u00f5numid, mis on saadetud sellele kasutajale haavatavatest kliendirakendustest. <\/p>\n

Edukaks \u00e4rakasutamiseks on vajalik juurdep\u00e4\u00e4s s\u00f5numi saaja kontole. Juurdep\u00e4\u00e4s v\u00f5ib olla saadud kas konto parameetrite leke kaudu v\u00f5i Matrix-serveri h\u00e4kkimise kaudu, mille kaudu kasutaja on \u00fchendatud. Suurim oht haavatavustest tuleneb kr\u00fcpteeritud vestlusruumide kasutajatest, mis on \u00fchendatud pahatahtlike kontrolli all olevate Matrix-serveritega. Selliste administraatorid serverid<\/a> v\u00f5ivad p\u00fc\u00fcda end serveri kasutajatena esitleda, et tabada s\u00f5numeid, mis on saadetud vestlusesse haavatavatest kliendirakendustest. <\/p>\n

Haavatavused on p\u00f5hjustatud loogilistest vigadest v\u00f5tmete korduvkasutuse mehhanismi rakendustes, mis on pakutud matrix-js-sdk < 12.4.1 (CVE-2021-40823), matrix-android-sdk2 < 1.2.2 (CVE-2021-40824), matrix-rust-sdk < 0.4.0, FamedlySDK < 0.5.0 ja Nheko \u2264 0.8.2. Rakendused, mis p\u00f5hinevad teistel teekidel nagu matrix-ios-sdk, matrix-nio ja libolm, ei ole haavatavustele alti. <\/p>\n

Seet\u00f5ttu ilmnevad haavatavused k\u00f5igis rakendustes, mis on laenanud probleemset koodi, ja ei puuduta otseselt Matrixi ja Olmi\/Megolmi protokolle. Eelk\u00f5ige m\u00f5jutab probleem peamist Matrix'i kliendi Element (endine Riot) veebis, lauaarvutites ja Androidis, samuti kolmandate osapoolte kliendirakendusi ja teeke, sealhulgas FluffyChat, Nheko, Cinny ja SchildiChat. Probleem ei ilmne ametlikus iOS-i kliendis ega rakendustes Chatty, Hydrogen, mautrix, purple-matrix ja Syphon. <\/p>\n

Haavatavused tuvastati Elementi kliendi turvaauditite k\u00e4igus. Parandused on praeguseks juba v\u00e4lja antud k\u00f5igi probleemsete klientide jaoks. Kasutajatele soovitatakse tungivalt uuendusi installida ja enne uuenduste installimist viia kliendid offline-re\u017eiimi. Haavatavuse kuritarvitamise t\u00f5endid enne paranduste avaldamist puuduvad. serverilt<\/a> R\u00fcnnaku fakti tuvastamine on v\u00f5imatu, kuid administratorid saavad anal\u00fc\u00fcsida oma serverite autentimislogisid ja hinnata kahtlaste sisenemiste olemasolu, kuna r\u00fcnnaku jaoks on vajalik konto kompromiteerimine. Kasutajad saavad oma kontoga seotud seadmete nimekirja uurida, et tuvastada hiljutisi uuesti \u00fchendamisi ja usaldusstaatuse muutusi. <\/p>\n

Klientide juurdep\u00e4\u00e4sumehhanism v\u00f5tmete jagamise kaudu, kus on leitud haavoittavusi, v\u00f5imaldab kliendil, kellel pole s\u00f5numi dekr\u00fcpteerimiseks v\u00f5tmeid, k\u00fcsida v\u00f5tmeid saatva seadme v\u00f5i teiste oma seadmete k\u00e4est. N\u00e4iteks on selline v\u00f5imalus vajalik vana s\u00f5numi dekr\u00fcpteerimiseks uuel seadmel v\u00f5i juhul, kui kasutaja on kaotanud olemasolevad v\u00f5tmed. Protokolli spetsifikatsioon m\u00e4\u00e4rab vaikimisi, et v\u00f5tme k\u00fcsimise taotlustele ei peaks vastama ning v\u00f5tmeid saadetakse automaatselt ainult sama kasutaja verifitseeritud seadmetele. Kahjuks ei ole praktikas seda n\u00f5uet tagatud ning v\u00f5tmete saatmise taotlused t\u00f6\u00f6deldi ilma asjakohase seadme tuvastamiseta.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-40823, CVE-2021-40824), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043a\u043b\u044e\u0447\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0447\u0430\u0442\u0430\u0445 \u0441\u043e \u0441\u043a\u0432\u043e\u0437\u043d\u044b\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c (E2EE). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0447\u0430\u0442\u0430, \u043c\u043e\u0436\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f, \u0440\u0430\u043d\u0435\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101267","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Matrixi klientide haavatavused, mis v\u00f5imaldavad paljastada l\u00f5pp-otsaga kr\u00fcpteerimise v\u00f5tmeid | ProHoster","description":"Enamikus klientrakendustes Matrixi detsentraliseeritud suhtlusplatvormil on tuvastatud haavatavused (CVE-2021-40823, CVE-2021-40824), mis v\u00f5imaldavad saada teavet edastatud v\u00f5tmete kohta.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 Matrix, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0441\u043a\u0432\u043e\u0437\u043d\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u0435\u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0439 Matrix \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-40823, CVE-2021-40824), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u043a\u043b\u044e\u0447\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-klientah-matrix-pozvolyayushhie-raskryt-klyuchi-skvoznogo-shifrovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-14T14:22:48+00:00","article:modified_time":"2021-09-14T14:22:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101267","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-14 14:28:26","updated":"2026-02-22 15:30:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101267"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101267\/revisions"}],"predecessor-version":[{"id":162276,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101267\/revisions\/162276"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}