{"id":113257,"date":"2024-01-31T01:41:06","date_gmt":"2024-01-30T23:41:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor"},"modified":"2024-01-31T01:41:06","modified_gmt":"2024-01-30T23:41:06","slug":"rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","title":{"rendered":"Tor projekti arenduste teise turvaauditi tulemused","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Anon\u00fc\u00fctse Tor-verv\u00f5rgu arendajad avaldasid teise auditi tulemused, mille viis l\u00e4bi ettev\u00f5te Radically Open Security aprillist augusta 2023 (enne seda viidi novembrist 2022 aprillini 2023 l\u00e4bi esimene audit ettev\u00f5tte Cure53 poolt). Kontroll keskendus v\u00e4ljund\u00f5litus\u00fcsteemide koodile, Tor Browserile, infrastruktuuri komponentidele (m\u00f5\u00f5dikute kogumine, SWBS, API Onionoo) ja testimist\u00f6\u00f6riistadele. Taas\u00fclevaate peamine \u00fclesanne oli hinnata muudatusi, mis on tehtud Tor v\u00f5rgu kiirus ja usaldusv\u00e4\u00e4rsuse t\u00f5stmiseks, sealhulgas Tor 0.4.8 v\u00e4ljaandes lisatud Conflux liiklusjaotuse protokoll ja Onion-teenuste kaitse DoS-r\u00fcnnakute eest t\u00f6\u00f6 t\u00f5estamise p\u00f5hjal.    <\/p>\n<p>Auditi k\u00e4igus avastati 17 haavatavust, millest ainult \u00fcks loeti ohtlikuks. Neljale haavatavusele anti keskmise ohu tase, 12 klassifitseeriti kergemaks probleemiks. K\u00f5ige ohtlikum haavatavus tuvastati onbasca (Onion Bandwidth Scanner) rakenduses, mida kasutatakse v\u00f5rgu s\u00f5lmide ribalaiuse skaneerimiseks.     <\/p>\n<p>V\u00f5imekus on p\u00f5hjustatud v\u00f5imalusest saata p\u00e4ringute kaudu HTTP meetod GET, mis v\u00f5imaldab t\u00e4ita saidisiseste p\u00e4ringute asendamist teise kasutaja nimel (CSRF, Cross-Site Request Forgery), mis annab r\u00fcndajale v\u00f5imaluse lisada oma silla s\u00f5lmed andmebaasi, manipuleerides parameetri &#171;bridge_lines&#187;ga. N\u00e4iteks v\u00f5ib r\u00fcndaja paigutada veebilehe JavaScript-koodiga fetch(&#171;http:\/\/127.0.0.1:8000\/bridge-state\/? bridge_lines=obfs4+0.0.0.000000+AAA+cert0+iat-mode0&#187;, ja kui kasutaja, kellel on aktiivne seanss Onion Bandwidth Scanneriga, avab selle lehe, lisatakse tema nimel andmebaasi IP &#171;0.0.0.0&#187;.    <\/p>\n<p>Keskmise ohu tasemega probleemid:  <\/p>\n<ul>\n<li class=\"l\"> Teenuse katkestamine metrics-lib'is suure kokkusurutud faili edastamise t\u00f5ttu \u2014 kuna fail dekompressitakse RAM-is, saab edastada sarnase zip-pommi (n\u00e4iteks on v\u00f5imalik pakkida 600 MB nullide hulk 0.0006 MB sisse) ja tekitada saadaval oleva m\u00e4lu kahanemise.\n<li class=\"l\"> Tor-android-service'is (kasutatakse Tor brauseris Androidis) on kasutusel kolmandate osapoolte moodul tun2socks, mille \u00fclalpidamine on l\u00f5petatud.\n<li class=\"l\"> Nulli baitide kirjutamine eraldatud m\u00e4lu piire Tor kliendis, mis tuleneb read_file_to_str_until_eof funktsiooni kasutamisest, mis tagastab suuruse, arvestamata nulli s\u00fcmbolit.\n<li class=\"l\"> Turvaleiavus sbws (Simple Bandwidth Scanner), mis v\u00f5imaldab tagasi l\u00fclitada HTTPS-\u00fchenduse HTTP-ks, kasutades HTTP suunamist. R\u00fcndaja kontrolli all olev Tor-i v\u00e4ljundnode v\u00f5ib kasutada seda turvaleiavust API-tokenite lekete korraldamiseks.          <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60522\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043f\u0435\u0440\u0432\u044b\u0439 \u0430\u0443\u0434\u0438\u0442). \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043a\u043e\u0434 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Tor Browser, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b (\u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a, SWBS, API Onionoo) \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113257","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Tor | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-01-30T23:41:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-01-30T23:41:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Teise Tor-i projekti turvaauditi tulemused | ProHoster","description":"Tor-i anon\u00fc\u00fcmse v\u00f5rgu arendajad avaldasid teise auditi tulemused, mille viis l\u00e4bi Radically Open Security aprillist augustini 2023 (enne seda novembrist 2022 aprillini 2023).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-30T23:41:06+00:00","article:modified_time":"2024-01-30T23:41:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=113257"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113257\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=113257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=113257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=113257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}