A taron Black Hat Amurka a Las Vegas bikin bayar da lambar yabo , wanda ke nuna mafi girman raunin rauni da gazawar rashin fahimta a fagen tsaro na kwamfuta. Ana ɗaukar kyaututtukan Pwnie a matsayin daidai da Oscars da Golden Raspberries a fagen tsaro na kwamfuta kuma ana gudanar da su kowace shekara tun 2007.
Main и :
- Mafi kyawun kwaro na uwar garken. An ba da lambar yabo don ganowa da cin gajiyar mafi rikitacciyar fasaha da kwaro mai ban sha'awa a cikin sabis na cibiyar sadarwa. Wadanda suka yi nasara sune masu bincike rauni a cikin mai ba da sabis na VPN Pulse Secure, wanda sabis na VPN ke amfani da Twitter, Uber, Microsoft, sla, SpaceX, Akamai, Intel, IBM, VMware, Sojojin ruwa na Amurka, Ma'aikatar Tsaron Gida ta Amurka (DHS) da tabbas rabin kamfanoni daga jerin Fortune 500. Masu bincike sun gano wata kofa ta baya da ke ba da damar maharin da ba shi da tabbas ya canza kalmar sirrin kowane mai amfani. Yiwuwar yin amfani da matsalar don samun tushen tushen shiga uwar garken VPN wanda kawai tashar HTTPS ke buɗe an nuna shi;
Daga cikin ‘yan takarar da ba su samu kyautar ba, ana iya lura da su kamar haka:
- An yi aiki a cikin matakin tantancewa a cikin tsarin haɗin kai na Jenkins, wanda ke ba ku damar aiwatar da lamba akan uwar garke. Bots suna amfani da raunin rayayye don tsara ma'adinan cryptocurrency akan sabobin;
- Mahimmanci a cikin uwar garken imel na Exim, wanda ke ba ku damar aiwatar da lamba akan uwar garken tare da haƙƙin tushen;
- a cikin kyamarori na Xiongmai XMeye P2P IP, yana ba ku damar sarrafa na'urar. An ba da kyamarori tare da kalmar sirri ta injiniya kuma ba su yi amfani da tabbacin sa hannu na dijital ba lokacin sabunta firmware;
- Mahimmanci a cikin aiwatar da yarjejeniyar RDP a cikin Windows, wanda ke ba ku damar aiwatar da lambar ku daga nesa;
- a cikin WordPress, hade da loda lambar PHP a ƙarƙashin hoton hoto. Matsalar tana ba ku damar aiwatar da lambar sabani akan uwar garken, samun gata na marubucin wallafe-wallafe (Mawallafi) akan rukunin yanar gizon;
- Mafi kyawun Bug Software na Abokin ciniki. Wanda ya ci nasara shine mai sauƙin amfani a cikin tsarin kiran rukuni na Apple FaceTime, yana ba da damar wanda ya ƙaddamar da kiran rukuni don tilasta kiran ya karɓi kiran wanda aka kira (misali, don saurare da snooping).
Haka kuma wadanda aka zaba don kyautar sune:
- a cikin WhatsApp, wanda ke ba ku damar aiwatar da lambar ku ta hanyar aika kiran murya na musamman;
- a cikin ɗakin karatu na zane-zane na Skia da aka yi amfani da shi a cikin burauzar Chrome, wanda zai iya haifar da lalacewar ƙwaƙwalwar ajiya saboda kurakurai masu iyo a wasu canje-canje na geometric;
- Mafi Girman Matsayin Rashin Gata. An ba da nasara don ganowa a cikin kernel na iOS, wanda za'a iya amfani dashi ta hanyar ipc_voucher, samun dama ta hanyar mai binciken Safari.
