Cov yeej ntawm txhua xyoo Pwnie Awards 2021 tau tshaj tawm, qhia txog qhov tseem ceeb tshaj plaws thiab qhov ua tsis tiav hauv kev ruaj ntseg hauv computer. Pwnie Awards yog suav tias yog qhov sib npaug ntawm Oscars thiab Golden Raspberries hauv kev ruaj ntseg hauv computer.
Cov yeej tseem ceeb (cov npe ntawm cov neeg sib tw):
- Qhov yooj yim tshaj plaws uas ua rau muaj cai nce ntxiv. Qhov yeej tau muab rau Qualys txhawm rau txheeb xyuas qhov muaj qhov tsis zoo CVE-2021-3156 hauv sudo qhov hluav taws xob, uas tso cai rau koj kom tau txais cov cai hauv paus. Qhov tsis txaus ntseeg tau muaj nyob rau hauv cov cai rau li 10 xyoo thiab tseem ceeb heev hauv qhov kev txheeb xyuas nws yuav tsum muaj kev soj ntsuam zoo ntawm cov laj thawj ntawm kev siv hluav taws xob.
- Qhov zoo tshaj plaws server kab. Muab khoom plig rau kev txheeb xyuas thiab siv cov txheej txheem nyuaj tshaj plaws thiab nthuav kab kab hauv kev pabcuam network. Qhov yeej tau txais txiaj ntsig rau kev txheeb xyuas cov vector tshiab ntawm kev tawm tsam ntawm Microsoft Exchange. Cov ntaub ntawv hais txog tsis yog txhua qhov tsis zoo ntawm chav kawm no tau raug tshaj tawm, tab sis cov ntaub ntawv twb tau tshaj tawm txog qhov tsis zoo CVE-2021-26855 (ProxyLogon), uas tso cai rau koj rho tawm cov ntaub ntawv ntawm tus neeg siv arbitrary yam tsis muaj authentication, thiab CVE-2021-27065 , uas ua rau nws muaj peev xwm ua tiav koj cov cai ntawm lub server nrog cov cai tswj hwm.
- Qhov zoo tshaj plaws cryptographic nres. Muab khoom plig rau kev txheeb xyuas qhov sib txawv tseem ceeb tshaj plaws hauv cov tshuab tiag tiag, cov txheej txheem thiab encryption algorithms. Qhov khoom plig tau muab rau Microsoft rau qhov muaj qhov tsis zoo (CVE-2020-0601) hauv kev siv cov kos npe digital raws li cov kab nkhaus, uas tso cai rau tsim cov yuam sij ntiag tug raws li cov yuam sij pej xeem. Qhov teeb meem tau tso cai rau kev tsim daim ntawv pov thawj TLS cuav rau HTTPS thiab kos npe tsis tseeb digital uas tau lees paub tias muaj kev ntseeg siab los ntawm Windows.
- Qhov kev tshawb fawb tshiab tshaj plaws puas tau. Qhov khoom plig tau txais txiaj ntsig rau cov kws tshawb fawb uas tau thov BlindSide txoj kev los hla qhov chaw nyob raws li kev tiv thaiv (ASLR) kev tiv thaiv siv sab-channel xau los ntawm kev xav txog kev ua tiav cov lus qhia.
- Qhov loj tshaj tsis ua hauj lwm (Feem ntau Epic FAIL). Qhov khoom plig tau muab rau Microsoft rau kev rov ua dua qhov kev txhim kho tawg rau PrintNightmare qhov tsis zoo (CVE-2021-34527) hauv Windows luam ntawv uas tso cai rau kev ua tiav. Microsoft pib chij qhov teeb meem raws li hauv zos, tab sis tom qab ntawd nws tau muab tawm tias qhov kev tawm tsam tuaj yeem nqa tawm mus deb. Tom qab ntawd Microsoft tau tshaj tawm tshiab plaub zaug, tab sis txhua lub sijhawm kho tsuas yog kaw ib rooj plaub tshwj xeeb thiab cov kws tshawb nrhiav pom txoj hauv kev tshiab los ua qhov kev tawm tsam.
