{"id":113257,"date":"2024-01-31T01:41:06","date_gmt":"2024-01-30T23:41:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor"},"modified":"2024-01-31T01:41:06","modified_gmt":"2024-01-30T23:41:06","slug":"rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","title":{"rendered":"Rezultati druge sigurnosne revizije razvoja projekta Tor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Razvija\u010di anonimne mre\u017ee Tor objavili su rezultate drugog audita koji je proveo Radically Open Security od travnja do kolovoza 2023. godine (prvi audit provela je tvrtka Cure53 od studenog 2022. do travnja 2023.). Provjera je obuhvatila kod za osiguranje rada izlaznih \u010dvorova, Tor Browser, komponente infrastrukture (prikupljanje metrika, SWBS, API Onionoo) i alate za testiranje. Glavni cilj ponovne provjere bio je procjena promjena u\u010dinjenih radi pove\u0107anja brzine i pouzdanosti mre\u017ee Tor, poput protokola razdvajanja prometa Conflux koji je dodan u izdanju Tor 0.4.8 i metoda za\u0161tite Onion usluga od DoS napada temeljenih na dokazima o izvr\u0161enju rada.    <\/p>\n<p>Tijekom audita otkrivene su 17 ranjivosti, od kojih je samo jedna klasificirana kao opasna. \u010cetiri ranjivosti su ocijenjene kao umjereno opasne, a 12 je klasificirano kao problemi s minimalnom razinom opasnosti. Najopasnija ranjivost otkrivena je u aplikaciji onbasca (Onion Bandwidth Scanner), koja se koristi za skeniranje propusnosti \u010dvorova mre\u017ee.     <\/p>\n<p>Ranljivost je uzrokovana mogu\u0107no\u0161\u0107u slanja zahtjeva putem HTTP metode GET, koja omogu\u0107ava izvr\u0161avanje me\u0111usajtnih napada ispred drugog korisnika (CSRF, Cross-Site Request Forgery), \u010dime napada\u010d mo\u017ee dodati svoje mostove u Bazu podataka manipulacijom s parametrima &#171;bridge_lines&#187;. Na primjer, napada\u010d mo\u017ee postaviti web stranicu s JavaScript kodom fetch(&#171;http:\/\/127.0.0.1:8000\/bridge-state\/? bridge_lines=obfs4+0.0.0.000000+AAA+cert0+iat-mode0&#187;, i ako ovu stranicu otvori korisnik s aktivnom sesijom na Onion Bandwidth Scanneru, bit \u0107e dodan IP &#171;0.0.0.0&#187; u bazu podataka u njegovo ime.    <\/p>\n<p>Problemi s umjerenom razinom opasnosti:  <\/p>\n<ul>\n<li class=\"l\"> Odbijanje usluge u metrics-lib kroz prijenos velike komprimirane datoteke \u2014 s obzirom da se datoteka raspakira u radnu memoriju, mo\u017ee se poslati ne\u0161to poput zip bombe (na primjer, mo\u017ee se pakirati 600 MB nula u 0.0006 MB) i izazvati iscrpljivanje dostupne memorije.\n<li class=\"l\"> Kori\u0161tenje u tor-android-service (koji se koristi u Tor browseru za Android) vanjskog modula tun2socks, \u010dija je podr\u0161ka obustavljena.\n<li class=\"l\"> Pisanje nultog bajta izvan dodijeljenog bafera u Tor klijentu zbog kori\u0161tenja funkcije read_file_to_str_until_eof, koja vra\u0107a veli\u010dinu bez nultog znaka.\n<li class=\"l\"> Ranjivost u sbws (Jednostavni skener propusnosti), koja omogu\u0107ava povratak HTTPS veze na HTTP, koriste\u0107i preusmjeravanje na HTTP. Kontrolirani izlazni \u010dvor Tor, koji napada\u010d mo\u017ee koristiti, potencijalno mo\u017ee iskoristiti ovu ranjivost za organizaciju curenja API tokena.          <\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60522\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043f\u0435\u0440\u0432\u044b\u0439 \u0430\u0443\u0434\u0438\u0442). \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043a\u043e\u0434 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Tor Browser, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b (\u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a, SWBS, API Onionoo) \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113257","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Tor | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-01-30T23:41:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-01-30T23:41:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rezultati drugog audita sigurnosti razvoja projekta Tor | ProHoster","description":"Programeri anonimne mre\u017ee Tor objavili su rezultate drugog audita, koji je proveo Radically Open Security od travnja do kolovoza 2023. godine (prije toga od studenog 2022. do travnja 2023. godine).","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-30T23:41:06+00:00","article:modified_time":"2024-01-30T23:41:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=113257"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113257\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=113257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=113257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=113257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}