{"id":91733,"date":"2020-08-17T19:42:21","date_gmt":"2020-08-17T17:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip"},"modified":"2020-08-17T19:42:21","modified_gmt":"2020-08-17T17:42:21","slug":"doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","title":{"rendered":"Tor\u2019i julgeolekun\u00f5ukogu aruanne: pahatahtlikud v\u00e4ljuvad s\u00f5lmed kasutasid sslstripi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"


\n \"Tor\u2019i<\/p>\n

<\/a><\/p>\n

<\/p>\n

Juhtumi olemus<\/b><\/p>\n

Mai 2020. aastal avastati r\u00fchmitus v\u00e4ljuvaid s\u00f5lmi, mis sekkusid v\u00e4ljak\u00e4ivate \u00fchenduste toimimisse. Nimelt j\u00e4eti peaaegu k\u00f5ik \u00fchendused muutumatuks, kuid p\u00fc\u00fcti kinni \u00fchendused v\u00e4ikesesse hulka kr\u00fcptovaluutade b\u00f6rse. Kui kasutajad k\u00fclastasid saidi HTTP-versiooni (st kr\u00fcptimata ja mitteautentitud), takistasid pahatahtlikud s\u00f5lmed suunamist HTTPS-versioonile (st kr\u00fcptitud ja autentitud). Kui kasutaja ei m\u00e4rganud asendamist (n\u00e4iteks brauseris lukuikooni puudumine) ja hakkas saatma olulist teavet, v\u00f5is see teave r\u00fcndaja poolt kinni p\u00fc\u00fcdma.<\/p>\n

Tor projekti eemaldas need s\u00f5lmed v\u00f5rgust maikus 2020. Juulis 2020 avastati j\u00e4rgmine r\u00fchm edastajaid, kes viis l\u00e4bi sarnase r\u00fcnnaku, mille j\u00e4rel needki eemaldati. Siiani ei ole selge, kas m\u00f5ni kasutaja oli r\u00fcnnaku k\u00e4igus edukalt ohvriks langenud, kuid arvestades r\u00fcnnaku ulatust ja fakti, et r\u00fcndaja proovis seda uuesti (esimene juhtum h\u00f5lmas 23% v\u00e4ljas\u00f5idukeskkonna kogumahust, teine umbes 19%), on m\u00f5istlik eeldada, et kurjategija leidis r\u00fcnnaku kulud \u00f5igustatud.<\/p>\n

See intsident on hea meeldetuletus, et HTTP-p\u00e4ringud pole kr\u00fcpteeritud ega autentitud ning on seet\u00f5ttu endiselt haavatavad. Tor Browser sisaldab laiendust HTTPS-Everywhere, mis on spetsiaalselt m\u00f5eldud selliste r\u00fcnnakute v\u00e4ltimiseks, kuid selle efektiivsus on piiratud nimekirjaga, mis ei kata k\u00f5iki maailma veebisaite. Kasutajad, kes k\u00fclastavad veebisaitide HTTP-versioone, on alati ohus.<\/p>\n

Sarnaste r\u00fcnnakute v\u00e4ltimine tulevikus<\/b><\/p>\n

R\u00fcnnaku \u00e4rahoidmise meetodid jagunevad kaheks osaks: esimene h\u00f5lmab meetmeid, mida saavad rakendada kasutajad ja veebihaldurid, et suurendada oma turvalisust, samas kui teine keskendub pahavara-verev\u00f5rku tuvastamisele ja \u00f5igeaegsele avastamisele.<\/p>\n

Soovitused veebisaitide jaoks: <\/p>\n

1. HTTPS-i lubamine (tasuta sertifikaate pakub Let’s Encrypt<\/a>) <\/p>\n

<\/noindex><\/p>\n

2. Suunamisreeglite lisamine HTTPS-Everywhere'i nimekirja, et kasutajad saaksid eelnevalt kaitstud \u00fchenduse kehtestada, mitte loota suunamisele p\u00e4rast kaitsmata \u00fchenduse loomist. Samuti, kui veebiteenuste haldurid soovivad t\u00e4ielikult v\u00e4ltida suhtlemist v\u00e4ljunds\u00f5lmedega, v\u00f5ivad nad pakuda saidi onion-versiooni<\/a>.<\/p>\n

