{"id":37054,"date":"2019-10-31T22:15:30","date_gmt":"2019-10-31T19:15:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\/"},"modified":"2019-10-31T22:15:30","modified_gmt":"2019-10-31T19:15:30","slug":"pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","title":{"rendered":"Pwnie Awards 2019: najzna\u010dajnije ranjivosti i propusti u sigurnosti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na nedavno odr\u017eanoj konferenciji Black Hat USA u Las Vegasu <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/\">odr\u017eana je<\/a><\/noindex> ceremonija dodele nagrada <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\">Pwnie Awards 2019<\/a><\/noindex>, u okviru koje su istaknute najzna\u010dajnije ranjivosti i apsurdni neuspesi u oblasti ra\u010dunalne sigurnosti. Pwnie Awards se smatra ekvivalentom Oscara i Zlatne maline u oblasti ra\u010dunalne sigurnosti i odr\u017eava se svake godine od 2007. godine. <\/p>\n<p>Glavne <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/winners\/\">pobednici<\/a><\/noindex> i <noindex><a rel=\"nofollow\" href=\"https:\/\/pwnies.com\/nominations\">nominacija<\/a><\/noindex>: <\/p>\n<ul>\n<li class=\"l\"> <b>Najbolja serverska gre\u0161ka<\/b>. Dodeljuje se za otkrivanje i eksploataciju najte\u017ee tehni\u010dki izazovne i zanimljive gre\u0161ke u mre\u017enoj usluzi. Pobednici su istra\u017eiva\u010di koji su  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.blackhat.com\/us-19\/briefings\/schedule\/#infiltrating-corporate-intranet-like-nsa---pre-auth-rce-on-leading-ssl-vpns-15545\">otkrili<\/a><\/noindex> ranjivost kod VPN provajdera Pulse Secure, \u010diji se VPN servis koristi u Twitteru, Uberu, Microsoftu, sla, SpaceX-u, Akamaiu, Intelu, IBM-u, VMware-u, Vojnim snagama SAD-a, Ministarstvu nacionalne sigurnosti (MNS) SAD-a i verovatno u polovini kompanija sa liste Fortune 500. Istra\u017eiva\u010di su prona\u0161li bauk koji omogu\u0107ava neautentifikovanom napada\u010du da promeni lozinku bilo kojeg korisnika. Demonstrirana je mogu\u0107nost eksploatacije problema za dobijanje root pristupa VPN serveru na kojem je otvoren samo port HTTPS;\n<p>Od nepobedni\u010dkih kandidata mo\u017ee se istaknuti: <\/p>\n<ul>\n<li class=\"l\"> Ranjivost koja se mo\u017ee iskoristiti pre nego \u0161to se pro\u0111e autentifikacija <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/orangetw\/awesome-jenkins-rce-2019\">ranljivost<\/a><\/noindex> u sistemu kontinuirane integracije Jenkins, koja omogu\u0107ava izvr\u0161avanje koda na serveru. Ranjivost se aktivno koristi od strane botova za organizovanje rudarenja kriptovaluta na serverima;\n<li class=\"l\"> Kriti\u010dna <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50819\">ranljivost<\/a><\/noindex> u po\u0161tanskom serveru Exim, koja omogu\u0107ava izvr\u0161avanje koda na serveru sa pravima root;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/10\/millions-of-xiongmai-video-surveillance-devices-can-be-hacked-via-cloud-feature-xmeye-p2p-cloud\/\">Ranjivosti<\/a><\/noindex> u IP kamerama Xiongmai XMeye P2P, koja omogu\u0107ava preuzimanje kontrole nad ure\u0111ajem. Kamere su isporu\u010dene sa in\u017eenjerskom lozinkom i nisu koristile digitalni potpis tokom a\u017euriranja firmvera;\n<li class=\"l\"> Kriti\u010dna <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0708\">ranljivost<\/a><\/noindex> u implementaciji RDP protokola u Windowsu, koja omogu\u0107ava daljinsko izvr\u0161avanje vlastitog koda;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50177\">Ranjivost<\/a><\/noindex> u WordPress-u, povezana sa otpremanjem PHP koda pod krinkom slike. Problem omogu\u0107ava izvr\u0161avanje proizvoljnog koda na serveru, sa privilegijama autora sadr\u017eaja (Author) na sajtu;\n<\/ul>\n<li class=\"l\"> <b>Najbolja gre\u0161ka u klijentskom softveru<\/b>. Pobednik je lako iskoristiva <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-6223\">ranljivost<\/a><\/noindex> u sistemu grupnih poziva Apple FaceTime, koja omogu\u0107ava inicijatoru grupnog poziva da natera prihvatanje poziva na strani pozvanog korisnika (na primer, za prislu\u0161kivanje i \u0161pijuniranje).