{"id":36939,"date":"2019-10-31T22:14:51","date_gmt":"2019-10-31T19:14:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer\/"},"modified":"2019-10-31T22:14:51","modified_gmt":"2019-10-31T19:14:51","slug":"opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","title":{"rendered":"Le code de l'analyseur de s\u00e9curit\u00e9 des firmwares FwAnalyzer a \u00e9t\u00e9 publi\u00e9","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La soci\u00e9t\u00e9 Cruise, sp\u00e9cialis\u00e9e dans les technologies de conduite autonome, a ouvert<\/a><\/noindex> les codes sources du projet FwAnalyzer<\/a><\/noindex>, fournissant des outils pour analyser les images de firmware bas\u00e9es sur Linux et identifier les vuln\u00e9rabilit\u00e9s potentielles et les fuites de donn\u00e9es. Le code est \u00e9crit en Go et est distribu\u00e9<\/a><\/noindex> sous licence Apache 2.0.<\/p>\n

L'analyse des images utilisant les syst\u00e8mes de fichiers ext2\/3\/4, FAT\/VFat, SquashFS et UBIFS est prise en charge. Pour extraire l'image, des utilitaires standards tels que e2tools, mtools, squashfs-tools et ubi_reader sont utilis\u00e9s. FwAnalyzer extrait de l'image l'arborescence des r\u00e9pertoires et \u00e9value le contenu en fonction d'un ensemble de r\u00e8gles. Les r\u00e8gles peuvent \u00eatre li\u00e9es aux m\u00e9tadonn\u00e9es du syst\u00e8me de fichiers, au type de fichiers et au contenu. En sortie, un rapport au format JSON est g\u00e9n\u00e9r\u00e9, r\u00e9sumant les informations extraites du firmware et fournissant des alertes et une liste de fichiers ne respectant pas les r\u00e8gles appliqu\u00e9es. <\/p>\n

Il prend en charge la v\u00e9rification des droits d'acc\u00e8s aux fichiers et r\u00e9pertoires (par exemple, il d\u00e9tecte les acc\u00e8s en \u00e9criture non restreints et les UID\/GID incorrects), identifie la pr\u00e9sence de fichiers ex\u00e9cutables avec le drapeau suid et l'utilisation d'\u00e9tiquettes SELinux, d\u00e9tecte les cl\u00e9s de chiffrement oubli\u00e9es et les fichiers potentiellement dangereux. Dans le contenu, il met en \u00e9vidence les mots de passe d'ing\u00e9nierie laiss\u00e9s et les donn\u00e9es de d\u00e9bogage, extrait des informations sur les versions, effectue une identification\/v\u00e9rification des contenus par hachages SHA-256 et proc\u00e8de \u00e0 des recherches en utilisant des masques statiques et des expressions r\u00e9guli\u00e8res. La liaison de scripts d'analyse externes \u00e0 certains types de fichiers est possible. Pour les firmwares bas\u00e9s sur Android, les param\u00e8tres de compilation sont d\u00e9termin\u00e9s (par exemple, l'utilisation du mode ro.secure=1, l'\u00e9tat de ro.build.type et l'activation de SELinux).<\/p>\n

FwAnalyzer peut \u00eatre utilis\u00e9 pour simplifier l'analyse des probl\u00e8mes de s\u00e9curit\u00e9 dans des firmwares tiers, mais son objectif principal est le contr\u00f4le de la qualit\u00e9 des propres firmwares ou de ceux fournis par des fournisseurs externes sous contrat. Les r\u00e8gles de FwAnalyzer permettent de constituer une sp\u00e9cification pr\u00e9cise de l'\u00e9tat du firmware et d'identifier les \u00e9carts inacceptables, tels que l'attribution de droits d'acc\u00e8s incorrects ou le fait de laisser des cl\u00e9s priv\u00e9es et du code de d\u00e9bogage (par exemple, la v\u00e9rification permet d'\u00e9viter des situations telles que le fait de laisser<\/a><\/noindex> un serveur SSH utilis\u00e9 durant la phase de test, pr\u00e9d\u00e9fini<\/a><\/noindex> mot de passe technique, disponible<\/a><\/noindex> en lecture \/etc\/config\/shadow ou oubli\u00e9es<\/a><\/noindex> cl\u00e9s<\/a><\/noindex> de formation de signature num\u00e9rique).<\/p>\n

\"Le<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cruise, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u0445 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f\u043c\u0438, \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 FwAnalyzer, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a \u043d\u0430 \u0431\u0430\u0437\u0435 Linux \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u043d\u0438\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u0434 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Go \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 Apache 2.0. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u0440\u0430\u0437\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b ext2\/3\/4, FAT\/VFat, SquashFS \u0438 UBIFS. \u0414\u043b\u044f \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27676,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Le code de l'analyseur de s\u00e9curit\u00e9 des firmwares FwAnalyzer est publi\u00e9 | ProHoster","description":"L'entreprise Cruise, sp\u00e9cialis\u00e9e dans les technologies de conduite autonome, a ouvert.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0434 \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043e\u043a FwAnalyzer | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cruise, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f\u0445 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u044f\u043c\u0438, \u043e\u0442\u043a\u0440\u044b\u043b\u0430.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovan-kod-analizatora-bezopasnosti-proshivok-fwanalyzer","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:51+00:00","article:modified_time":"2019-10-31T19:14:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:36:24","updated":"2026-01-22 05:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/36939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=36939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/36939\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/27676"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=36939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=36939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=36939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}