<\/noindex><\/p>\n

Hetkel kaalub Tor projekti t\u00e4iesti eemaldada kaitseta HTTP Tor Brauseris. Paar aastat tagasi tundus selline meede m\u00f5ttetu (liigne arv ressursse kasutas vaid kaitsetut HTTP-d), kuid HTTPS Everywhere'i ja tulevase Firefoxi versioonil on katse v\u00f5imalus kasutada HTTPS-i vaikimisi esimesel \u00fchendusel, v\u00f5imalusega vajadusel tagasi minna HTTP peale. Siiani ei ole selge, kuidas selline l\u00e4henemine m\u00f5jutab Tor Brauseri kasutajaid, seet\u00f5ttu testitakse seda esmalt k\u00f5rgema turvataseme brauseri raames (kilbi ikoon).<\/p>\n

Tor v\u00f5rgu poolt on vabatahtlikud, kes j\u00e4lgivad edastajate k\u00e4itumist ja teatavad intsidentidest, t\u00e4nu millele saavad pahatahtlikud s\u00f5lmed olla v\u00e4lja j\u00e4etud katalooge haldavatest juureserveritest. Kuigi neid teatiseid k\u00e4sitletakse tavaliselt kiiresti ja pahatahtlikud s\u00f5lmed \u00fchendatakse kohe p\u00e4rast avastamist, ei piisa pidevaks j\u00e4lgimiseks ressurssidest. Kui leiate pahatahtliku edastaja, saate teatada projektile, juhised on saadaval sellel lingil<\/a>.<\/p>\n

<\/noindex><\/p>\n

Praegusel l\u00e4henemisel on kaks p\u00f5hiprobleemi: <\/p>\n

1. Tundmatu edastaja hindamisel on keeruline t\u00f5endada selle pahatahtlikkust. Kui sellelt suunatud r\u00fcnnakuid ei ole t\u00e4heldatud, kas tuleks see j\u00e4tta paika? Suured r\u00fcnnakud, mis m\u00f5jutavad paljusid kasutajaid, on kergemini tuvastatavad, kuid kui r\u00fcnnakud kajastuvad vaid v\u00e4hestes veebisaitides ja kasutajates, v\u00f5ib r\u00fcndaja tegutseda ettevaatlikult<\/a>. Tor v\u00f5rk koosneb tuhandetest edastajatest, mis asuvad \u00fcle kogu maailma, ning selline mitmekesisus (ja sellest tulenev detsentraliseeritus) on \u00fcks selle tugevaid k\u00fclgi. <\/p>\n

<\/noindex><\/p>\n

2. Tundmatu edastajate grupi hindamisel on keeruline t\u00f5endada nende omavahelist seotust (st kas nad teevad Civilla r\u00fcnnakut<\/a>). Paljud vabatahtlikud edastajate operaatorid valivad samad odavad v\u00f5rguteenused, nagu Hetzner, OVH, Online, Frantech, Leaseweb jne, ja kui mitmeid uusi edastajaid avastatakse, on keeruline \u00fcheselt j\u00e4reldada, kas on ilmunud mitu uut operaatorit v\u00f5i ainult \u00fcks, kes juhib k\u00f5iki uusi edastajaid.<\/p>\n

<\/noindex><\/noindex><\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0412 \u043c\u0430\u0435 2020 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0432\u043c\u0435\u0448\u0438\u0432\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043e\u043d\u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u043d\u0435\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u043d\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u043b\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u043c\u0443 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u044b\u0445 \u0431\u0438\u0440\u0436. \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u0441\u0435\u0449\u0430\u043b\u0438 HTTP-\u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 (\u0442.\u0435. \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e), \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430 HTTPS-\u0432\u0435\u0440\u0441\u0438\u044e (\u0442.\u0435. \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e). \u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0437\u0430\u043c\u0435\u0447\u0430\u043b \u043f\u043e\u0434\u043c\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91734,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91733","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tor'i turvakoja raport: pahatahtlikud v\u00e4ljund\u00fclesanded kasutasid sslstripi. | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043a\u043b\u0430\u0434 \u0441\u043e\u0432\u0435\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Tor: \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435 \u0443\u0437\u043b\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 sslstrip. | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/doklad-soveta-bezopasnosti-tor-vredonosnye-vyhodnye-uzly-ispolzovali-sslstrip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-17T17:42:21+00:00","article:modified_time":"2020-08-17T17:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91733","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:22:22","updated":"2022-10-05 06:28:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91733"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91733\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/91734"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}