- Cov kab mob zoo tshaj plaws hauv cov neeg siv software. Tus yeej yog tus kws tshawb fawb uas tau txheeb xyuas qhov tsis zoo ntawm CVE-2020-28341 hauv Samsung ruaj ntseg cryptoprocessors, uas tau txais daim ntawv pov thawj CC EAL 5+ kev ruaj ntseg. Qhov tsis zoo ua rau nws muaj peev xwm hla kev ruaj ntseg kiag li thiab nkag mus rau cov cai khiav ntawm lub nti thiab cov ntaub ntawv khaws cia hauv lub enclave, hla qhov screen saver xauv, thiab tseem hloov pauv mus rau lub firmware los tsim lub zais rov qab.
- Qhov feem ntau underestimated vulnerability. Qhov khoom plig tau txais txiaj ntsig rau Qualys txhawm rau txheeb xyuas cov kab ke ntawm 21Nails qhov tsis zoo hauv Exim mail server, 10 ntawm cov uas tuaj yeem siv tau nyob deb. Cov neeg tsim tawm Exim tau tsis ntseeg tias cov teeb meem tuaj yeem raug siv thiab siv ntau tshaj 6 lub hlis txhim kho.
- Lamest Tus Neeg Muag Khoom Teb. Kev xaiv tsa rau qhov tsis txaus siab tshaj plaws rau cov lus hais txog qhov tsis zoo ntawm koj tus kheej cov khoom. Tus yeej yog Cellebrite, ib lub tuam txhab uas tsim cov ntawv thov rau kev soj ntsuam xyuas thiab tshem tawm cov ntaub ntawv los ntawm cov koom haum tub ceev xwm. Cellebrite tsis teb kom txaus rau cov ntaub ntawv qhia txog qhov tsis zoo uas xa los ntawm Moxie Marlinspike, tus sau ntawm Signal raws tu qauv. Moxey tau txaus siab rau Cellebrite tom qab tshaj tawm hauv xov xwm ntawm cov ntawv ceeb toom txog kev tsim cov thev naus laus zis uas tso cai rau kev nyiag nyiag cov lus ceeb toom encrypted, uas tom qab ntawd dhau los ua tus cuav vim kev txhais lus tsis raug ntawm cov ntaub ntawv hauv ib tsab xov xwm ntawm Cellebrite lub vev xaib, uas yog tom qab ntawd tshem tawm ("qhov kev tawm tsam" yuav tsum muaj lub cev nkag mus rau lub xov tooj thiab lub peev xwm tshem tawm lub xauv npo, piv txwv li nws raug txo kom pom cov lus hauv tus xa xov, tab sis tsis yog manually, tab sis siv daim ntawv thov tshwj xeeb uas simulates cov neeg siv kev ua).
Moxey tau kawm Cellebrite daim ntawv thov thiab pom qhov muaj qhov tsis zoo nyob ntawd uas tso cai rau kev txiav txim siab txiav txim siab thaum sim tshuaj xyuas cov ntaub ntawv tsim tshwj xeeb. Daim ntawv thov Cellebrite kuj tau pom tias siv lub tsev qiv ntawv ffmpeg uas tsis tau hloov kho rau 9 xyoo thiab muaj ntau qhov tsis muaj qhov tsis zoo. Hloov chaw lees paub cov teeb meem thiab kho cov teeb meem, Cellebrite tau tshaj tawm cov lus hais tias nws mob siab rau kev ncaj ncees ntawm cov neeg siv cov ntaub ntawv, tswj kev ruaj ntseg ntawm nws cov khoom nyob rau theem tsim nyog, tsis tu ncua tso tawm tshiab thiab xa cov ntawv thov zoo tshaj plaws ntawm nws hom.
- Qhov kev ua tiav loj tshaj plaws. Qhov khoom plig tau muab rau Ilfak Gilfanov, tus sau ntawm IDA disassembler thiab Hex-Rays decompiler, rau nws txoj kev koom tes rau kev tsim cov cuab yeej rau cov kws tshawb fawb kev ruaj ntseg thiab nws lub peev xwm los tswj cov khoom lag luam tshiab rau 30 xyoo.
Tau qhov twg los: opennet.ru