\n<p>Na nagradu su tako\u0111e kandidovali: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50679\">Ranjivost<\/a><\/noindex> u WhatsAppu, koja omogu\u0107ava izvr\u0161avanje vlastitog koda putem slanja posebno oblikovanog glasovnog poziva;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugs.chromium.org\/p\/chromium\/issues\/detail?id=899689\">Ranjivost<\/a><\/noindex> u grafi\u010dkoj biblioteci Skia, koja se koristi u pregledniku Chrome, \u0161to mo\u017ee dovesti do o\u0161te\u0107enja memorije zbog gre\u0161ke u operacijama s pl floating-point tijekom nekih geometrijskih transformacija;\n<\/ul>\n<li class=\"l\"> <b>Najbolja ranjivost koja dovodi do pove\u0107anja privilegija<\/b>. Nagrada je dodijeljena za otkrivanje <noindex><a rel=\"nofollow\" href=\"https:\/\/googleprojectzero.blogspot.com\/2019\/01\/voucherswap-exploiting-mig-reference.html\">ranjivosti<\/a><\/noindex> u iOS jezgru, koju je mogu\u0107e iskoristiti putem ipc_vouchera, dostupnog za pristup preko preglednika Safari.\n<p>Na nagradu su tako\u0111e kandidovali: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2019-0859\">Ranjivost<\/a><\/noindex> u Windowsu, koja omogu\u0107ava potpuno preuzimanje kontrole nad sustavom putem manipulacija funkcijom CreateWindowEx (win32k.sys). Problem je otkriven tijekom analize zlonamjernog softvera koji je iskori\u0161tavao ranjivost prije njenog ispravljanja;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50130\">Ranjivost<\/a><\/noindex> u runc i LXC, koja utje\u010de na Docker i druge sisteme kontejnerske izolacije, omogu\u0107avaju\u0107i zlonamjerniku u izoliranom kontejneru da izmijeni izvr\u0161nu datoteku runc i dobije root privilegije na strani host sustava;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.zecops.com\/vulnerabilities\/exploit-of-cve-2019-7286\/\">Ranjivost<\/a><\/noindex> u iOS (CFPrefsDaemon), koja omogu\u0107ava zaobila\u017eenje re\u017eima izolacije i izvr\u0161avanje koda s root pravima;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-9568\">Ranjivost<\/a><\/noindex> u reviziji TCP staka Linuxa, koji se koristi u Androidu, omogu\u0107avaju\u0107i lokalnom korisniku da pove\u0107aje svoje privilegije na ure\u0111aju;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49931\">Ranjivosti<\/a><\/noindex> u systemd-journald, koja omogu\u0107ava dobivanje root prava;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/usn.ubuntu.com\/4077-1\/\">Ranjivost<\/a><\/noindex> u alatu tmpreaper za \u010di\u0161\u0107enje \/tmp, koja omogu\u0107ava zadr\u017eavanje vlastite datoteke bilo gdje na datote\u010dnom sustavu;\n<\/ul>\n<li class=\"l\"> <b>Najbolji kriptografski napad<\/b>. Nagrada se dodjeljuje za otkrivanje najzna\u010dajnijih propusta u stvarnim sistemima, protokolima i algoritmima \u0161ifriranja. Nagrada je dodijeljena za otkrivanje <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50493\">ranjivosti<\/a><\/noindex> u tehnologiji za\u0161tite be\u017ei\u010dnih mre\u017ea WPA3 i u EAP-pwd, koja omogu\u0107ava rekonstrukciju lozinke za povezivanje i pristup be\u017ei\u010dnoj mre\u017ei bez poznavanja lozinke.