{"id":113257,"date":"2024-01-31T01:41:06","date_gmt":"2024-01-30T23:41:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor"},"modified":"2024-01-31T01:41:06","modified_gmt":"2024-01-30T23:41:06","slug":"rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","title":{"rendered":"A Tor projekt fejleszt\u00e9seinek m\u00e1sodik biztons\u00e1gi auditj\u00e1nak eredm\u00e9nyei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A Tor anonim h\u00e1l\u00f3zat fejleszt\u0151i k\u00f6zz\u00e9tett\u00e9k a m\u00e1sodik audit eredm\u00e9nyeit, amelyet a Radically Open Security v\u00e9gzett 2023 \u00e1prilisa \u00e9s augusztusa k\u00f6z\u00f6tt (az el\u0151z\u0151 auditot a Cure53 v\u00e9gezte 2022 novembere \u00e9s 2023 \u00e1prilisa k\u00f6z\u00f6tt). Az ellen\u0151rz\u00e9s \u00e9rintette a kimeneti csom\u00f3pontok m\u0171k\u00f6d\u00e9s\u00e9t biztos\u00edt\u00f3 k\u00f3dot, a Tor b\u00f6ng\u00e9sz\u0151t, az infrastrukt\u00fara elemeit (m\u00e9r\u00e9si adatok gy\u0171jt\u00e9se, SWBS, API Onionoo) \u00e9s a tesztel\u00e9shez sz\u00fcks\u00e9ges eszk\u00f6z\u00f6ket. A visszaellen\u0151rz\u00e9s f\u0151 c\u00e9lja a Tor h\u00e1l\u00f3zat sebess\u00e9g\u00e9nek \u00e9s megb\u00edzhat\u00f3s\u00e1g\u00e1nak n\u00f6vel\u00e9s\u00e9re tett int\u00e9zked\u00e9sek \u00e9rt\u00e9kel\u00e9se volt, mint p\u00e9ld\u00e1ul a Tor 0.4.8 verzi\u00f3ban bevezetett Conflux forgalommegoszt\u00f3 protokoll \u00e9s az Onion szolg\u00e1ltat\u00e1sok v\u00e9delm\u00e9t c\u00e9lz\u00f3 DoS t\u00e1mad\u00e1sok ellen tett int\u00e9zked\u00e9sek.    <\/p>\n<p>Az audit sor\u00e1n 17 sebezhet\u0151s\u00e9get azonos\u00edtottak, k\u00f6z\u00fcl\u00fck csup\u00e1n egyet soroltak a vesz\u00e9lyes kateg\u00f3ri\u00e1ba. N\u00e9gy sebezhet\u0151s\u00e9g k\u00f6zepes vesz\u00e9lyess\u00e9gi szintet kapott, 12 pedig a csek\u00e9ly vesz\u00e9lyess\u00e9g\u0171 probl\u00e9m\u00e1k k\u00f6z\u00e9 sorolhat\u00f3. A legvesz\u00e9lyesebb sebezhet\u0151s\u00e9get az onbasca (Onion Bandwidth Scanner) alkalmaz\u00e1sban tal\u00e1lt\u00e1k, amely a csom\u00f3pontok \u00e1tbocs\u00e1t\u00f3k\u00e9pess\u00e9g\u00e9nek szkennel\u00e9s\u00e9re szolg\u00e1l.     <\/p>\n<p>A sebezhet\u0151s\u00e9g azon a lehet\u0151s\u00e9gen alapul, hogy HTTP GET m\u00f3dszerrel k\u00fcldhet\u0151k k\u00e9r\u00e9sek, amelyek lehet\u0151v\u00e9 teszik a cross-site k\u00e9r\u00e9s hamis\u00edt\u00e1st (CSRF, Cross-Site Request Forgery), \u00e9s ezzel a t\u00e1mad\u00f3 lehet\u0151s\u00e9get kap arra, hogy saj\u00e1t h\u00eddcsom\u00f3pontokat adjon hozz\u00e1 az adatb\u00e1zishoz a \"bridge_lines\" param\u00e9ter manipul\u00e1l\u00e1s\u00e1val. P\u00e9ld\u00e1ul, a t\u00e1mad\u00f3 l\u00e9trehozhat egy weboldalt JavaScript k\u00f3ddal, amely fetch(&#171;http:\/\/127.0.0.1:8000\/bridge-state\/? bridge_lines=obfs4+0.0.0.000000+AAA+cert0+iat-mode0&#187;, \u00e9s ha ezt az oldalt megnyitja egy felhaszn\u00e1l\u00f3, akinek akt\u00edv sessionje van az Onion Bandwidth Scannerhez, akkor annak nev\u00e9ben az adatb\u00e1zisba hozz\u00e1ad\u00f3dik az IP &#171;0.0.0.0&#187;.    <\/p>\n<p>K\u00f6zepes vesz\u00e9lyess\u00e9gi szint\u0171 probl\u00e9m\u00e1k:  <\/p>\n<ul>\n<li class=\"l\"> Szolg\u00e1ltat\u00e1smegtagad\u00e1s a metrics-lib haszn\u00e1lat\u00e1val nagy t\u00f6m\u00f6r\u00edtett f\u00e1jl \u00e1tad\u00e1s\u00e1n kereszt\u00fcl \u2014 mivel a f\u00e1jl a mem\u00f3ri\u00e1ban ki van csomagolva, hasonl\u00f3 zip-bomb\u00e1t lehet \u00e1tadni (p\u00e9ld\u00e1ul 600 MB null\u00e1t csomagolva 0.0006 MB-ra), ami a rendelkez\u00e9sre \u00e1ll\u00f3 mem\u00f3ria kimer\u00fcl\u00e9s\u00e9t okozhatja.\n<li class=\"l\"> A tor-android-service (a Tor b\u00f6ng\u00e9sz\u0151ben Androidra alkalmazott) haszn\u00e1l egy elavult harmadik f\u00e9l tun2socks modult.\n<li class=\"l\"> Nulla b\u00e1jt \u00edr\u00e1sa a Tor kliens \u00e1ltal lefoglalt pufferen k\u00edv\u00fcl a read_file_to_str_until_eof funkci\u00f3 haszn\u00e1lata miatt, amely a m\u00e9retet a null\u00e1s karakter figyelmen k\u00edv\u00fcl hagy\u00e1s\u00e1val adja vissza.\n<li class=\"l\"> A Simple Bandwidth Scanner (sbws) vulnerability allows for the rollback of HTTPS connections to HTTP using a redirect to HTTP. A Tor exit node controlled by an attacker could potentially exploit this vulnerability to leak API tokens.          <\/ul>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60522\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043f\u0435\u0440\u0432\u044b\u0439 \u0430\u0443\u0434\u0438\u0442). \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u043a\u043e\u0434 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432, \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Tor Browser, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b (\u0441\u0431\u043e\u0440 \u043c\u0435\u0442\u0440\u0438\u043a, SWBS, API Onionoo) \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113257","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Tor | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-01-30T23:41:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-01-30T23:41:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47A m\u00e1sodik audit eredm\u00e9nyei a Tor projekt biztons\u00e1g\u00e1val kapcsolatban | ProHoster","description":"The developers of the anonymous network Tor have published the results of the second audit, conducted by Radically Open Security from April to August 2023 (following the previous audit from November 2022 to April 2023).","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043e\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0432\u0442\u043e\u0440\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Radically Open Security \u0441 \u0430\u043f\u0440\u0435\u043b\u044f \u043f\u043e \u0430\u0432\u0433\u0443\u0441\u0442 2023 \u0433\u043e\u0434\u0430 (\u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-30T23:41:06+00:00","article:modified_time":"2024-01-30T23:41:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/113257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=113257"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/113257\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=113257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=113257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=113257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}