{"id":91733,"date":"2020-08-17T19:42:21","date_gmt":"2020-08-17T17:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip"},"modified":"2020-08-17T19:42:21","modified_gmt":"2020-08-17T17:42:21","slug":"doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","title":{"rendered":"Tor-i turvan\u00f5ukogu aruanne: pahatahtlikud v\u00e4ljundikeskused kasutasid sslstripi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"


\n \"Tor-i<\/p>\n

<\/a><\/p>\n

<\/p>\n

Juhtumi olemus<\/b><\/p>\n

Mai 2020. aastal avastati r\u00fchm v\u00e4ljundpunkte, mis sekkusid v\u00e4ljaminevatesse \u00fchendustesse. Eriti j\u00e4eti praktiliselt k\u00f5ik \u00fchendused puutumatuks, kuid peeti kinni v\u00e4ikese arvu kr\u00fcptovaluuta b\u00f6rside \u00fchendustest. Kui kasutajad k\u00fclastasid saidi HTTP-versiooni (st kr\u00fcpteerimata ja mitteautentitud), takistasid pahatahtlikud s\u00f5lmendid suunamist HTTPS-versioonile (st kr\u00fcpteeritud ja autentitud). Kui kasutaja ei m\u00e4rganud vahetust (n\u00e4iteks lukkuikooni puudumist brauseris) ja hakkas saatma t\u00e4htsat teavet, v\u00f5idi see teave r\u00fcndaja poolt p\u00fc\u00fcda.<\/p>\n

Tor-projekt v\u00e4listas need s\u00f5lmed v\u00f5rgust 2020. aasta maid. Juulis 2020 avastati uus grup retansleeraid, kes viisid l\u00e4bi sarnase r\u00fcnnaku, mille j\u00e4rel needki v\u00e4listati. Senini pole selge, kas m\u00f5ni kasutaja oli r\u00fcnnaku koh targetit, kuid r\u00fcnnaku ulatusest ja faktist, et r\u00fcndaja proovis uuesti (esimene juhtum m\u00f5jutab 23% kogu v\u00e4ljuses\u00f5lmede l\u00e4bilaskev\u00f5imest, teine umbes 19%), on m\u00f5istlik arvata, et kurjategija leidis r\u00fcnnaku kulud m\u00f5istlikuks.<\/p>\n

See intsident on hea meeldetuletus, et HTTP-p\u00e4ringud ei ole kr\u00fcpteeritud ega autentitud ja seet\u00f5ttu on need j\u00e4tkuvalt haavatavad. Tor Brauser sisaldab HTTPS-Everywhere laiendust, mis on spetsiaalselt m\u00f5eldud sarnaste r\u00fcnnakute v\u00e4ltimiseks, kuid selle t\u00f5husus on piiratud nimekirjaga, mis ei kata k\u00f5iki veebisaite maailmas. Kasutajad, kes k\u00fclastavad HTTP-versioonide saite, on alati ohus.<\/p>\n

Selliste r\u00fcnnakute ennetamine tulevikus<\/b><\/p>\n

R\u00fcnnakute ennetamise meetodid jagunevad kaheks osaks: esimene h\u00f5lmab meetmeid, mida saavad astuda kasutajad ja saidi administraatorid, et suurendada oma turvalisust, samas kui teine \u200b\u200bkontseptsioon k\u00e4sitleb pahatahtlike s\u00f5lmede tuvastamist ja \u00f5igeaegset avastamist.<\/p>\n

Soovitatavad tegevused saitide poolt: <\/p>\n

1. HTTPS-i aktiveerimine (tasuta sertifikaate pakub Let\u2019s Encrypt<\/a>) <\/p>\n

<\/noindex><\/p>\n

2. Reeglite reeglid HTTPS-Everywhere nimekirja, et kasutajad saaksid proaktiivselt luua kaitstud \u00fchendust, mitte s\u00f5ltuda suunamisest p\u00e4rast alaselget \u00fchendust. Samuti v\u00f5ivad veebiteenuste haldajad, kui nad soovivad t\u00e4iesti v\u00e4ltida \u00fchendust v\u00e4ljundknotidega, pakkuda saidi onion-versiooni<\/a>.<\/p>\n