\n<p>Kandidati za dodjelu nagrade tako\u0111er su bili: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48597\">Metoda<\/a><\/noindex> napadi na PGP i S\/MIME \u0161ifriranje u klijentima e-po\u0161te;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.f-secure.com\/cold-boot-attacks\/\">Primjena<\/a><\/noindex> metoda hladnog ponovnog pokretanja za pristup sadr\u017eaju \u0161ifriranih particija Bitlockera;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50213\">Ranjivost<\/a><\/noindex> u OpenSSL, koja omogu\u0107ava razdvajanje situacija dobijanja neispravnog dodanog punjenja i neispravnog MAC-a. Problem je uzrokovan neispravnim rukovanjem nul-lim bajtovima u dodanom punjenju (padding oracle);\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2018\/11\/my-name-is-johann-wolfgang-von-goethe-i-can-prove-it\/\">Problemi<\/a><\/noindex> s kartama za identifikaciju koje se primjenjuju u Njema\u010dkoj, koriste\u0107i SAML;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.chromium.org\/chromium-os\/u2f-ecdsa-vulnerability\">Problem<\/a><\/noindex> s entropijom nasumi\u010dnih brojeva u implementaciji podr\u0161ke za U2F tokene u ChromeOS-u;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/monocypher.org\/quality-assurance\/disclosures\">Ranjivost<\/a><\/noindex> u Monocypheru, zbog koje su nulte EdDSA potpise progla\u0161ene ispravnim.\n<\/ul>\n<li class=\"l\"> <b>Najinovativnije istra\u017eivanje.<\/b>  Nagradu je dobio developer tehnologije <noindex><a rel=\"nofollow\" href=\"https:\/\/gamozolabs.github.io\/fuzzing\/2018\/10\/14\/vectorized_emulation.html\">Vectorized Emulation<\/a><\/noindex>, koja koristi vektorske instrukcije AVX-512 za emulaciju izvr\u0161avanja programa, omogu\u0107uju\u0107i zna\u010dajno pove\u0107anje brzine fuzzing testiranja (do 40-120 milijardi instrukcija u sekundi). Tehnika omogu\u0107ava paralelno izvo\u0111enje 8 64-bitnih ili 16 32-bitnih virtualnih ma\u0161ina na svakom CPU jezgru s instrukcijama za fuzzing testiranje aplikacija.\n<p>Za nagradu su se kandidirali: <\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mimecast.com\/blog\/2019\/06\/exploit-using-microsoft-excel-power-query-for-remote-dde-execution-discovered\/\">Ranjivost<\/a><\/noindex> tehnologija Power Query iz MS Excela, koja omogu\u0107uje izvr\u0161avanje koda i zaobila\u017eenje metoda izolacije aplikacija prilikom otvaranja posebno oblikovanih elektronskih tabela;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50446\">Metoda<\/a><\/noindex> prevara autopilota automobila Tesla kako bi se izazvao izlazak na suprotnu traku saobra\u0107aja;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/sec-consult.com\/en\/blog\/2019\/02\/reverse-engineering-architecture-pinout-plc\/\">Rad<\/a><\/noindex> in\u017eenjering ASICS \u010dipa Siemens S7-1200;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/arxiv.org\/abs\/1808.10250\">SonarSnoop<\/a><\/noindex> \u2014 tehnika pra\u0107enja pokreta prstiju za otkrivanje lozinke telefona, zasnovana na principu sonarstva \u2014 gornji i donji zvu\u010dnici pametnog telefona generiraju neslu\u0161ljive vibracije, a ugra\u0111eni mikrofoni ih hvataju za analizu prisutnosti reflektiranih vibracija s ruke;\n<li class=\"l\"> \t<noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50260\">Razvoj<\/a><\/noindex> u NSA alatima za in\u017eenjering Ghidra;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@massarelli\/safe-self-attentive-function-embedding-d80abbfea794\">SAFE<\/a><\/noindex> \u2014 tehnika odre\u0111ivanja upotrebe koda identi\u010dnih funkcija u vi\u0161e izvr\u0161nih datoteka na temelju analize binarnih paketa;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/vulmon.com\/vulnerabilitydetails?qid=CVE-2019-11098&#038;scoretype=cvssv2\">Izrada<\/a><\/noindex> metoda zaobilaska mehanizma Intel Boot Guard kako bi se u\u010ditale modificirane UEFI firmware bez provjere digitalnim potpisom.