Haka kuma wadanda aka zaba don kyautar sune:
- a cikin Windows, yana ba ku damar samun cikakken iko akan tsarin ta hanyar magudi tare da aikin CreateWindowEx (win32k.sys). An gano matsalar a lokacin nazarin malware wanda ya yi amfani da raunin kafin a gyara shi;
- a cikin runc da LXC, yana shafar Docker da sauran tsarin keɓewar kwantena, ƙyale kwandon keɓaɓɓe wanda maharin ke sarrafa shi don canza fayil ɗin runc mai aiwatarwa da samun tushen gata a gefen tsarin tsarin;
- a cikin iOS (CFPrefsDaemon), wanda ke ba ku damar ƙetare hanyoyin keɓewa da aiwatar da lamba tare da haƙƙin tushen;
- a cikin bugu na Linux TCP stack da aka yi amfani da su a cikin Android, yana ba masu amfani da gida damar haɓaka gatansu akan na'urar;
- a cikin systemd-journald, wanda ke ba ku damar samun haƙƙin tushen;
- a cikin tmpreaper mai amfani don tsaftacewa / tmp, wanda ke ba ku damar adana fayil ɗin ku a kowane ɓangare na tsarin fayil;
- Mafi kyawun harin Cryptographic. An ba da lambar yabo don gano mafi mahimmancin gibi a cikin ainihin tsarin, ka'idoji da algorithms na ɓoyewa. An bayar da kyautar ne don tantancewa a cikin fasahar tsaro ta hanyar sadarwa mara waya ta WPA3 da EAP-pwd, wanda ke ba ka damar sake ƙirƙirar kalmar sirri ta haɗi da samun dama ga hanyar sadarwar mara waya ba tare da sanin kalmar sirri ba.
Sauran 'yan takarar da suka nemi lambar yabo sun hada da:
- hare-hare akan PGP da S/MIME boye-boye a cikin abokan cinikin imel;
- Hanyar takalma mai sanyi don samun damar yin amfani da abubuwan da ke cikin ɓoyayyen ɓoyayyen ɓoyayyun Bitlocker;
- a cikin OpenSSL, wanda ke ba ku damar raba yanayin karɓar padding mara kyau da MAC mara kyau. Matsalar tana faruwa ne ta hanyar rashin kula da sifili na sifili a cikin madaidaicin magana;
- tare da katunan ID da aka yi amfani da su a Jamus ta amfani da SAML;
- tare da entropy na bazuwar lambobi a cikin aiwatar da tallafi don alamun U2F a cikin ChromeOS;
- a cikin Monocypher, saboda abin da sa hannun EdDSA mara kyau aka gane daidai.
- Mafi kyawun bincike har abada. An ba da kyautar ga mai haɓaka fasahar , wanda ke amfani da umarnin vector AVX-512 don yin koyi da aiwatar da shirin, yana ba da damar haɓaka haɓaka mai saurin gwaji (har zuwa umarnin biliyan 40-120 a sakan daya). Dabarar tana ba kowane cibiya CPU damar gudanar da injunan kama-da-wane 8 64-bit ko 16 32-bit a layi daya tare da umarni don gwaji na aikace-aikacen.
Masu zuwa sun cancanci samun lambar yabo:
- a cikin fasahar Query Query daga MS Excel, wanda ke ba ku damar tsara aiwatar da code da keɓance hanyoyin keɓance aikace-aikacen lokacin buɗe maƙunsar bayanai na musamman;
- yaudarar matukin jirgi na motocin Tesla don tayar da tuki cikin layin da ke zuwa;
- Injiniyan baya na ASICS guntu Siemens S7-1200;
- - dabarar bin diddigin motsin yatsa don tantance lambar buɗe wayar, dangane da ƙa'idar aikin sonar - manyan lasifika na sama da na ƙasa na wayar suna haifar da girgizar da ba za a iya ji ba, kuma microphones ɗin da aka gina a ciki suna ɗaukar su don tantance kasancewar girgizar da ke nunawa daga hannu;
- kayan aikin injiniya na Ghidra na NSA;
- - dabara don ƙayyade amfani da lambar don ayyuka iri ɗaya a cikin fayilolin aiwatarwa da yawa dangane da nazarin majalisun binary;
- hanya don ƙetare tsarin Intel Boot Guard don loda firmware na UEFI da aka gyara ba tare da tabbatar da sa hannun dijital ba.