<\/noindex><\/p>\n

Praegu kaalub Tor projekti v\u00f5imalust t\u00e4ielikult keelata kaitsmata HTTP Tor Brauseris. M\u00f5ni aasta tagasi oleks selline meede olnud m\u00f5eldamatu (kuna liiga paljud ressursid toetasid ainult kaitsmata HTTP), kuid HTTPS-Everywhere ja tulevane Firefoxi versioon pakuvad katsetamise v\u00f5imalust kasutada HTTPS-i vaikimisi esimeses \u00fchenduses, v\u00f5imalusega vajadusel tagasi liikuda HTTP-le. J\u00e4\u00e4nud on ebaselgeks, kuidas see l\u00e4henemine m\u00f5jutab Tor Brauseri kasutajaid, seega katsetatakse seda esmalt brauseri k\u00f5rgematel turvatasemetel (kilbi ikoon).<\/p>\n

Tor-v\u00f5rgustiku poolt on vabatahtlikud, kes j\u00e4lgivad edastajate k\u00e4itumist ja teatavad intsidentidest, mille t\u00f5ttu pahatahtlikud s\u00f5lmed saavad olla v\u00e4listatud kataloogiserverite poolt. Kuigi sellised raportid vaadatakse tavaliselt kiiresti l\u00e4bi ja pahatahtlikud s\u00f5lmed eemaldatakse kohe p\u00e4rast avastamist, on pidev j\u00e4lgimine v\u00f5rgustiku jaoks ressursiga piiratud. Kui olete avastanud pahatahtliku edastaja, saate teatada projektile, juhised on saadaval sellel lingil<\/a>.<\/p>\n

<\/noindex><\/p>\n

Praegusel l\u00e4henemisel on kaks p\u00f5hiprobleemi: <\/p>\n

1. Tundmatu edasiviija kaalumisel on raske t\u00f5endada selle pahatahtlikkust. Kui r\u00fcnnakuid tema poolt ei ole t\u00e4heldatud, kas tuleks see j\u00e4tta paika? Massilised r\u00fcnnakud, mis m\u00f5jutavad paljusid kasutajaid, on kergemini avastatavad, kuid kui r\u00fcnnakud m\u00f5jutavad vaid v\u00e4ikest arvu saite ja kasutajaid, v\u00f5ib r\u00fcndaja tegutseda ettevaatlikult<\/a>. Tor-v\u00f5rk koosneb tuhandetest edastajatest, mis asuvad \u00fcle kogu maailma, ja selline mitmekesisus (ning sellest tulenev detsentraliseeritus) on \u00fcks selle tugevusi. <\/p>\n

<\/noindex><\/p>\n

2. Tundmatute edasiviijate r\u00fchma kaalumisel on raske t\u00f5endada nende seotust (st, kas nad teevad Civilli r\u00fcnnaku<\/a>). Paljuski vabatahtlikud edastusteenuse pakkujad valivad sama madala hinnaga v\u00f5rke, nagu Hetzner, OVH, Online, Frantech, Leaseweb jne, ja kui avastatakse mitu uut edastajat, on keeruline \u00fchem\u00f5tteliselt j\u00e4reldada, kas on ilmunud mitu uut operaatorit v\u00f5i ainult \u00fcks, kes juhib k\u00f5iki uusi edastajaid.<\/p>\n

<\/noindex><\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0412 \u043c\u0430\u0435 2020 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043e\u043d\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u043d\u0435\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043d\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c\u0443 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u044b\u0445 \u0431\u0438\u0440\u0436. \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0441\u0435\u0449\u0430\u043b\u0438 HTTP-\u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 (\u0442.\u0435. \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e), \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 HTTPS-\u0432\u0435\u0440\u0441\u0438\u044e (\u0442.\u0435. \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e). \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043b \u043f\u043e\u0434\u043c\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91734,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91733","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tor\u2019i turvajuhi aruanne: pahatahtlikud v\u00e4ljundpunktid kasutasid sslstripi. | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043a\u043b\u0430\u0434 \u0441\u043e\u0432\u0435\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Tor: \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 sslstrip. | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-17T17:42:21+00:00","article:modified_time":"2020-08-17T17:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91733","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:22:22","updated":"2022-10-05 06:28:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91733"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91733\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/91734"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}