\n<\/ul>\n<li class=\"l\"> <b>Najgluplja reakcija dobavlja\u010da<\/b> (Lamest Vendor Response). Nominacija za najneadekvatniju reakciju na izvje\u0161taj o ranjivosti u vlastitom proizvodu. Pobjednici su developeri kripto-nov\u010danika BitFi, koji su vikali o super sigurnosti svog proizvoda, koja se zapravo pokazala iluzornom, te su progonili istra\u017eiva\u010de koji su otkrili ranjivosti, a nisu isplatili obe\u0107ane nagrade za otkrivene probleme;\n<p>Me\u0111u kandidatima za nagradu razmatrane su i: <\/p>\n<ul>\n<li class=\"l\"> Istra\u017eiva\u010d sigurnosti je optu\u017eio direktora Atrienta za napad kako bi ga natjerao da ukloni izvje\u0161taj o ranjivosti koju je otkrio, ali direktor negira incident, a nadzorne kamere nisu snimile taj napad;\n<li class=\"l\"> Kompanija Zoom je odlagala ispravku kriti\u010dne <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/bugbountywriteup\/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5\">ranjivosti<\/a><\/noindex> u svom sustavu konferencijskog poziva i ispravila problem tek nakon javnog otkrivanja. Ranljivost je omogu\u0107ila vanjskom napada\u010du pristup podacima s web kamera korisnika macOS-a otvaranjem posebne, oblikovane stranice u pregledniku (zoom je na strani klijenta pokretao HTTP poslu\u017eitelj koji je primao naredbe od lokalne aplikacije).\n<li class=\"l\"> Nesposobnost da se ispravi vi\u0161e od 10 godina <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51006\">problem<\/a><\/noindex> s poslu\u017eiteljima kriptografskih klju\u010deva OpenPGP, opravdavaju\u0107i to time da je kod napisan na specifi\u010dnom jeziku OCaml i bez pratnje.\n<\/ul>\n<p><b>Najvi\u0161e napuhana vijest o ranjivosti<\/b>. Dodjeljuje se za najdramati\u010dnije i najop\u0161irnije osvjetljavanje problema na internetu i u medijima, posebno ako se na kraju ispostavi da ranjivost nije iskoristiva u praksi. Nagradu je dobio Bloomberg za <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49393\">priop\u0107enje<\/a><\/noindex> otkrivanje \u0161pijunskih \u010dipova u Super Micro plo\u010dama, \u0161to nije potvr\u0111eno, a izvor je naveo potpuno <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49417\">druga\u010dije informacije.<\/a><\/noindex>.<\/p>\n<p>U nominaciji su spomenuti: <\/p>\n<ul>\n<li class=\"l\"> Ranjivost u libssh koja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49453\">utjecala na<\/a><\/noindex> jednostavne poslu\u017eiteljske aplikacije (libssh se gotovo i ne koristi za poslu\u017eitelje), ali je predstavljena od strane NCC Group kao ranjivost koja omogu\u0107uje napad na bilo koji OpenSSH poslu\u017eitelj.\n<li class=\"l\"> Napad kori\u0161tenjem slika u DICOM formatu. Su\u0161tina je u tome da se mo\u017ee pripremiti izvr\u0161na datoteka za Windows koja \u0107e izgledati kao valjana slika u DICOM formatu. Ova datoteka se mo\u017ee u\u010ditati na medicinski ure\u0111aj i izvr\u0161iti.