- Mafi gurguwar amsa daga mai siyarwa (Masanin Mai Tallafawa Lamest). Zaɓe don mafi ƙarancin isassun amsa ga saƙo game da rauni a cikin samfuran ku. Masu cin nasara sune masu haɓakawa na walat ɗin crypto na BitFi, waɗanda suka yi ihu game da matsananciyar tsaro na samfuran su, wanda a zahiri ya zama abin hasashe, suna tursasa masu bincike waɗanda ke gano raunin da ba su da alaƙa da abubuwan da aka yi alkawari don gano matsalolin;
Daga cikin masu neman lambar yabo kuma an yi la'akari da su:
- Wani mai bincike kan tsaro ya zargi daraktan na Atrient da kai masa hari domin tilasta masa cire wani rahoto kan wata lalura da ya gano, amma daraktan ya musanta faruwar lamarin kuma kyamarori masu sa ido ba su nada labarin harin ba;
- Zuƙowa ya jinkirta gyara matsala mai mahimmanci a tsarin taronta da kuma gyara matsalar sai bayan an bayyanawa jama'a. Rashin lahani ya ba da damar mai kai hari na waje samun bayanai daga kyamarorin yanar gizo na masu amfani da macOS lokacin buɗe wani shafi na musamman a cikin mai binciken (Zoom ya ƙaddamar da sabar http a gefen abokin ciniki wanda ya karɓi umarni daga aikace-aikacen gida).
- Rashin gyara fiye da shekaru 10 tare da sabar maɓalli na sirri na OpenPGP, yana ambaton gaskiyar cewa an rubuta lambar a cikin takamaiman yaren OCaml kuma ya kasance ba tare da mai kulawa ba.
Mafi kyawun sanarwar rashin lafiyar tukuna. An ba da kyauta don mafi yawan abin tausayi da ɗaukar hoto na matsalar akan Intanet da kafofin watsa labaru, musamman idan raunin da ya faru ya zama mara amfani a aikace. An ba da kyautar ga Bloomberg don game da gano kwakwalwan leken asiri a cikin Super Micro allon, wanda ba a tabbatar da shi ba, kuma majiyar ta nuna kwata-kwata. .
An ambata a cikin nadin:
- Rashin lahani a cikin libssh, wanda aikace-aikacen uwar garken guda ɗaya ( kusan ba a taɓa amfani da libssh don sabobin ba), amma ƙungiyar NCC ta gabatar da ita a matsayin raunin da ke ba da damar kai hari ga kowane uwar garken OpenSSH.
- Kai hari ta amfani da hotunan DICOM. Batun shine zaku iya shirya fayil ɗin aiwatarwa don Windows wanda zai yi kama da ingantaccen hoton DICOM. Ana iya sauke wannan fayil ɗin zuwa na'urar likita kuma a kashe shi.
- Varfafawa , wanda ke ba ka damar ƙetare amintaccen tsarin taya akan na'urorin Cisco. An rarraba rashin lafiyar a matsayin matsala mai yawa saboda yana buƙatar haƙƙin tushen don kai hari, amma idan maharin ya riga ya sami damar samun tushen tushen, to menene tsaro zamu iya magana akai. Har ila yau, rashin lahani ya ci nasara a cikin nau'in matsalolin da ba a yi la'akari da su ba, saboda yana ba ku damar gabatar da kofa ta dindindin a cikin Flash;
- Babban gazawa (Mafi yawan almara RASHI). An ba da nasarar ga Bloomberg don jerin labarai masu ban sha'awa tare da manyan kanun labarai amma abubuwan da aka kirkira, murkushe tushe, zuriyarsu zuwa ka'idodin makirci, amfani da kalmomi kamar "makamai na cyber", da kuma bayanan da ba a yarda da su ba. Sauran wadanda aka nada sun hada da:
- Harin Shadowhammer akan sabis na sabunta firmware Asus;
- Hacking vault BitFi da aka tallata a matsayin "ba za a iya yin fashi ba";
- Leaks na bayanan sirri da shiga Facebook.
source: budenet.ru