\n<li class=\"l\"> Ranjivost <noindex><a rel=\"nofollow\" href=\"https:\/\/thrangrycat.com\/\">Thrangrycat<\/a><\/noindex>, \u0161to omogu\u0107ava zaobila\u017eenje mehanizma sigurnog pokretanja na Cisco ure\u0111ajima. Ranjivost je svrstana u kategoriju napuhnanih problema jer zahtijeva root privilegije za napad, ali ako je napada\u010d ve\u0107 uspio dobiti root pristup, o kakvoj se sigurnosti mo\u017ee razgovarati. Ranjivost je istovremeno pobijedila u kategoriji najpodcijenjenijih problema, jer omogu\u0107ava uvo\u0111enje stalnog baga u Flash;\n<\/ul>\n<li class=\"l\"> <b>Najve\u0107i neuspjeh<\/b> (Najepi\u010dniji FAIL). Pobjeda je dodijeljena \u010dasopisu Bloomberg za niz senzacionalnih \u010dlanaka s dramati\u010dnim naslovima, ali izmi\u0161ljenim \u010dinjenicama, pre\u0161u\u0107ivanjem izvora, skliznutim u teorije zavjere, kori\u0161tenjem termina poput \u201ekiberneti\u010dko oru\u017eje\u201c, i neprihvatljivim generalizacijama. Me\u0111u ostalim nominacijama:\n<ul>\n<li class=\"l\"> Napad Shadowhammer na uslugu a\u017euriranja firmvera Asusa;\n<li class=\"l\"> Hakerski napad na skladi\u0161te BitFi, reklamirano kao \u201eneprobojan\u201c;\n<li class=\"l\"> Curanje osobnih podataka i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49366\">tokena<\/a><\/noindex> pristup na Facebook.\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51267\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie Awards 2019, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u044b \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0430\u0431\u0441\u0443\u0440\u0434\u043d\u044b\u0435 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. Pwnie Awards \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u043e\u043c \u041e\u0441\u043a\u0430\u0440\u0430 \u0438 \u0417\u043e\u043b\u043e\u0442\u043e\u0439 \u043c\u0430\u043b\u0438\u043d\u044b \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u043e, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2007 \u0433\u043e\u0434\u0430. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0431\u0435\u0434\u0438\u0442\u0435\u043b\u0438 \u0438 \u043d\u043e\u043c\u0438\u043d\u0430\u0446\u0438\u0438: \u041b\u0443\u0447\u0448\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37054","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Pwnie Awards 2019: \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:30+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:30+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pwnie Awards 2019: najzna\u010dajnije ranjivosti i propusti u sigurnosti | ProHoster","description":"Na konferenciji Black Hat USA u Las Vegasu odr\u017eana je ceremonija dodjele Pwnie nagrade.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Pwnie Awards 2019: \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0430\u043b\u044b \u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u041b\u0430\u0441 \u0412\u0435\u0433\u0430\u0441\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA \u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0430\u0441\u044c \u0446\u0435\u0440\u0435\u043c\u043e\u043d\u0438\u044f \u0432\u0440\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u043c\u0438\u0438 Pwnie.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/pwnie-awards-2019-naibolee-sushhestvennye-uyazvimosti-i-provaly-v-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:30+00:00","article:modified_time":"2019-10-31T19:15:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37054","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:53:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:34:24","updated":"2026-01-22 05:53:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=37054"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37054\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=37054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=37054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=37054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}